
%% bare_jrnl_compsoc.tex
%% V1.3
%% 2007/01/11
%% by Michael Shell
%% See:
%% http://www.michaelshell.org/
%% for current contact information.
%%
%% This is a skeleton file demonstrating the use of IEEEtran.cls
%% (requires IEEEtran.cls version 1.7 or later) with an IEEE Computer
%% Society journal paper.
%%
%% Support sites:
%% http://www.michaelshell.org/tex/ieeetran/
%% http://www.ctan.org/tex-archive/macros/latex/contrib/IEEEtran/
%% and
%% http://www.ieee.org/

%%*************************************************************************
%% Legal Notice:
%% This code is offered as-is without any warranty either expressed or
%% implied; without even the implied warranty of MERCHANTABILITY or
%% FITNESS FOR A PARTICULAR PURPOSE! 
%% User assumes all risk.
%% In no event shall IEEE or any contributor to this code be liable for
%% any damages or losses, including, but not limited to, incidental,
%% consequential, or any other damages, resulting from the use or misuse
%% of any information contained here.
%%
%% All comments are the opinions of their respective authors and are not
%% necessarily endorsed by the IEEE.
%%
%% This work is distributed under the LaTeX Project Public License (LPPL)
%% ( http://www.latex-project.org/ ) version 1.3, and may be freely used,
%% distributed and modified. A copy of the LPPL, version 1.3, is included
%% in the base LaTeX documentation of all distributions of LaTeX released
%% 2003/12/01 or later.
%% Retain all contribution notices and credits.
%% ** Modified files should be clearly indicated as such, including  **
%% ** renaming them and changing author support contact information. **
%%
%% File list of work: IEEEtran.cls, IEEEtran_HOWTO.pdf, bare_adv.tex,
%%                    bare_conf.tex, bare_jrnl.tex, bare_jrnl_compsoc.tex
%%*************************************************************************

% *** Authors should verify (and, if needed, correct) their LaTeX system  ***
% *** with the testflow diagnostic prior to trusting their LaTeX platform ***
% *** with production work. IEEE's font choices can trigger bugs that do  ***
% *** not appear when using other class files.                            ***
% The testflow support page is at:
% http://www.michaelshell.org/tex/testflow/

% Note that the a4paper option is mainly intended so that authors in
% countries using A4 can easily print to A4 and see how their papers will
% look in print - the typesetting of the document will not typically be
% affected with changes in paper size (but the bottom and side margins will).
% Use the testflow package mentioned above to verify correct handling of
% both paper sizes by the user's LaTeX system.
%
% Also note that the "draftcls" or "draftclsnofoot", not "draft", option
% should be used if it is desired that the figures are to be displayed in
% draft mode.
%
% The Computer Society usually requires 12pt for submissions.
%
\documentclass[11pt,compsoc]{IEEEtran}
%
% If IEEEtran.cls has not been installed into the LaTeX system files,
% manually specify the path to it like:
% \documentclass[12pt,journal,compsoc]{../sty/IEEEtran}

% Some very useful LaTeX packages include:
% (uncomment the ones you want to load)

% *** MISC UTILITY PACKAGES ***
%
%\usepackage{ifpdf}
% Heiko Oberdiek's ifpdf.sty is very useful if you need conditional
% compilation based on whether the output is pdf or dvi.
% usage:
% \ifpdf
%   % pdf code
% \else
%   % dvi code
% \fi
% The latest version of ifpdf.sty can be obtained from:
% http://www.ctan.org/tex-archive/macros/latex/contrib/oberdiek/
% Also, note that IEEEtran.cls V1.7 and later provides a builtin
% \ifCLASSINFOpdf conditional that works the same way.
% When switching from latex to pdflatex and vice-versa, the compiler may
% have to be run twice to clear warning/error messages.

% *** CITATION PACKAGES ***
%
\ifCLASSOPTIONcompsoc
  % IEEE Computer Society needs nocompress option
  % requires cite.sty v4.0 or later (November 2003)
  % \usepackage[nocompress]{cite}
\else
  % normal IEEE
  % \usepackage{cite}
\fi
% cite.sty was written by Donald Arseneau
% V1.6 and later of IEEEtran pre-defines the format of the cite.sty package
% \cite{} output to follow that of IEEE. Loading the cite package will
% result in citation numbers being automatically sorted and properly
% "compressed/ranged". e.g., [1], [9], [2], [7], [5], [6] without using
% cite.sty will become [1], [2], [5]--[7], [9] using cite.sty. cite.sty's
% \cite will automatically add leading space, if needed. Use cite.sty's
% noadjust option (cite.sty V3.8 and later) if you want to turn this off.
% cite.sty is already installed on most LaTeX systems. Be sure and use
% version 4.0 (2003-05-27) and later if using hyperref.sty. cite.sty does
% not currently provide for hyperlinked citations.
% The latest version can be obtained at:
% http://www.ctan.org/tex-archive/macros/latex/contrib/cite/
% The documentation is contained in the cite.sty file itself.
%
% Note that some packages require special options to format as the Computer
% Society requires. In particular, Computer Society  papers do not use
% compressed citation ranges as is done in typical IEEE papers
% (e.g., [1]-[4]). Instead, they list every citation separately in order
% (e.g., [1], [2], [3], [4]). To get the latter we need to load the cite
% package with the nocompress option which is supported by cite.sty v4.0
% and later. Note also the use of a CLASSOPTION conditional provided by
% IEEEtran.cls V1.7 and later.

