A formal approach to access control and consent management

点击翻译按钮获取中文摘要

Personal data are widely distributed in enterprise information systems (IS) and shared across thousands of users. Protecting the confidentiality and integrity of personal data is critical in several domains like health, banking and governmental programs. Access control is responsible for controlling who has access to what and when in an IS. The objective of this research proposal is to develop a formal framework for controlling access to personal data stored in information systems. This framework shall ensure that personal data is accessed according to the requirements of the organisation and the requirements of the individuals related to the personal data. This framework shall address the following issues. First, it must include a proper mechanism for modeling IS users, individuals and their personal data, and access control rules, which together form an access control policy. Second, it must include a mechanism for specifying and verifying properties of an access control policy, to ensure that both individual requirements and organisational requirements are taken into account. Third, it must include an access control engine that can apply an access control policy to an access request. Finally, this framework should be general enough to be used in a variety of application domains; in others words, we need to transition from an ad hoc way of developing access control systems to a systematic approach based on a sound and powerful model of what access control consist of.