Expressing Privacy Policies Using Authorization Views

In this paper, we design a rule-based privacy policy for the RFID Ecosystem, an RFID-based ubiquitous computing system. We start from the physical access control (PAC) rule (Kriplean et al., IEEE Pervasive Computing 2007) that provides a default level of privacy but constrains the possible set of applications. We extend it by using principled ways of defining other access control rules that retain the simplicity of PAC and yet provide increased flexibility for users and applications. We then propose authorization views as a database technique to implent rule-based privacy policies and demonstrate the use of authorization views over the privacy policy designed for the RFID Ecosystem.

在本文中，我们为射频识别（RFID）生态系统（一个基于RFID的普适计算系统）设计了一种基于规则的隐私策略。我们从物理访问控制（PAC）规则（Kriplean等人，《IEEE普适计算》2007年）入手，该规则提供了默认的隐私级别，但限制了可能的应用集合。我们通过使用有原则的方法来定义其他访问控制规则对其进行扩展，这些规则保留了PAC的简单性，同时为用户和应用提供了更大的灵活性。然后，我们提出授权视图作为一种数据库技术来实现基于规则的隐私策略，并展示了在为RFID生态系统设计的隐私策略上使用授权视图的情况。