\long\def\comment#1{\relax}

% *** GRAPHICS RELATED PACKAGES ***
%
\ifCLASSINFOpdf
   \usepackage[pdftex]{graphicx}
  % declare the path(s) where your graphic files are
   \graphicspath{{images/}{../jpeg/}}
  % and their extensions so you won't have to specify these with
  % every instance of \includegraphics
   \DeclareGraphicsExtensions{.pdf,.jpeg,.png}
\else
  % or other class option (dvipsone, dvipdf, if not using dvips). graphicx
  % will default to the driver specified in the system graphics.cfg if no
  % driver is specified.
  % \usepackage[dvips]{graphicx}
  % declare the path(s) where your graphic files are
  % \graphicspath{{../eps/}}
  % and their extensions so you won't have to specify these with
  % every instance of \includegraphics
  % \DeclareGraphicsExtensions{.eps}
\fi
% graphicx was written by David Carlisle and Sebastian Rahtz. It is
% required if you want graphics, photos, etc. graphicx.sty is already
% installed on most LaTeX systems. The latest version and documentation can
% be obtained at: 
% http://www.ctan.org/tex-archive/macros/latex/required/graphics/
% Another good source of documentation is "Using Imported Graphics in
% LaTeX2e" by Keith Reckdahl which can be found as epslatex.ps or
% epslatex.pdf at: http://www.ctan.org/tex-archive/info/
%
% latex, and pdflatex in dvi mode, support graphics in encapsulated
% postscript (.eps) format. pdflatex in pdf mode supports graphics
% in .pdf, .jpeg, .png and .mps (metapost) formats. Users should ensure
% that all non-photo figures use a vector format (.eps, .pdf, .mps) and
% not a bitmapped formats (.jpeg, .png). IEEE frowns on bitmapped formats
% which can result in "jaggedy"/blurry rendering of lines and letters as
% well as large increases in file sizes.
%
% You can find documentation about the pdfTeX application at:
% http://www.tug.org/applications/pdftex





% *** MATH PACKAGES ***
%
%\usepackage[cmex10]{amsmath}
% A popular package from the American Mathematical Society that provides
% many useful and powerful commands for dealing with mathematics. If using
% it, be sure to load this package with the cmex10 option to ensure that
% only type 1 fonts will utilized at all point sizes. Without this option,
% it is possible that some math symbols, particularly those within
% footnotes, will be rendered in bitmap form which will result in a
% document that can not be IEEE Xplore compliant!
%
% Also, note that the amsmath package sets \interdisplaylinepenalty to 10000
% thus preventing page breaks from occurring within multiline equations. Use:
%\interdisplaylinepenalty=2500
% after loading amsmath to restore such page breaks as IEEEtran.cls normally
% does. amsmath.sty is already installed on most LaTeX systems. The latest
% version and documentation can be obtained at:
% http://www.ctan.org/tex-archive/macros/latex/required/amslatex/math/





% *** SPECIALIZED LIST PACKAGES ***
%
%\usepackage{algorithmic}
% algorithmic.sty was written by Peter Williams and Rogerio Brito.
% This package provides an algorithmic environment fo describing algorithms.
% You can use the algorithmic environment in-text or within a figure
% environment to provide for a floating algorithm. Do NOT use the algorithm
% floating environment provided by algorithm.sty (by the same authors) or
% algorithm2e.sty (by Christophe Fiorio) as IEEE does not use dedicated
% algorithm float types and packages that provide these will not provide
% correct IEEE style captions. The latest version and documentation of
% algorithmic.sty can be obtained at:
% http://www.ctan.org/tex-archive/macros/latex/contrib/algorithms/
% There is also a support site at:
% http://algorithms.berlios.de/index.html
% Also of interest may be the (relatively newer and more customizable)
% algorithmicx.sty package by Szasz Janos:
% http://www.ctan.org/tex-archive/macros/latex/contrib/algorithmicx/




% *** ALIGNMENT PACKAGES ***
%
%\usepackage{array}
% Frank Mittelbach's and David Carlisle's array.sty patches and improves
% the standard LaTeX2e array and tabular environments to provide better
% appearance and additional user controls. As the default LaTeX2e table
% generation code is lacking to the point of almost being broken with
% respect to the quality of the end results, all users are strongly
% advised to use an enhanced (at the very least that provided by array.sty)
% set of table tools. array.sty is already installed on most systems. The
% latest version and documentation can be obtained at:
% http://www.ctan.org/tex-archive/macros/latex/required/tools/


%\usepackage{mdwmath}
%\usepackage{mdwtab}
% Also highly recommended is Mark Wooding's extremely powerful MDW tools,
% especially mdwmath.sty and mdwtab.sty which are used to format equations
% and tables, respectively. The MDWtools set is already installed on most
% LaTeX systems. The lastest version and documentation is available at:
% http://www.ctan.org/tex-archive/macros/latex/contrib/mdwtools/


% IEEEtran contains the IEEEeqnarray family of commands that can be used to
% generate multiline equations as well as matrices, tables, etc., of high
% quality.


%\usepackage{eqparbox}
% Also of notable interest is Scott Pakin's eqparbox package for creating
% (automatically sized) equal width boxes - aka "natural width parboxes".
% Available at:
% http://www.ctan.org/tex-archive/macros/latex/contrib/eqparbox/





% *** SUBFIGURE PACKAGES ***
%\ifCLASSOPTIONcompsoc
%\usepackage[tight,normalsize,sf,SF]{subfigure}
%\else
%\usepackage[tight,footnotesize]{subfigure}
%\fi
% subfigure.sty was written by Steven Douglas Cochran. This package makes it
% easy to put subfigures in your figures. e.g., "Figure 1a and 1b". For IEEE
% work, it is a good idea to load it with the tight package option to reduce
% the amount of white space around the subfigures. Computer Society papers
% use a larger font and \sffamily font for their captions, hence the
% additional options needed under compsoc mode. subfigure.sty is already
% installed on most LaTeX systems. The latest version and documentation can
% be obtained at:
% http://www.ctan.org/tex-archive/obsolete/macros/latex/contrib/subfigure/
% subfigure.sty has been superceeded by subfig.sty.


