Principles of Data Protection

Course code: 2IMS25

Academic Year: 2024/2025

Quartile 1

Time: Tuesday, hours 3 and 4 (from 10:45 till 12:30)
Place: Auditorium 7

Time: Friday, hours 7 and 8 (from 15:30 till 17:15)
Place: Luna 1.050

The slides are being updated during the course. They are available on CANVAS.

Assessment

Grades for the course are based on a final exam. The final exam is a 3 hours closed-book exam covering ALL topics presented during the course and mandatory papers.

There is the possibility that the exam will be online. More information will be provided when available.

Final exam

Date: 6 November 2024 9:00-12:00
Place: TBD

Date: 29 January 2025 18:00-21:00
Place: TBD

Course Outline (numbers correspond to lectures):

(3/9) Introduction. (Nicola Zannone)
(6/9) Discretionary Access Control. (Nicola Zannone)
- (Obligatory) Michael A. Harrison, Walter L. Ruzzo, and Jeffrey D. Ullman. Protection in Operating Systems. Communications of the ACM 19(8): 461-471. 1976
- (Obligatory) Butler W. Lampson. Protection. ACM SIGOPS Operating Systems Review 8(1): 18-24. 1974.
- (Suggested) Pierangela Samarati, Sabrina De Capitani di Vimercati. Access Control: Policies, Models, and Mechanisms. Revised versions of lectures given during the IFIP WG 1.7 International School on Foundations of Security Analysis and Design on Foundations of Security Analysis and Design: Tutorial Lectures.
(10/9) Mandatory Access Control. (Nicola Zannone)
- (Obligatory) Ravi S. Sandhu. Lattice-Based Access Control Models. Computer 26(11):9-19. 1993.
- (Suggested) Pierangela Samarati, Sabrina De Capitani di Vimercati. Access Control: Policies, Models, and Mechanisms. Revised versions of lectures given during the IFIP WG 1.7 International School on Foundations of Security Analysis and Design on Foundations of Security Analysis and Design: Tutorial Lectures.
(13/9) Role-Based Access Control. (Nicola Zannone)
- (Obligatory) R. S. Sandhu, E.J. Coyne, H.L. Feinstein, C.E. Youman. 1996. Role-Based Access Control Models, IEEE Computer 29(2): 38-47
- (Suggested) Pierangela Samarati, Sabrina De Capitani di Vimercati. Access Control: Policies, Models, and Mechanisms. Revised versions of lectures given during the IFIP WG 1.7 International School on Foundations of Security Analysis and Design on Foundations of Security Analysis and Design: Tutorial Lectures.
(17/9) Role-Based Trust Management I. (Sandro Etalle)
- (Obligatory) Ninghui Li, William H. Winsborough, John C. Mitchell Distributed Credential Chain Discovery in Trust Management. (only the syntax and the backward algorithms)
- (Suggested) Marianne Winslett. An Introduction to Trust Negotiation. iTrust 2003: 275-283.
(20/9) Role-Based Trust Management II. (Sandro Etalle)
- (Obligatory) Ninghui Li, William H. Winsborough, John C. Mitchell Distributed Credential Chain Discovery in Trust Management. (only the syntax and the backward algorithms)
- (Obligatory) Czenko, M.R. and Etalle, S. and Li, D. and Winsborough, W.H. (2007) An Introduction to the Role Based Trust Management Framework RT. (until Section 3.1 included)
(24/9) Attribute-Based Access Control. (Nicola Zannone)
- (Recommended) Vincent C. Hu, David Ferraiolo, Rick Kuhn. Guide to Attribute Based Access Control (ABAC) Definition and Considerations. NIST Special Publication 800-162. (Sections 3.2, 3.3, 3.4 are optional)
(27/9) No lecture (MomenTUm)
(1/10) Usage Control. (Nicola Zannone)
- (Obligatory) Jaehong Park and Ravi Sandhu. 2004. The UCONABC usage control model. ACM Trans. Inf. Syst. Secur. 7, 1, 128-174. (Section 6 is optional)
(4/10) Introduction to Privacy. (Nicola Zannone)
- (Obligatory) Rakesh Agrawal, Jerry Kiernan, Ramakrishnan Srikant, Yirong Xu. Hippocratic Databases. VLDB 2002: 143-154 (2002) (only privacy principles)
- (Suggested) P. Guarda and N. Zannone. Towards the Development of Privacy-Aware Systems. Information and Software Technology. 51(2):337-350. 2009.
(8/10) Privacy-aware Access Control I. (Nicola Zannone)
- (Obligatory) Rakesh Agrawal, Jerry Kiernan, Ramakrishnan Srikant, Yirong Xu. Hippocratic Databases. VLDB 2002: 143-154 (2002) (Section 5 is optional)
- (Obligatory) Ji-Won Byun, Ninghui Li. Purpose based access control for privacy protection in relational database systems. VLDB J. 17(4): 603-619 (2008) (Sections 5, 6 and 7 are optional)
(11/10) Privacy-aware Access Control II. (Nicola Zannone)
- (Obligatory) Michael Backes, Günter Karjoth, Walid Bagga, Matthias Schunter. Efficient comparison of enterprise privacy policies. SAC 2004: 375-382 (2004) (There are some mistakes in the example. A step by step explanation of the (correct) example is presented here.)
- (Suggested) Enterprise Privacy Authorization Language (EPAL 1.2)
(15/10) eXtensible Access Control Markup Language (XACML) I. (Nicola Zannone)
- (Recommended) XACML 3.0 Core: eXtensible Access Control Markup Language (XACML) version 3.0
- (Suggested) Ninghui Li, Qihua Wang, Wahbeh Qardaji, Elisa Bertino, Prathima Rao, Jorge Lobo, and Dan Lin. Access control policy combining: theory meets practice. In Proceedings of the 14th ACM Symposium on Access Control Models and Technologies (SACMAT '09), pages 135-144, ACM, 2009.
(18/10) eXtensible Access Control Markup Language (XACML) II. (Nicola Zannone)
- (Recommended) Core and hierarchical role based access control (RBAC) profile of XACML v3.0
- (Recommended) Privacy policy profile of XACML v3.0
(22/10) Reduction of Access Control Decisions (Nicola Zannone)
- (Obligatory) Charles Morisset, Nicola Zannone: Reduction of access control decisions. In Proceedings of the ACM symposium on Access control models and technologies (SACMAT 2014), pages 53-62, ACM, 2014.