No description available.

Huge growth of the Internet is due to the large number of websites and web services through which information is easily accessible. E-commerce and e-services obtain much private data from users for various reasons such as advertising, marketing, etc. Collection, storage, and usage of private data are subject to various standards, privacy laws, and regulations. To adhere to these legal requirements, many privacy services, such as secure data transmission, authentication, notice, and consent, are required. Inclusion of these required privacy services early in the life cycle of the software development is preferred and advocated, but not fully adhered to. Inclusion of privacy services in legacy software and currently developed software is required. We describe software architecture and a system for automatic inclusion of privacy services, under the supervision of privacy expert, into web pages after the development phase of the Software Development Life Cycle. This will help organizations to adhere to standards, privacy laws, and regulations when collecting private data online from its clients. We also describe a prototype that we have developed as a proof-of-concept to demonstrate the feasibility of our approach.

The growth of online activities in our daily lives has led to substantially increased attention on how organizations and their computer systems handle Personal Information (PI). Independently, the wide adoption of Web Service Architecture (WSA), for the integration of software, creates an opportunity to facilitate support for privacy by monitoring the use of PI by web services and enforcing applicable privacy policies. This thesis designs an agent for privacy monitoring and enforcement in a WSA environment and creates a prototype as a proof of concept. The agent is based on a specific multi-agent architecture for privacy compliance. The design of the agent has led to extension of the architecture to bring out its full potential in monitoring PI flows and enforcing privacy policies in a WSA environment. The evaluation of the prototype has led to suggestions on its implementation for an operational environment.

No abstract available. / Thesis (LL.M.)-University of KwaZulu-Natal, Durban, 2004.

No description available.

Vehicle-to-grid (V2G) network, which provides electricity charging service to the electric vehicles (EVs), is an essential part of the smart grid (SG). It can not only effectively reduce the greenhouse gas emission but also significantly enhance the efficiency of the power grid. Due to the limitation of the local electricity resource, the quality of charging service can be hardly guaranteed for every EV in V2G network. To this end, the multi-quality charging is introduced to provide quality-guaranteed service (QGS) to the qualified EVs and best effort service (BES) to the other EVs. To perform the multi-quality charging, the evaluation on the EV's attributes is necessary to determine which level of charging service can be offered to the EV. However, the EV owner's privacy such as real identity, lifestyle, location, and sensitive information in the attributes may be violated during the evaluation and authentication. In this thesis, a privacy-preserving multi-quality charging (PMQC) scheme for V2G network is proposed to evaluate the EV's attributes, authenticate its service eligibility and generate its bill without revealing the EV's private information. Specifically, by adopting ciphertext-policy attribute based encryption (CP-ABE), the EV can be evaluated to have proper charging service without disclosing its attribute privacy. By utilizing group signature, the EV's real identity is kept confidential during the authentication and the bill generation. By hiding the EV's real identity, the EV owner's lifestyle privacy and location privacy are also preserved. Security analysis demonstrates that PMQC can achieve the EV's privacy preservation, fine-grained access control on the EVs for QGS, traceability of the EV's real identity and secure revocation on the EV's service eligibility. Performance evaluation result shows that PMQC can achieve higher efficiency in authentication and verification compared with other schemes in terms of computation overhead. Based on PMQC, the EV's computation overhead and storage overhead can be further reduced in the extended privacy-preserving multi-quality charging (ePMQC) scheme.

No description available.

[Abstract]Determining the boundaries of the modern criminal law have become a difficult issue, particulary as 21st century criminal law struggles to deal with the widespread use of technology such as digital cameras, mobile phone cameras, video cameras, web cams, the Internet, email and blogosphere, privacy concerns and shifts in modern culture. This thesis discusses making and/or distributing visual recording, and issues which arise with the criminalisation of this conduct. Whilst various national and international jurisdictions have legislated in this regard, their responses have been inconsistent, and this thesis therefore takes a principled approach to examining the criminalisation of such conduct, examining constructs of privacy, harm, morality, culpability, punishment, social welfare and respect for individual autonomy. In framing criminal offences around this conduct, this thesis suggessts that the criminal law should respect the consent of the person visually recorded and consider the subjective culpability of the person making and/or distributing the visual recording.

Service-oriented architectures (SOA), and in particular Web services, have quickly become a popular paradigm to develop distributed applications. Nowadays, more and more organizations shift their core business to the Web services platform within which various interactions between the autonomous services occur. One of the widely accepted standards in the Web services platform is Business Process Execution Lan- guage for Web Services (BPEL4WS, or BPEL for short). BPEL defines a language to integrate Web services by creating composite Web services in the form of business processes following the service orchestration paradigm, and it enables organizations to focus on core competence and mission-critical operations while outsource every- thing else to reduce costs and time to market. However BPEL is deficient in privacy issues. The facts are: (1) service requestors?? personal information is fundamental to enable business processes (e.g., the mortgage approval business process); (2) privacy concerns have become one of the most important issues in Information Technology and has received increasing at- tention from organizations, consumers and legislators; (3) most organizations have recognized that dealing correctly and honestly with customers?? privacy concerns can have beneficial returns for their businesses, not only in terms of being compliant with laws and regulations but also in terms of reputation and potential business op- portunities. If not addressed properly, privacy concerns may become an impediment to the widespread adoption of BPEL. Privacy issues have many aspects, the privacy concerns of potential service re- questor (i.e., client) and the privacy concerns of service provider (i.e., organization) are two of them. Service requestor specifies his/her privacy concerns as privacy preference, while service provider defines and publishes its privacy policy to specify its privacy promises. Before requestor accesses certain service, he/she likes to know whether the service provider will respect his/her privacy preference. Otherwise, the requestor may seek the desired service from somewhere else. On the other hand,even though most organizations publish their privacy promises, it will be more convincing if customers are assured that such privacy promises are actually kept within the organizations. In this thesis, we propose a privacy enforcement framework for business processes. In particular, we focus on those that are automated using BPEL. The framework consists of two parts. One focuses on the service requestors?? perspective of privacy, the other concentrates on the privacy concerns of the business process owner (i.e., the service provider). More specifically, the first part of the framework is based on description logic, and allows to represent privacy concepts and perform some rea- soning about these concepts. The reasoning engine will check requestor??s privacy preference against the service provider??s published privacy promises before the re- questor accesses the desired service. The second part of the framework facilitates the service provider to enforce its privacy policy within all its business processes throughout the life cycle of personal data. The privacy enforcement can be achieved step by step: privacy inspection, privacy verification and privacy obligation man- agement. The first step, privacy inspection, aims to identify which activity needs the involvement of what personal data. The second step, privacy verification, is to verify the correctness of designed BPEL business processes in terms of privacy. The third step is to enforce the privacy by managing the fulfillment of the obligation during the execution of business process. The privacy enforcement framework presented in the thesis has been implemented. The first part of the framework is implemented in the Privacy Match Engine prototype. For the second part of the framework, as different parts of the privacy policy need to be enforced at different stages of the life cycle of business processes, the implementation consists of a privacy verification tool and a privacy obligation management system.

Proefschrift Universiteit van Amsterdam. / Met lit. opg. - Met samenvatting in het Engels.