%\ifCLASSOPTIONcompsoc
%  \usepackage[caption=false]{caption}
%  \usepackage[font=normalsize,labelfont=sf,textfont=sf]{subfig}
%\else
%  \usepackage[caption=false]{caption}
%  \usepackage[font=footnotesize]{subfig}
%\fi
% subfig.sty, also written by Steven Douglas Cochran, is the modern
% replacement for subfigure.sty. However, subfig.sty requires and
% automatically loads Axel Sommerfeldt's caption.sty which will override
% IEEEtran.cls handling of captions and this will result in nonIEEE style
% figure/table captions. To prevent this problem, be sure and preload
% caption.sty with its "caption=false" package option. This is will preserve
% IEEEtran.cls handing of captions. Version 1.3 (2005/06/28) and later 
% (recommended due to many improvements over 1.2) of subfig.sty supports
% the caption=false option directly:
%\ifCLASSOPTIONcompsoc
%  \usepackage[caption=false,font=normalsize,labelfont=sf,textfont=sf]{subfig}
%\else
%  \usepackage[caption=false,font=footnotesize]{subfig}
%\fi
%
% The latest version and documentation can be obtained at:
% http://www.ctan.org/tex-archive/macros/latex/contrib/subfig/
% The latest version and documentation of caption.sty can be obtained at:
% http://www.ctan.org/tex-archive/macros/latex/contrib/caption/




% *** FLOAT PACKAGES ***
%
%\usepackage{fixltx2e}
% fixltx2e, the successor to the earlier fix2col.sty, was written by
% Frank Mittelbach and David Carlisle. This package corrects a few problems
% in the LaTeX2e kernel, the most notable of which is that in current
% LaTeX2e releases, the ordering of single and double column floats is not
% guaranteed to be preserved. Thus, an unpatched LaTeX2e can allow a
% single column figure to be placed prior to an earlier double column
% figure. The latest version and documentation can be found at:
% http://www.ctan.org/tex-archive/macros/latex/base/



%\usepackage{stfloats}
% stfloats.sty was written by Sigitas Tolusis. This package gives LaTeX2e
% the ability to do double column floats at the bottom of the page as well
% as the top. (e.g., "\begin{figure*}[!b]" is not normally possible in
% LaTeX2e). It also provides a command:
%\fnbelowfloat
% to enable the placement of footnotes below bottom floats (the standard
% LaTeX2e kernel puts them above bottom floats). This is an invasive package
% which rewrites many portions of the LaTeX2e float routines. It may not work
% with other packages that modify the LaTeX2e float routines. The latest
% version and documentation can be obtained at:
% http://www.ctan.org/tex-archive/macros/latex/contrib/sttools/
% Documentation is contained in the stfloats.sty comments as well as in the
% presfull.pdf file. Do not use the stfloats baselinefloat ability as IEEE
% does not allow \baselineskip to stretch. Authors submitting work to the
% IEEE should note that IEEE rarely uses double column equations and
% that authors should try to avoid such use. Do not be tempted to use the
% cuted.sty or midfloat.sty packages (also by Sigitas Tolusis) as IEEE does
% not format its papers in such ways.



%\ifCLASSOPTIONcaptionsoff
%  \usepackage[nomarkers]{endfloat}
% \let\MYoriglatexcaption\caption
% \renewcommand{\caption}[2][\relax]{\MYoriglatexcaption[#2]{#2}}
%\fi
% endfloat.sty was written by James Darrell McCauley and Jeff Goldberg.
% This package may be useful when used in conjunction with IEEEtran.cls'
% captionsoff option. Some IEEE journals/societies require that submissions
% have lists of figures/tables at the end of the paper and that
% figures/tables without any captions are placed on a page by themselves at
% the end of the document. If needed, the draftcls IEEEtran class option or
% \CLASSINPUTbaselinestretch interface can be used to increase the line
% spacing as well. Be sure and use the nomarkers option of endfloat to
% prevent endfloat from "marking" where the figures would have been placed
% in the text. The two hack lines of code above are a slight modification of
% that suggested by in the endfloat docs (section 8.3.1) to ensure that
% the full captions always appear in the list of figures/tables - even if
% the user used the short optional argument of \caption[]{}.
% IEEE papers do not typically make use of \caption[]'s optional argument,
% so this should not be an issue. A similar trick can be used to disable
% captions of packages such as subfig.sty that lack options to turn off
% the subcaptions:
% For subfig.sty:
% \let\MYorigsubfloat\subfloat
% \renewcommand{\subfloat}[2][\relax]{\MYorigsubfloat[]{#2}}
% For subfigure.sty:
% \let\MYorigsubfigure\subfigure
% \renewcommand{\subfigure}[2][\relax]{\MYorigsubfigure[]{#2}}
% However, the above trick will not work if both optional arguments of
% the \subfloat/subfig command are used. Furthermore, there needs to be a
% description of each subfigure *somewhere* and endfloat does not add
% subfigure captions to its list of figures. Thus, the best approach is to
% avoid the use of subfigure captions (many IEEE journals avoid them anyway)
% and instead reference/explain all the subfigures within the main caption.
% The latest version of endfloat.sty and its documentation can obtained at:
% http://www.ctan.org/tex-archive/macros/latex/contrib/endfloat/
%
% The IEEEtran \ifCLASSOPTIONcaptionsoff conditional can also be used
% later in the document, say, to conditionally put the References on a 
% page by themselves.


