Principles of Data Protection

Course code: 2IMS25

Academic Year: 2024/2025

Quartile 1

Time: Tuesday, hours 3 and 4 (from 10:45 till 12:30)
Place: Auditorium 7

Time: Friday, hours 7 and 8 (from 15:30 till 17:15)
Place: Luna 1.050

The slides are being updated during the course. They are available on CANVAS.

Assessment

Grades for the course are based on a final exam. The final exam is a 3 hours closed-book exam covering ALL topics presented during the course and mandatory papers.

Final exam

Date: 6 November 2024 9:00-12:00
Place: Vertigo 3.15 A, Vertigo 3.15 B, Vertigo 4.06 A, Vertigo 4.06 B, Vertigo 4.15 A

Date: 29 January 2025 18:00-21:00
Place: TBD

Course Outline (numbers correspond to lectures):

(3/9) Introduction. (Nicola Zannone)
(6/9) Discretionary Access Control. (Nicola Zannone)
- (Obligatory) Michael A. Harrison, Walter L. Ruzzo, and Jeffrey D. Ullman. Protection in Operating Systems. Communications of the ACM 19(8): 461-471. 1976
- (Obligatory) Butler W. Lampson. Protection. ACM SIGOPS Operating Systems Review 8(1): 18-24. 1974.
- (Suggested) Pierangela Samarati, Sabrina De Capitani di Vimercati. Access Control: Policies, Models, and Mechanisms. Revised versions of lectures given during the IFIP WG 1.7 International School on Foundations of Security Analysis and Design on Foundations of Security Analysis and Design: Tutorial Lectures.
(10/9) Mandatory Access Control. (Nicola Zannone)
- (Obligatory) Ravi S. Sandhu. Lattice-Based Access Control Models. Computer 26(11):9-19. 1993.
- (Suggested) Pierangela Samarati, Sabrina De Capitani di Vimercati. Access Control: Policies, Models, and Mechanisms. Revised versions of lectures given during the IFIP WG 1.7 International School on Foundations of Security Analysis and Design on Foundations of Security Analysis and Design: Tutorial Lectures.
(13/9) Role-Based Access Control. (Nicola Zannone)
- (Obligatory) R. S. Sandhu, E.J. Coyne, H.L. Feinstein, C.E. Youman. 1996. Role-Based Access Control Models, IEEE Computer 29(2): 38-47
- (Suggested) Pierangela Samarati, Sabrina De Capitani di Vimercati. Access Control: Policies, Models, and Mechanisms. Revised versions of lectures given during the IFIP WG 1.7 International School on Foundations of Security Analysis and Design on Foundations of Security Analysis and Design: Tutorial Lectures.
(17/9) Role-Based Trust Management I. (Sandro Etalle)
- (Obligatory) Ninghui Li, William H. Winsborough, John C. Mitchell Distributed Credential Chain Discovery in Trust Management. (only the syntax and the backward algorithms)
- (Suggested) Marianne Winslett. An Introduction to Trust Negotiation. iTrust 2003: 275-283.
(20/9) Role-Based Trust Management II. (Sandro Etalle)
- (Obligatory) Ninghui Li, William H. Winsborough, John C. Mitchell Distributed Credential Chain Discovery in Trust Management. (only the syntax and the backward algorithms)
- (Obligatory) Czenko, M.R. and Etalle, S. and Li, D. and Winsborough, W.H. (2007) An Introduction to the Role Based Trust Management Framework RT. (until Section 3.1 included)
(24/9) Attribute-Based Access Control. (Nicola Zannone)
- (Recommended) Vincent C. Hu, David Ferraiolo, Rick Kuhn. Guide to Attribute Based Access Control (ABAC) Definition and Considerations. NIST Special Publication 800-162. (Sections 3.2, 3.3, 3.4 are optional)
(27/9) No lecture (MomenTUm)
(1/10) Usage Control. (Nicola Zannone)
- (Obligatory) Jaehong Park and Ravi Sandhu. 2004. The UCONABC usage control model. ACM Trans. Inf. Syst. Secur. 7, 1, 128-174. (Section 6 is optional)
(4/10) Introduction to Privacy. (Nicola Zannone)
- (Obligatory) Rakesh Agrawal, Jerry Kiernan, Ramakrishnan Srikant, Yirong Xu. Hippocratic Databases. VLDB 2002: 143-154 (2002) (only privacy principles)
- (Suggested) P. Guarda and N. Zannone. Towards the Development of Privacy-Aware Systems. Information and Software Technology. 51(2):337-350. 2009.
(8/10) Privacy-aware Access Control I. (Nicola Zannone)
- (Obligatory) Rakesh Agrawal, Jerry Kiernan, Ramakrishnan Srikant, Yirong Xu. Hippocratic Databases. VLDB 2002: 143-154 (2002) (Section 5 is optional)
- (Obligatory) Ji-Won Byun, Ninghui Li. Purpose based access control for privacy protection in relational database systems. VLDB J. 17(4): 603-619 (2008) (Sections 5, 6 and 7 are optional)
(11/10) Privacy-aware Access Control II. (Nicola Zannone)
- (Obligatory) Michael Backes, Günter Karjoth, Walid Bagga, Matthias Schunter. Efficient comparison of enterprise privacy policies. SAC 2004: 375-382 (2004) (There are some mistakes in the example. A step by step explanation of the (correct) example is presented here.)
- (Suggested) Enterprise Privacy Authorization Language (EPAL 1.2)
(15/10) eXtensible Access Control Markup Language (XACML) I. (Nicola Zannone)
- (Recommended) XACML 3.0 Core: eXtensible Access Control Markup Language (XACML) version 3.0
- (Suggested) Ninghui Li, Qihua Wang, Wahbeh Qardaji, Elisa Bertino, Prathima Rao, Jorge Lobo, and Dan Lin. Access control policy combining: theory meets practice. In Proceedings of the 14th ACM Symposium on Access Control Models and Technologies (SACMAT '09), pages 135-144, ACM, 2009.
(18/10) eXtensible Access Control Markup Language (XACML) II. (Nicola Zannone)
- (Recommended) Core and hierarchical role based access control (RBAC) profile of XACML v3.0
- (Recommended) Privacy policy profile of XACML v3.0
(22/10) Reduction of Access Control Decisions (Nicola Zannone)
- (Obligatory) Charles Morisset, Nicola Zannone: Reduction of access control decisions. In Proceedings of the ACM symposium on Access control models and technologies (SACMAT 2014), pages 53-62, ACM, 2014.