Towards Accountable Management of Privacy and Identity Information

1
Towards Accountable Management of
Privacy and Identity Information

• Marco Casassa Mont
• Siani Pearson
• Pete Bramhall
• Trusted Systems Laboratory
• Hewlett-Packard Labs, Bristol, UK
• ESORICS 2003, 13-15 October 2003
• Gjovik, Norway

2
Presentation Outline

• Problem Outline
• Related Work
• Privacy Management Model
• Realisation
• Discussion
• Conclusions

3
Privacy and Identity Information
E-Commerce
Government
Person Profiles
Business
Personal
4
Scenario Multiparty Interactions
Multiparty Transaction / Interaction
User
Negotiation of Privacy Policy
Services
Policies
Provision of Identity Profile Data
Data
Identity/ Profile Disclosure
Enterprise
Accountability
Enterprise
Enforcement
User Specification
5
Related Work
EPAL
Enterprise EnforcementTools
Legal
Proof, Evidence,Prosecution?
Who Controls?
EU vs US
Personal Data
User Understanding
IdentityServices
P3P
Point to point
Eg MS Passport
Privacy Seal
Predefined Policies
Enforcement?
Club
6
Presentation Outline

• Problem Outline
• Related Work
• Privacy Management Model
• Realisation
• Discussion
• Conclusions

7
Privacy Management Model
User
Enterprise
User DB
P
Transaction
User Involvement
Enforcement
Tracing and Audit Authority
Accountable?Transparency
Policy Compliance
Evidence
8
Multi-Party Scenario
?
7
9
Privacy Model -- Summary

• User Centric
• Specifies Policies
• Binds with their profile
• TAA aids user
• Manages and records release of data
• Transparency aids accountability
• Validates and records enforcement mechanism
• Enterprise
• Makes audited promises concerning personal data
• Allows validation and assessment of enforcement
  mechanism
• Can Still Abuse Privacy

10
Presentation Outline

• Problem Outline
• Related Work
• Privacy Management Model
• Realisation
• Discussion
• Conclusions

11
Realisation Issues
Strong Binding of Policy and Data
IBE
EnforcementVerifiability
TCGTagged OS
12
What is Identifier-based Encryption (IBE)?
User
Enterprise
Get decrypt Key,e
Choose e
Encrypt
Encrypted Msg
Decrypt
Msg
Msg
Profile
Enterprise mustSatisfy Policy
PrivacyPolicy
Public details
TAA Enforces Policy
Compute public details
Audit
Generate Decryption Key
Secrets s
13
Trusted Platforms -- TCG
Server
Root of Trust
Apps OS Bios
User
ID
Issuer
Query Status
Measures Boot, OSand APP loading
14
Tagged Operating Systems
Tagged OS
Data
Tagged Datafollowed throughmemory
Tagged
Kernel Function
PEP
Policy internal allow external encrypt
with policy
PolicyTagOperation(Destination)
15
Control Flow
Enterprise
TAA
Server
Request for IBE decryption Key
Keys
IBE Encrypt Key PPolicy
Apps Tagged OS Bios
Context, Id, Purpose
Dataflow Policies
Check Policy
ID
User
Check Machine Status
Record Request
16
Sticky Privacy Policies
Example of high-level Sticky Policy (XML format)
Reference to TA(s)
Constraints/ Obligations
Platform/OS Constraint
Actions (User Involvement)
IBE encryption keys can define any kind of
privacy constraints or terms and conditions to be
deployed and enforced at different levels of
abstractions (application/service, OS, platform)
17
High-level System Architecture

• Based on the IBE Model
• Privacy Policies are
• represented as
• IBE Encryption Keys
• Confidential data is
• encrypted with IBE
• encryption keys
• IBE encryption keys
• stick with the encrypted
• data (at least till the first
• de-obfuscation of the data )
• The Tracing and Auditing
• Authority is an (IBE based)
• Trust Authority.
• Leveraging Trusted Platforms and

18
Presentation Outline

• Problem Outline
• Related Work
• Privacy Management Model
• Realisation
• Discussion
• Conclusions

19
Discussion
Enterprise 1
Personal Data
Policy Engine
Sticky Privacy Policies
Enterprise 2

Enforcement via Trust Authority


Policy Engine
Enforcement By Trusted Platforms and Tagged
OS (Work in Progress)
Trusted Audit
Policy Engine
Tracing, Audit Authority (TAA)
20
Conclusion

• Presented a model for accountable management of
  private identity data
• User gains more control
• Aided by (their) third party
• Audit of legitimate requests
• Shared with the user
• Checks on enforcement mechanisms
• Linked to TAA
• Enterprise is accountable for use and enforcement
• Links to policy based enforcement

21
(No Transcript)