% *** PDF, URL AND HYPERLINK PACKAGES ***
%
\usepackage{url}
% url.sty was written by Donald Arseneau. It provides better support for
% handling and breaking URLs. url.sty is already installed on most LaTeX
% systems. The latest version can be obtained at:
% http://www.ctan.org/tex-archive/macros/latex/contrib/misc/
% Read the url.sty source comments for usage information. Basically,
% \url{my_url_here}.





% *** Do not adjust lengths that control margins, column widths, etc. ***
% *** Do not use packages that alter fonts (such as pslatex).         ***
% There should be no need to do such things with IEEEtran.cls V1.6 and later.
% (Unless specifically asked to do so by the journal or conference you plan
% to submit to, of course. )


% correct bad hyphenation here
\hyphenation{op-tical net-works semi-conduc-tor}


\begin{document}
%
% paper title
% can use linebreaks \\ within to get better formatting as desired
\title{Preserving Privacy Based on Semantic Policy Tools}

% author names and IEEE memberships
% note positions of commas and nonbreaking spaces ( ~ ) LaTeX will not break
% a structure at a ~ so this keeps an author's name from being broken across
% two lines.
% use \thanks{} to gain access to the first footnote area
% a separate \thanks must be used for each paragraph as LaTeX2e's \thanks
% was not built to handle multiple paragraphs
%
%
%\IEEEcompsocitemizethanks is a special \thanks that produces the bulleted
% lists the Computer Society journals use for "first footnote" author
% affiliations. Use \IEEEcompsocthanksitem which works much like \item
% for each affiliation group. When not in compsoc mode,
% \IEEEcompsocitemizethanks becomes like \thanks and
% \IEEEcompsocthanksitem becomes a line break with idention. This
% facilitates dual compilation, although admittedly the differences in the
% desired content of \author between the different types of papers makes a
% one-size-fits-all approach a daunting prospect. For instance, compsoc 
% journal papers have the author affiliations above the "Manuscript
% received ..."  text while in non-compsoc journals this is reversed. Sigh.

\author{Lalana~Kagal$^{*}$ and Joe Pato$^{+}$ \\ $^{*}$MIT Computer Science and Artificial Intelligence Lab\\ $^{+}$HP Labs} % <-this % stops a space
%\IEEEcompsocitemizethanks{\IEEEcompsocthanksitem L. Kagal is with MIT CSAIL \protect\\
% note need leading \protect in front of \\ to get a newline within \thanks as
% \\ is fragile and will error, could use \hfil\break instead.
%E-mail: see http://csail.mit.edu/~lkagal/ }
%\IEEEcompsocthanksitem J. Soltren is with MIT CSAIL}% <-this % stops a space
%}

% The paper headers
%\markboth{Journal of \LaTeX\ Class Files,~Vol.~6, No.~1, January~2007}%
%{Shell \MakeLowercase{\textit{et al.}}: Bare Demo of IEEEtran.cls for Computer Society Journals}
% The only time the second header will appear is for the odd numbered pages
% after the title page when using the twoside option.
% 
% *** Note that you probably will NOT want to include the author's ***
% *** name in the headers of peer review papers.                   ***
% You can use \ifCLASSOPTIONpeerreview for conditional compilation here if
% you desire.

% The publisher's ID mark at the bottom of the page is less important with
% Computer Society journal papers as those publications place the marks
% outside of the main text columns and, therefore, unlike regular IEEE
% journals, the available text space is not reduced by their presence.
% If you want to put a publisher's ID mark on the page you can do it like
% this:
%\IEEEpubid{0000--0000/00\$00.00~\copyright~2009 IEEE}
% or like this to get the Computer Society new two part style.
\IEEEpubid{\makebox[\columnwidth]{\hfill 0000--0000/00/\$00.00~\copyright~2009 IEEE}%
\hspace{\columnsep}\makebox[\columnwidth]{Published by the IEEE Computer Society\hfill}}
% Remember, if you use this you must call \IEEEpubidadjcol in the second
% column for its text to clear the IEEEpubid mark (Computer Society jorunal
% papers don't need this extra clearance.)



% use for special paper notices
%\IEEEspecialpapernotice{(Invited Paper)}

% for Computer Society papers, we must declare the abstract and index terms
% PRIOR to the title within the \IEEEcompsoctitleabstractindextext IEEEtran
% command as these need to go into the title area created by \maketitle.
\IEEEcompsoctitleabstractindextext{%
\begin{abstract}
%\boldmath

% IEEE Security & Privacy
% Special Issue on Privacy Preserving Sharing of Data
% http://www.ieee-security.org/Calendar/cfps/cfp-SI-SNPMag-2010.html

Private data of individuals is constantly being collected, analyzed,
and stored by different kinds of organizations: shopping sites to
provide better service and recommendations, hospitals for improved
healthcare, and government agencies to enable national defense and law
enforcement. Sharing data between these organizations makes it
possible to discover important knowledge and draw useful conclusions
but raises concerns about information privacy and trust. Until
recently the focus was on restricting access to data on a ``need to
know'' basis, but since the 9/11 Commission there has been a paradigm
shift to ``need to share''. Our work explores the use of semantic
privacy policies, \comment{user-accessible} justifications for data
requests, and automated auditing to encourage sharing of sensitive
data between organizations.  We describe an architecture based on our
policy tools that evaluates incoming queries against semantic policies
and domain knowledge and provides a justification for each query - why
they are permitted, denied, or inapplicable.  Using a semantic policy
language gives policies explicit semantics that allows all
participants to unambiguously understand their meaning. The
justifications generated by checking incoming requests against these
policies help requesters formulate privacy-aware queries. Lastly,
reasoning over event logs and justifications allows data owners to
verify that their privacy policies are being correctly enforced.

