IBM Zurich Research Lab © 2004 IBM Corporation PART 5 Enterprise Privacy Policies

IBM Zurich Research Lab A Toolkit for Managing Enterprise Privacy Policies © 2004 IBM Corporation Motivation Your personal data will be handled with care ???

IBM Zurich Research Lab A Toolkit for Managing Enterprise Privacy Policies © 2004 IBM Corporation Consumers are concerned about privacy  $15B in e-commerce lost in 2001(27% of projected revenues for 2001)  50%+ extremely/very concerned about online privacy, 30% somewhat concerned  37% current online consumers would buy more if not worried about privacy  34% internet users who don't buy online would start if privacy concerns addressed  Only 6% think benefits of giving up personal information outweigh privacy concerns Source of survey data: Forrester 10/ and are taking action  78% say have refused to give information to a business because too personal or not really needed (42% in 1990)  80% rate privacy protection of consumer information as important in their selection of companies to patronize  Almost 50% believe they have personally been the victim of a consumer privacy invasion Source of survey data: PCG and Louis Harris poll

IBM Zurich Research Lab A Toolkit for Managing Enterprise Privacy Policies © 2004 IBM Corporation Focus on Enterprise Privacy Technologies Privacy-enhancing Infrastructure Client Organization Privacy-enhancing Infrastructure  Client-side PETs to ƒ minimize data disclosed ƒ filter data received ƒ keep track of data ƒ control multiple identities ƒ...  Infrastructure PETs to ƒ hide relations ƒ unlinkable credentials ƒ Mixes ƒ... What happens to the data once disclosed? How to enable businesses to work with pseudonyms? How to authenticate and authorize, relative to a pseudonym?

IBM Zurich Research Lab A Toolkit for Managing Enterprise Privacy Policies © 2004 IBM Corporation Life-Cycle of Personal Data Subject or Guardian or Authority 4. Anonymized use give consent update access withdraw consent 3. Depersonalized use anonymize release 2. Personalized use disclose utilize delete repersonalize depersonalize form = data + rules Law, regulations, privacy agreements, preferences, consent Data Subject notify Rules authorization, obligation request... 1a. Collection 1b. Control Data User

IBM Zurich Research Lab A Toolkit for Managing Enterprise Privacy Policies © 2004 IBM Corporation Motivation  Enterprise privacy policies and their enforcement are a fundamental issue in practice: ► Reflect different legal regulations ► Used to capture promises made to customers ► More restrictive internal practices ► Incorporating customer preferences  Privacy policies may be authored, maintained, and audited in a distributed fashion  Important task is to provide tools for such management of enterprise privacy policies

IBM Zurich Research Lab A Toolkit for Managing Enterprise Privacy Policies © 2004 IBM Corporation Motivation  Policy refinement ► Roughly, one policy refines another if using the first policy automatically also fulfills the second one. ► Refinement as the central notion for many situations in policy management, e.g., checking whether an enterprise policy adheres to legal regulations  Policy composition ► Notion of constructively combining two policies ► Several notions exist for different purposes:  Mandatory sub-policies

IBM Zurich Research Lab A Toolkit for Managing Enterprise Privacy Policies © 2004 IBM Corporation Outline 1.The Platform for Enterprise Privacy Policies (E-P3P) 2.A Toolkit for Managing E-P3P Enterprise Privacy Policies 3.Summary

IBM Zurich Research Lab A Toolkit for Managing Enterprise Privacy Policies © 2004 IBM Corporation E-P3P/EPAL  Vocabulary defines scope: ► Data, users, and purposes as hierarchies ► Operations, obligations as lists  Rules authorize access: A [user] should be [allowed or denied] the ability to perform [action] on [data] for [purpose] under [condition] yielding an [obligation]. Example: " can be used for the book-of-the-month club if consent has been given and age is more than 13":  default ruling: allow, deny, don’t care

IBM Zurich Research Lab A Toolkit for Managing Enterprise Privacy Policies © 2004 IBM Corporation EPAL policy - a list of rules, sorted by priority ► Elements of a rule user u 1, u 2, … e.g., “borderless-books” action a 1, a 2, … e.g., “read” for purpose p 1, p 2, … e.g., “book-of-the-month-club” on data d 1, d 2, … e.g., “ ” under condition c 1, c 2, … e.g., “age >= 18“ yielding decision r 1, r 2, … e.g., “allow” and an obligation o 1, o 2, … e.g., “write audit”

