• 제목/요약/키워드: Platform for Privacy Preference(P3P)

검색결과 2건 처리시간 0.018초

프라이버시 보호 상황인식 시스템 개발을 위한 쌍방향 P3P 방법론 (A Mutual P3P Methodology for Privacy Preserving Context-Aware Systems Development)

  • 권오병
    • Asia pacific journal of information systems
    • /
    • 제18권1호
    • /
    • pp.145-162
    • /
    • 2008
  • One of the big concerns in e-society is privacy issue. In special, in developing robust ubiquitous smart space and corresponding services, user profile and preference are collected by the service providers. Privacy issue would be more critical in context-aware services simply because most of the context data themselves are private information: user's current location, current schedule, friends nearby and even her/his health data. To realize the potential of ubiquitous smart space, the systems embedded in the space should corporate personal privacy preferences. When the users invoke a set of services, they are asked to allow the service providers or smart space to make use of personal information which is related to privacy concerns. For this reason, the users unhappily provide the personal information or even deny to get served. On the other side, service provider needs personal information as rich as possible with minimal personal information to discern royal and trustworthy customers and those who are not. It would be desirable to enlarge the allowable personal information complying with the service provider's request, whereas minimizing service provider's requiring personal information which is not allowed to be submitted and user's submitting information which is of no value to the service provider. In special, if any personal information required by the service provider is not allowed, service will not be provided to the user. P3P (Platform for Privacy Preferences) has been regarded as one of the promising alternatives to preserve the personal information in the course of electronic transactions. However, P3P mainly focuses on preserving the buyers' personal information. From time to time, the service provider's business data should be protected from the unintended usage from the buyers. Moreover, even though the user's privacy preference could depend on the context happened to the user, legacy P3P does not handle the contextual change of privacy preferences. Hence, the purpose of this paper is to propose a mutual P3P-based negotiation mechanism. To do so, service provider's privacy concern is considered as well as the users'. User's privacy policy on the service provider's information also should be informed to the service providers before the service begins. Second, privacy policy is contextually designed according to the user's current context because the nomadic user's privacy concern structure may be altered contextually. Hence, the methodology includes mutual privacy policy and personalization. Overall framework of the mechanism and new code of ethics is described in section 2. Pervasive platform for mutual P3P considers user type and context field, which involves current activity, location, social context, objects nearby and physical environments. Our mutual P3P includes the privacy preference not only for the buyers but also the sellers, that is, service providers. Negotiation methodology for mutual P3P is proposed in section 3. Based on the fact that privacy concern occurs when there are needs for information access and at the same time those for information hiding. Our mechanism was implemented based on an actual shopping mall to increase the feasibility of the idea proposed in this paper. A shopping service is assumed as a context-aware service, and data groups for the service are enumerated. The privacy policy for each data group is represented as APPEL format. To examine the performance of the example service, in section 4, simulation approach is adopted in this paper. For the simulation, five data elements are considered: $\cdot$ UserID $\cdot$ User preference $\cdot$ Phone number $\cdot$ Home address $\cdot$ Product information $\cdot$ Service profile. For the negotiation, reputation is selected as a strategic value. Then the following cases are compared: $\cdot$ Legacy P3P is considered $\cdot$ Mutual P3P is considered without strategic value $\cdot$ Mutual P3P is considered with strategic value. The simulation results show that mutual P3P outperforms legacy P3P. Moreover, we could conclude that when mutual P3P is considered with strategic value, performance was better than that of mutual P3P is considered without strategic value in terms of service safety.

S-P3P: P3P 표준을 반영한 보안 프로토콜 설계 및 분석 (Design and Analysis of a Secure Protocol for the P3P Standard)

  • 최현우;장현수;고광선;김구수;엄영익
    • 정보처리학회논문지C
    • /
    • 제14C권7호
    • /
    • pp.545-552
    • /
    • 2007
  • P3P는 웹 서비스 제공자와 사용자 사이에서 사용되는 개인정보의 정의, 전송, 수집, 그리고 유지 등에 대한 정책을 정의하고 협상하기 위한 표준이다. 현재까지 제시된 P3P 표준은 주로 사용자의 개인정보보호 정책과 웹 서버의 P3P 정책을 정의하고 두 정책을 비교하는 방법을 제공하고 있다. 그러나 사용자와 웹 서버 사이의 개인정보 및 데이터의 안전한 전송을 위한 세부 기능과 이 때 발생할 수 있는 문제점에 대해서는 명확하게 제시하고 있지 않다. 이러한 문제점을 해결하기 위해서, 본 논문에서는 Secure P3P(S-P3P) 프로토콜을 제안한다. 제안 프로토콜은 현재의 P3P 표준을 위한 보안 프로토콜로서 웹 서버와 사용자 간의 상호 인증 기능을 제공하고, 전송되는 메시지와 데이터의 무결성과 기밀성을 보장한다. 또한, S-P3P 프로토콜은 사용자로부터 웹 서버에 전송되는 개인정보의 송수신에 대한 부인방지 기능을 제공한다.