\end{abstract}
% IEEEtran.cls defaults to using nonbold math in the Abstract.
% This preserves the distinction between vectors and scalars. However,
% if the journal you are submitting to favors bold math in the abstract,
% then you can use LaTeX's standard command \boldmath at the very start
% of the abstract to achieve this. Many IEEE journals frown on math
% in the abstract anyway. In particular, the Computer Society does
% not want either math or citations to appear in the abstract.

% Note that keywords are not normally used for peerreview papers.
\begin{IEEEkeywords}
Privacy policy, justifications, proofs, sharing, trust
\end{IEEEkeywords}}


% make the title area
\maketitle


% To allow for easy dual compilation without having to reenter the
% abstract/keywords data, the \IEEEcompsoctitleabstractindextext text will
% not be used in maketitle, but will appear (i.e., to be "transported")
% here as \IEEEdisplaynotcompsoctitleabstractindextext when compsoc mode
% is not selected <OR> if conference mode is selected - because compsoc
% conference papers position the abstract like regular (non-compsoc)
% papers do!
\IEEEdisplaynotcompsoctitleabstractindextext
% \IEEEdisplaynotcompsoctitleabstractindextext has no effect when using
% compsoc under a non-conference mode.


% For peer review papers, you can put extra information on the cover
% page as needed:
% \ifCLASSOPTIONpeerreview
% \begin{center} \bfseries EDICS Category: 3-BBND \end{center}
% \fi
%
% For peerreview papers, this IEEEtran command inserts a page break and
% creates the second title. It will be ignored for other modes.
\IEEEpeerreviewmaketitle



\begin{figure*}[!t]
\centering
\includegraphics[width=5.6in]{architecture-version2}
\caption{Architecture: Databases have a policy layer that allows them
  to identify and execute only compliant queries and return
  justifications for non-compliant ones}
\label{fig_arch}
\end{figure*}


\section{Introduction}

Efforts to address privacy have been dominated by strict access
restriction and privacy-preserving algorithms such as anonymization,
generalization, and perturbation. These techniques assume that most
data consumers are malicious and focus on helping data owners restrict
access to data. \comment{prevent inappropriate access to their data.}
However, these techniques also discourage honest consumers from
accessing data they require. With the current push towards
need-to-share, we suggest that alternative approaches are required
that help honest consumers be honest as well as enforce privacy
policies of data owners.

Our group is exploring accountability mechanisms as a means of
protecting central information policy values such as privacy and fair
and reliable use of information. We view accountability combined with
transparency and appropriate redress as a complementary process to
strict access control~\cite{weitzner08info}. Fundamental to this
approach is the use of formalisms that can express realistic data-use
policies, and automated reasoning engines that can interpret those
policies and automatically determine whether particular uses of data
are policy-compliant.

We are buildings \comment{that supports both honest users as well as
  data owners. We propose} systems that provide policy-awareness
enabling honest users to comply with explicitly defined policies and
data owners to verify that their policies are being enforced
correctly. {\it Policy-awareness} is a property of information systems
that provides participants with machine-readable representations of
policies and audit trails in order to facilitate compliance with
stated rules, as well as understandable views of policy decisions
made.

Most access control mechanisms provide just a yes/no or permit/deny
kind of answer leaving users unsure of what they are doing wrong and
suspicious of possible prejudices. Users wanting to comply with
security and privacy policies end up either being afraid to make
queries for fear of doing something wrong or being angry that they are
never able to get a query past the security mechanism to the data they
require. Our objective is to use policy-awareness to enable users to
make the right queries by giving them enough information to do
so. Consider a simple privacy policy ``You may not query for both
zipcode and last name''. With normal access control mechanisms, a
requester who is asking for several fields including zipcode and last
name from the database will be constantly rejected without knowing
why. Similarly a requester who initially asked for zipcodes and is now
asking for first and last names will be rejected.  Our policy tools
will provide a reason for this rejection such as ``You've previously
requested zipcode. Once one of zipcode and last name has been
requested, the other cannot be retrieved''. This justification enables
the user to reformulate his query so that it does respect the privacy
policies. Further, policies derived from regulatory controls governing
information sharing are often complicated and may need to draw on
contradictory sources from different
jurisdictions~\cite{waterman10pre,breaux08analyzing}. Examination of
explicit justifications can expose these contradictions and lead to
redefinition of the appropriate policy.

Policy-awareness supports extensive and machine-readable logs of
events that have occurred in the system including requests for data
and the results of those requests. We provide tools to allow data
owners to run audits over these logs to check whether the enforcement
mechanisms are fulfilling the intent of the policy. In case of
non-conformance, the justifications associated with the decision
provide guidance on how the policy should be adjusted to meet their
intended result. For example, if the log shows that Alex accessed
certain records the data owner or an authorized user can ask why this
was permitted. Our tools provide a detailed justification saying that
Alex is from the FBI, and his purpose was law enforcement, so it was
permitted. If the data owner realizes that he does want FBI agents to
access all data for law enforcement but only wants them to retrieve
data about a ``person of interest'' he can add this rule to the policy
and continue monitoring the logs.

We have designed an architecture based on policy-awareness and
accountability that enables privacy-preserving sharing of sensitive
data. We have implemented most of the key components including the
Semantic Web based policy language, the reasoner that infers whether
queries are compliant, generates justifications and handles private
policies, the user interface that allows justifications to be
explored, and techniques for integrating the architecture with
different databases, as well as for the handling of intention, usage
and context. In this article, we define our architecture, describe the
individual components, and illustrate the effectiveness of our
solution through several examples.