IBM Zurich Research Lab A Toolkit for Managing Enterprise Privacy Policies © 2004 IBM Corporation  Policy maps any well-defined authorization request (user, action, purpose, data, variable assignment) to decision  {allow, deny, don’t care} + obligations  Completion of rule set through inheritance ► allow inherits down along hierarchies, deny inherits up and down  Check rules in given order for applicability ► rule covers request directly / by inheritance ► condition/s are satisfied (More sophisticated issue: Incomplete variable assignments: If a deny-rule could still apply, then we let it apply If an allow-rule may not apply, then we let it not apply )  Decision ► First applicable deny/allow-rule decides + take rule’s obligation/s ► If there is none then take default ruling Semantics of EPAL: Authorization

IBM Zurich Research Lab A Toolkit for Managing Enterprise Privacy Policies © 2004 IBM Corporation Outline 1.The Platform for Enterprise Privacy Policies (E-P3P) 2.A Toolkit for Managing E-P3P Enterprise Privacy Policies 3.Summary

IBM Zurich Research Lab A Toolkit for Managing Enterprise Privacy Policies © 2004 IBM Corporation Summary of Tools in the Toolbox  Policy refinement for comparing policies ► A policy refines another if using the first policy automatically also satisfies the second one. ► Central notion in policy management: compliance with legal regulations  The main tool is policy composition ► Notion of constructively combining two policies ► For different purposes, several notions exist AND, OR, Ordered Composition ► Operators collected in an algebraic structure together with results about the relationship between composition and refinement  Mandatory sub-policies P 1 < P 2 P 1 & P 2 P 1 + P 2  < P 1 P 2 M1D1 P 1  P 2

IBM Zurich Research Lab A Toolkit for Managing Enterprise Privacy Policies © 2004 IBM Corporation Policy Refinement Refinement intuitively means to add details to an existing policy while preserving the original privacy statements: ► Ruling: Whenever the original policy allows (denies) a request, the refined policy also allows (denies) the request. ► Obligation: Fulfillment of the refined obligations implies fulfillment of the original obligations for every request.  (u, a, d, p, ass) (r 1, o 1 )(r 2, o 2 ) P1P1 P2P2 < r 1 refines r 2 and o 1 refines o 2

IBM Zurich Research Lab A Toolkit for Managing Enterprise Privacy Policies © 2004 IBM Corporation Policy Refinement  What does it mean that r 1 refines r 2 (r 1 < r 2 ) ? ► If r 2  {deny, allow} then r 1 = r 2 (weak form also: r 2 = allow and r 1 = deny) ► If r 2 = out-of-scope then r 1 can be arbitrary ► If r 2 = don’t care then r 1  {deny, allow, don’t care}  Meaning of “o 1 refines o 2 ” slightly more complicated  Simply using o 1 => o 2 not suited, e.g., P 1 : o 1 = “delete now”, o = “delete in a day” with o 1 => o P 2 : o = “delete in a day”, o 2 = “delete in a week” with o => o 2 Now “o 1 refines o 2 ” if there exists o  O 1  O 2 such that o 1 => o => o 2 o1o1 o o2o2 P1P1 P2P2

IBM Zurich Research Lab A Toolkit for Managing Enterprise Privacy Policies © 2004 IBM Corporation Algebra for Policy Composition and Refinement  Policy Composition: Notion of constructively combining two policies  Collection of composition operators that are shown to work together in intuitively meaningful ways ► Ordered Composition: Master / Slave composition: ► Logical composition: Build the conjunction or the disjunction of two policies ► Scoping Operation: Restrict a policy to sub-scope  Show suitable relations among these operators, e.g., distributivity, associativity, refinement relations etc.

IBM Zurich Research Lab A Toolkit for Managing Enterprise Privacy Policies © 2004 IBM Corporation Ordered Composition  Master / Slave Composition  Achievable by precedence shift + some tedious details (dealing with out-of-scope errors, default rulings, etc.)  Advantage: Ordered composition always refines Master! P1P1 P2P2 High Precedence P2P2 P1P1  <

IBM Zurich Research Lab A Toolkit for Managing Enterprise Privacy Policies © 2004 IBM Corporation Logical Composition (AND)  AND-Composition: Design a new policy that behaves as the conjunction  P 3 defined semantically as follows from the following equivalence class: If P 1  (r 1,o 1 ) and P 2  (r 2,o 2 ) then P 3  (r 1,o 1 ) AND (r 2,o 2 ) = (r 1 AND r 2, o 1  o 2 )  Very useful in practice (take all applicable legal regulations and combine them into one policy possible with customer preferences, existing sticky policies etc.)  Main Question: Does such a policy P 3 always exist? P1P1 P2P2 P3P3 & No!

