1. Meng Yan

2. Introduction In fact, your online actions may be monitored by unauthorized parties logged and preserved for future access years later

3. Principles Controlling Over Data Collection Limitation Inform Data Security Access Right

4. Principles Protecting Anonymity Anonymity Pseudonymity Unobservability Unlinkablity Deniability

5. Principles Separating User from Unwanted Data

6. Classification Based on Application Area: Privacy Policy Language Anonymity Technology Authentication Management

7. Classification Privacy Policy Language Application Area Formalize privacy policies Help surfers understand privacy policies Help websites express privacy policies Representative PPL P3P EPAL XACML

8. Classification Privacy Policy Language P3P Give a standard format of privacy policy User agent of P3P interprets privacy policy to users User need not to read privacy policy at every website they visit

9. Classification Privacy Policy Language EPAL The first language that allows websites to express privacy policies of rule-based complexity directly in a standards-based markup language

10. Classification Privacy Policy Language eXtensible Access Control Markup Language (XACML) Describe privacy policy Describe request/response

11. Classification Anonymity Technology Application Area Anonymous browsing and publishing Classification (based on implementation_method) Remove user’s information Anonymous HTTP proxy server Mark-up user’s information Mix-based System Crowd

12. Classification Anonymity Technology Anonymous HTTP proxy server HTTP Request Modified HTTP Request HTTP Server User HTTP Proxy Server N HTTP Proxy Server 1

13. Classification Anonymity Technology Mix-based System Server User Onion Router Onion Proxy Entry Exit

14. Classification Authentication Management Application Area Protect Identity Authenticating Information (AI) What user knows (password) What user has (fingerprints, credit card number) What user does (signature) Classification Two-factor authentication (relies on two AI) Multi-factor authentication (relies on more than two AI)

15. Comparison P3P, EPAL, XACML P3PEPALXACML Purpose For user preference For enterprise- internal privacy policies& control access Flexibility Bad (Pre-defined policies) Fair (flexible policies but not scalable) Good (flexible policies &allow reference )

16. Comparison Crowd vs. mix-based system Common Mix-based Systems message delivery paths are fixed and messages are encrypted. Crowd paths are dynamically configured as a message traverses the network and each crowd member encrypts the message for the next member of the path.

17. Conclusion PET Anonymity Technology Privacy Policy Language (PPL) Authentication Management P3P EPAL & XACML HTTP proxy server Mix-based system &(Crowd) Two-factor Multi-factor

18. Thank you!