\section{Architecture}
As illustrated in Figure~\ref{fig_arch}, our architecture includes
inserting a privacy-enabling engine in front of the database
containing private data. This engine consists of (i) policy reasoner,
(ii) event log, (iii) set of applicable policies, and (iv) meta-data
about the database.  Queries to the database are input to the policy
reasoner. The policy reasoner reasons over the policies, meta-data
about the database such as the fields in the database, possible values
of the fields, and the distribution of values in the fields, and also
takes into account past queries. The reasoner then infers whether the
current query is compliant or not and provides an appropriate
justification.  If the query is compliant, it is forwarded to the
database for execution otherwise the policy result and justification
are returned to the requester. In either case, the query and
justification are logged so they can be used for auditing
purposes. For compliant queries, all associated usage restrictions are
added to the results before being returned to the requester. In an
ideal situation, a similar architecture could be present within the
data consumer's context to verify that usage restrictions are being
complied with. Usage restrictions can be complied with by up-front
policy checking and violations detected through after-the-fact
auditing.

\section{Motivating Example}

Consider a database consisting of information about US Persons. This
data contains names, home address, telephone numbers, work address,
email, fax number, marital status and other personal information.  In
order to allow this data to be used while maintaining privacy, our
architecture is used to enforce semantic policies and help consumers
understand what kinds of queries are allowed under them.  Current
access control policies for databases mainly consist of
permitting/preventing access to rows, columns or views. However, our
system is able to handle higher level policies that are not
necessarily in terms of rows and columns of the database. Some
examples of semantic policies include ``You may not filter based on
ethnicity'', ``You may not retrieve contact information of foreign
nationals'', and ``You may not retrieve both First-name and age for
residents of New England'' where the semantics of {\it ethnicity},
{\it contact information}, being a {\it foreign national} and being a
{\it resident of New England} are defined using Semantic Web
languages. Queries of the form ``SELECT age, firstname WHERE
birth-country=Nepal'' and ``SELECT * WHERE zipcode=02139'' are matched
against the policies and are identified as non-compliant whereas
``SELECT lastname WHERE city=Cambridge'' is identified as compliant.

\section{Semantic Web-based Policy Language}
Several policy languages in the literature could be used for policies
about data sharing within a single security domain because a single
domain typically uses uniform domain-specific semantics, is uniformly
managed, and is less open compared to the cross-domain sharing
scenarios. Though there has been some research on the problem of
multiple security domains, it usually involves prior negotiation
between separate domains in advance of the sharing that prevents
dynamic sharing or sharing of new unaccounted-for information. We
propose the use of Semantic Web technologies for policy descriptions
that span muliple domains as they provide common models of data and
knowledge such that entities (software and human) in the systems can
exchange information, queries and requests with some assurance that
they share a common meaning. The Semantic Web consists of several
languages such as Resource Description Framework (RDF), RDF Schema
(RDFS), and the Web Ontology Language (OWL), which can be used to
provide a description of concepts, terms, and relationships within the
domain(s), as well as technologies for the retrieval, use, and
integration of these descriptions. These languages and technologies
enable data, including policies and credentials, to be annotated with
machine-understandable meta-data, allowing them to be automatically
retrieved and used in correct contexts. Our policy language,
AIR~\cite{air} is grounded in Semantic Web
technologies~\cite{bl01semantic}, which allows it be domain
independent and especially useful when policy is shared across domains
that must adhere to the policy even though they have their own native
schemas or data models. For example, it is possible to define a policy
in AIR that describes the characteristics of users, the kinds of data
that can be exchanged, and the conditions under which the exchange is
possible between two government agencies, even though the data being
used, the role descriptions, the user attributes, etc. used by each
agency is different. The AIR reasoner accepts AIR policies, queries
defined in the SPARQL Query Language for RDF~\cite{sparql}, and domain
knowledge such as the semantics of {\it New England residents} and
{\it ethnicity} and infers whether the queries are compliant with the
policy.

We use Semantic Web technologies not only to model policies but also
for our justifications and logs. Having common semantics for this
security information enables our tools to be used in any system that
understands basic Semantic Web technologies and allows participants
from different domains to effectively use and reason over each other's
policies, logs and justifications.

In recent years there have been several efforts to develop expressive
policy languages using Semantic Web technologies for a variety of
application domains including network management, Web services, and
privacy.  These include languages such as
KAoS~\cite{bradshaw03representation} and
Rei~\cite{kagal03policy}. KAoS policies are OWL descriptions of
actions that are permitted (or not) or obligated (or not).  This
limits the expressive power, but allows the classification of policy
statements, enabling conflicts to be discovered from the rules
themselves.  Another advantage that KAoS has is that if policy
descriptions stay within OWL-Lite or OWL-DL, then the computation is
decidable and has well understood complexity results.  On the other
hand, Rei and AIR are more expressive and allow for rules to be
defined over attributes of classes in the domain including users,
resources, and the context, however, they lack well defined
semantics. Rei also includes tools for policy analysis and speech acts
for dynamic policy modification, which both AIR and KAoS lack. AIR is
focused on generating explanations for policy decisions, which neither
KAoS nor Rei are capable of, and is also able to handle noisy and
inconsistent data from multiple sources by allowing users and rules to
explicitly assert and manage provenance and other contextual
information.