IBM Zurich Research Lab A Toolkit for Managing Enterprise Privacy Policies © 2004 IBM Corporation Excurse: Expressiveness of E-P3P  Let P be a policy, q a request, and  an assignment on the variables in P. Then we have 1.eval(P,q,  ) = (+,o)   q* < q: eval(P,q*,  ) = (+,o*) 2.eval(P,q,  ) = (-,o)   q* > q: eval(P,q*,  ) = (-,o*) 3.eval(P,q,  ) = (-,o)  (1 out of the following three cond. holds) 1. q is a leaf. 2.  q* < q: eval(P,q*,  ) = (+,o*) 3.  q* < q: eval(P,q*,  ) = (-,o*) with o = o* 4.eval(P,q,  ) = (don’t care,o)  o = 

IBM Zurich Research Lab A Toolkit for Managing Enterprise Privacy Policies © 2004 IBM Corporation Well-founded E-P3P Policies  AND/OR-Composition not possible for all E-P3P policies!  Main inherent Problem: Rules of parent element might not be related to rules of the children  Possible solution: Consider only those policies in which rules of parent elements are determined by rules of their children  well-founded policies  For well-founded policies, AND/OR – composition is well-defined

IBM Zurich Research Lab A Toolkit for Managing Enterprise Privacy Policies © 2004 IBM Corporation Basic Algebraic Results (well-founded EPAL)  Idempotency: P 1 & P 1  P 1 P 1 + P 1  P 1  Commutativity: P 1 & P 2  P 2 & P 1 P 1 + P 2  P 2 + P 1  Associativity: (P 1 & P 2 ) & P 3  P 1 & (P 2 & P 3 ) (P 1 + P 2 ) + P 3  P 1 + (P 2 + P 3 )  Distributivity: P 1 + (P 2 & P 3 )  (P 1 + P 3 ) & (P 1 + P 3 ) P 1 & (P 2 + P 3 )  (P 1 & P 2 ) + (P 1 & P 3 )  Strong Absorption: P 1 + (P 1 & P 2 ) < P 1 but not P 1 & (P 1 + P 2 ) < P 1 Legend: = Ordered composition ”+” = OR “&” = AND “  ” = equivalence “<“ = refinement  <

IBM Zurich Research Lab A Toolkit for Managing Enterprise Privacy Policies © 2004 IBM Corporation Advanced Algebraic Results (well-founded EPAL)  Multiplicative Refinement (conjunction is stricter than both policies): ► P 1 & P 2 < P 1 ► P 1 & P 2 < P 2  Additive Refinement (each policy is at least as strict as the disjunction): ► P 1 P 1 + P 2 ► P 2 P 1 + P 2  Master / Slave Refinement: ► P 1 P 2 < P 1  Operator Refinement: ► P 1 & P 2 P 1 P 2 P 1 + P 2  <  < Legend: = Ordered composition ”+” = OR “&” = AND “  ” = equivalence “<“ = refinement “<“ = weak refinement  <    <  <  <  < 

IBM Zurich Research Lab A Toolkit for Managing Enterprise Privacy Policies © 2004 IBM Corporation Outline 1.The Platform for Enterprise Privacy Policies (E-P3P) 2.A Toolkit for Managing E-P3P Enterprise Privacy Policies 3.Summary

IBM Zurich Research Lab A Toolkit for Managing Enterprise Privacy Policies © 2004 IBM Corporation  Toolkit for maintaining, authoring, and auditing enterprise privacy languages  Mainly driven by real-life demands on privacy policies, we have introduced the following: ► The notion of refinement between privacy policies as the central notion of almost any operation on privacy policies ► Different notions of privacy policy composition ► Algebraic structure and results on composition and refinement operators ► Two-layered policies to specifically deal with enterprise internal policy management ► Treatment of incomplete data in privacy policy evaluation ► Explicit representation of conditions languages (context information)  All these cases together allow for capturing a variety of real-life use cases, i.e., safely changing companies promises with respect to customer requirements while abiding by the law Summary