Article: Minimising disclosure of client information in credential-based interactions Journal: International Journal of Information Privacy, Security and Integrity (IJIPSI) 2012 Vol.1 No.2/3 pp.205 - 233 Abstract: The advancements in ICT allow people to use and access resources and services on the web anywhere and anytime. Servers offering resources typically require users to release information about them, which is then used to enforce possible access policies on the offered services. Effective access to such resources requires the development of approaches for enabling the user to organise and manage all her credentials and regulate their release when interacting with other parties over the web. In this paper, we provide a means for the user to specify how much she values the release of different properties, credentials, or combinations thereof as well as additional constraints that she might impose on information disclosure. Exploiting a graph modelling of the problem, the user can determine the credentials and properties to disclose to satisfy a server request while minimising the sensitivity of the information disclosed. We develop a heuristic approach that shows execution times compatible with the requirements of interactive access to web resources. Inderscience Publishers - linking academia, business and industry through research

Title: Minimising disclosure of client information in credential-based interactions

Authors: Claudio A. Ardagna; Sabrina De Capitani di Vimercati; Sara Foresti; Stefano Paraboschi; Pierangela Samarati

Addresses: DTI – Università degli Studi di Milano, 26013 Crema, Italy. ' DTI – Università degli Studi di Milano, 26013 Crema, Italy. ' DTI – Università degli Studi di Milano, 26013 Crema, Italy. ' DIIMM – Università degli Studi di Bergamo, 24044 Dalmine, Italy. ' DTI – Università degli Studi di Milano, 26013 Crema, Italy

Abstract: The advancements in ICT allow people to use and access resources and services on the web anywhere and anytime. Servers offering resources typically require users to release information about them, which is then used to enforce possible access policies on the offered services. Effective access to such resources requires the development of approaches for enabling the user to organise and manage all her credentials and regulate their release when interacting with other parties over the web. In this paper, we provide a means for the user to specify how much she values the release of different properties, credentials, or combinations thereof as well as additional constraints that she might impose on information disclosure. Exploiting a graph modelling of the problem, the user can determine the credentials and properties to disclose to satisfy a server request while minimising the sensitivity of the information disclosed. We develop a heuristic approach that shows execution times compatible with the requirements of interactive access to web resources.

Keywords: privacy; user credentials; minimal disclosure; portfolio management; client information; information disclosure; graph modelling; security; web resources; web access.

DOI: 10.1504/IJIPSI.2012.046133

International Journal of Information Privacy, Security and Integrity, 2012 Vol.1 No.2/3, pp.205 - 233

Published online: 23 Aug 2014 *

Full-text access for editors Full-text access for subscribers Purchase this article Comment on this article

Title: Minimising disclosure of client information in credential-based interactions

Keep up-to-date