\section{Integration with Different Databases}

As the policy language itself is domain independent, it works with any
database that can provide ontological meta-data. The meta-data of a
database usually includes a description of the fields in the
tables. For example, to model personal data you might say that Person
is a class and has name, social security number, email, address and
telephone number as properties. Further, address itself has several
properties including street, house number, state, city, and
zipcode. An important advantage of separating the domain knowledge
from the policy language is the ability to define abstract concepts
specific to different databases over which policies can be later
defined. For example, for one database {\it Contact-Information} is an
abstract concept containing email, address, telephone, fax, and office
address of Person. It can be modeled in several ways using Semantic
Web languages. One simple way is to make email, address, telephone,
fax and office address sub-properties of {\it Contact-Information}. An
example of a policy using {\it Contact-Information} is ``You may not
access Contact Information of minors'' where {\it minors} can be
defined as the class of those individuals whose age is less than 18.
The meta-data can also include distribution of the values of a field
such as ``70 percent of the field gender is male''.  This means
policies such as ``You may not retrieve more than 50 percent of the
database'' will find queries such as ``SELECT * WHERE gender=male'' to
be non-compliant.

\begin{figure*}[!t]
\centering
\includegraphics[width=5.6in]{just-ui}
\caption{Justification Example: Under a policy that states ``You may
  not query for New England residents'', the query ``SELECT NAME, ID
  WHERE AGE$>$18 and CITY=BOSTON'' is found to be non-compliant and
  this justification is provided.}
\label{fig_justui}
\end{figure*}


\section{Justification - Why and How ?}

Most reasoners are capable of generating proofs for why they believe a
certain conclusion to be true, however, these proofs are in the form
of proof trees. These trees are difficult for end users to understand
and contain a lot of irrelevant information. While reasoning over the
policy and data, our reasoner maintains the set of dependencies for
each statement in the knowledge base. It annotates all invoked rules
in the dependencies with their natural language descriptions
generating a machine-understandable justification embedded with
English descriptions that a user can understand~\cite{air}. This
information can be interactively explored with another of our policy
tools called Justification UI (for more information, please see
{\small
  \url{http://dig.csail.mit.edu/TAMI/2008/JustificationUI/howto.html}}). Figure~\ref{fig_justui}
shows an example of a justification generated by the AIR reasoner. The
policy states ``You may not query for New England residents'' and the
query is ``SELECT NAME, ID WHERE AGE$>$18 and CITY=BOSTON''. The
reasoner finds this query to be non-compliant and provides a
justification for it.

Researchers have suggested other approaches to explanation generation
such as the WhyNot~\cite{chalupsky02whynot} and
KNOW~\cite{kapadia04know} systems. Both these systems focus explicitly
on failed queries and try to suggest changes to the input or knowledge
base that would cause the queries to succeed. WhyNot uses abductive
reasoning to compute partial proofs for how to satisfy the query. This
implies requester has to sort through potentially irrelevant
information to find the reason for failure. These proofs could also
reveal private data and rules. The KNOW system searches all applicable
policies using ordered binary decision diagrams to suggest
modifications to the input that would cause the query to be
satisfied. It also uses meta-policies to maintain privacy requirements
of security policies. This privacy functionality is similar to what
our approach provides. However, along with being domain independent
and applicable to policies of all kinds, our approach also allows the
system to capture and provide justifications for both successful and
failed queries. Instead of using meta-policies, AIR supports syntax
and semantics for adding natural-language descriptions to
justifications and allows justifications to be declaratively modified
preventing private information from being inadvertently leaked.

\comment{Researchers have proposed other approaches to explanation
  justification generation, such as the WhyNot1 and Know systems.2
  Both these systems focus explicitly on failed queries and try to
  suggest changes to the knowledge base that will help these queries
  succeed. Because the explanation for failed policy results could end
  up being the list of all rules that the requester didn’t match, the
  requester is required to sort through a lot of potentially
  irrelevant information. These additional rules could also be a
  privacy risk, revealing sensitive information. Our justification
  approach is more general and allows the system to capture both
  successes and failures in policies, so requesters can receive
  explanations for both successful and failed policy decisions. Also,
  AIR supports syntax and semantics for the addition of natural
  language descriptions to justifications and allows justifications to
  be declaratively modified preventing private policies from being
  inadvertently leaked.}


\section{Private Policies and Justification}
In most cases the default justification provided by the AIR reasoner
is acceptable. However, policy administrators might want to modify
these justifications if (i) parts of the policy or the data are
private, or (ii) if the justification contains too much
information. In these cases, some portions of the justification need
to be suppressed and our policy language provides two mechanisms -
{\it Hidden} rules and {\it Ellipsed} rules. Hiding rules is a
mechanism for suppressing unimportant or private information from
explanations. Declaring a rule to be hidden prevents all its deduction
steps from appearing in the explanation. Consider a rule that says
``Students have access to the database'' and the statements
``GradStudent is a subclass of student'' and ``PhDstudent is a
subclass of GradStudent'' are believed to be true.  Then while proving
that a PhD student has access to the data, there will be a rule to
deduce the sub-class relationships, but it won't be interesting for
most end users. So we can declare the subclass rule as a {\it Hidden}
rule to prevent this information from appearing in the
explanation. Another mechanism is {\it Ellipsed} rule where we do not
want to hide all steps following the rule but only want the execution
of a specific rule to be suppressed. For example, if we have a rule
that states ``Unless a check is over X dollars it is not investigated
for fraud''~\footnote{{\small Thanks to KK Waterman for this
    example}}, it is not in the best interests of the policy
administrator to reveal this ``X''. In this case, he can declare the
rule to be an ellipsed rule. Another example is if the data owner
maintains a list of untrusted requesters or wants to limit the number
of requests any single requester makes. Using {\it Ellipsed} rule will
prevent only the rule that checks the list or the rule that checks the
number of requests from appearing in the overall
justification. \comment{If a rule searches for a particular attribute
  of the requester but the policy administrator doesn't want anyone to
  know what this attribute is, he can declare that rule to be an
  ellipsed rule. {\it [Q: better example]}.}

Even when policies are public, justifications are important because
most policies especially those that relate to data sharing and usage
are complex. A data consumer is not able to easily figure out which
policies are applicable to a particular query and is not always
capable of understanding these policies.

