A Privacy-Enhanced Access Control Model

Privacy is one of the most important issues in providing high-quality ubiquitous network services to users over the Internet. Although several privacy aware access control models have been proposed in recent years, these models still rely mostly on the traditional access control models designed primarily for security. When privacy becomes a main concern, these models are no longer adequate. In this paper, we propose a three-dimensional access control model enhanced with privacy and show that our model can be used as a general method for defining privacy requirements in systems that respect and protect user privacy. By introducing the notions of privacy-concerning subjects and privacy access rights and enhancing the traditional two-dimensional access control models with a third dimension, we demonstrate that our privacy-enhanced access control model can better describe and support user requirements for protecting private information when access control is used for making access decisions to user information.