Privacy-Aware Organisation-Based Access Control Model (PrivOrBAC)

Modelling Motivation

We illustrate in this section the issues related to private data management and how to use a privacy policy to specify privacy requirements. We assume that the private data are collected by mobile operator networks since we focus, in our work, on sensitive data such as location and presence of mobile subscribers that only the network operator can collect (See Figure 1). At this stage we do not care about means used to collect data. Collected data concerns operator’s subscribers.

Figure 1.

Privacy enforcement in mobile operator networks

The information is stored within operator’s information system. The latter should implement the OrBAC model to enforce the privacy policy defined by the subscribers. Service providers request that information to offer enhanced services. So, the operator should manage the access to services.