\section{Intention, Usage, Context,  and More}
Knowing the intention of the user or the proposed use of the data
being retrieved is usually extremely important for privacy policies
and is very difficult for machines to ascertain. Many privacy policies
include usage restrictions such as ``My health information may not be
used to contact me regarding potential clinical trials'' that are
virtually impossible to enforce at time of access. Our approach is to
allow the user to state his or her purpose at request time, log this
signed statement, and use it to make the policy decision. Later these
logs can be audited and in case of a violation, this statement can be
used to hold the requester accountable~\cite{weitzner08info}. In order
to be effective, however, appropriate regulation needs to be in place
so action could be taken against the requester. A similar mechanism is
used to model unexpected circumstances such as an emergency
situation. If a privacy policy states ``Only my primary healthcare
provider may access my records unless there is a health emergency''
then the system allows a requester who is not the primary healthcare
provider to access the records if he or she can prove that there is an
emergency or is willing to provide a signed statement of the fact.
\comment{{\it [Q:how can we do this technically?]}} The system also
annotates the query results with usage restrictions in the spirit of
making policies explicit and understandable. The data consumer can use
our policy tools to ensure that they are using data in compliance with
their usage policies.  \comment{Having these policies attached to the
  data allows data consumers to ensure that they are using data in
  compliance with the usage policy. One possible way is to use our
  policy tools to write rules to check this compliance.}

Another aspect of policies is context. By context we mean attributes
of the requester, environmental variables, and attributes of the data
itself. We can obtain certain contextual information using techniques
such as FOAF+SSL~\cite{foafssl}, where users log in with a Uniform
Resource Identifier (URI) that contains relevant information about
them, rules about where to obtain some information will be present in
the meta-data of the database but for other kinds of context we need
to rely on input from the requester.  Consider the following policy
``You may only access this database if you've recently obtained XYZ
certification''. In order to know whether the requester has XYZ
certification the reasoner will look in the meta-data for rules about
which online resources can be trusted to vouch for certified users or
will expect a signed statement from the requester. In order to handle
these cases, we suggest that regular audits be run over the log so
statements made by users can be verified and that violations of the
policy can be identified.


%Difficult to gauge intention allow user to provide it and log that in
%case data is mis-used, hold user accountably context - date, time,
%role, emergency situation - again no policy so allow user to state it,
%log it and provide access. Could have list of allowable emergencies
%and only permit access if emergency in list. again accountability



% An example of a floating figure using the graphicx package.
% Note that \label must occur AFTER (or within) \caption.
% For figures, \caption should occur after the \includegraphics.
% Note that IEEEtran v1.7 and later has special internal code that
% is designed to preserve the operation of \label within \caption
% even when the captionsoff option is in effect. However, because
% of issues like this, it may be the safest practice to put all your
% \label just after \caption rather than within \caption{}.
%
% Reminder: the "draftcls" or "draftclsnofoot", not "draft", class
% option should be used if it is desired that the figures are to be
% displayed while in draft mode.
%
%\begin{figure}[!t]
%\centering
%\includegraphics[width=2.5in]{myfigure}
% where an .eps filename suffix will be assumed under latex, 
% and a .pdf suffix will be assumed for pdflatex; or what has been declared
% via \DeclareGraphicsExtensions.
%\caption{Simulation Results}
%\label{fig_sim}
%\end{figure}

% Note that IEEE typically puts floats only at the top, even when this
% results in a large percentage of a column being occupied by floats.
% However, the Computer Society has been known to put floats at the bottom.

% An example of a double column floating figure using two subfigures.
% (The subfig.sty package must be loaded for this to work.)
% The subfigure \label commands are set within each subfloat command, the
% \label for the overall figure must come after \caption.
% \hfil must be used as a separator to get equal spacing.
% The subfigure.sty package works much the same way, except \subfigure is
% used instead of \subfloat.
%
%\begin{figure*}[!t]
%\centerline{\subfloat[Case I]\includegraphics[width=2.5in]{subfigcase1}%
%\label{fig_first_case}}
%\hfil
%\subfloat[Case II]{\includegraphics[width=2.5in]{subfigcase2}%
%\label{fig_second_case}}}
%\caption{Simulation results}
%\label{fig_sim}
%\end{figure*}
%
% Note that often IEEE papers with subfigures do not employ subfigure
% captions (using the optional argument to \subfloat), but instead will
% reference/describe all of them (a), (b), etc., within the main caption.


% An example of a floating table. Note that, for IEEE style tables, the 
% \caption command should come BEFORE the table. Table text will default to
% \footnotesize as IEEE normally uses this smaller font for tables.
% The \label must come after \caption as always.
%
%\begin{table}[!t]
%% increase table row spacing, adjust to taste
%\renewcommand{\arraystretch}{1.3}
% if using array.sty, it might be a good idea to tweak the value of
% \extrarowheight as needed to properly center the text within the cells
%\caption{An Example of a Table}
%\label{table_example}
%\centering
%% Some packages, such as MDW tools, offer better commands for making tables
%% than the plain LaTeX2e tabular which is used here.
%\begin{tabular}{|c||c|}
%\hline
%One & Two\\
%\hline
%Three & Four\\
%\hline
%\end{tabular}
%\end{table}


% Note that IEEE does not put floats in the very first column - or typically
% anywhere on the first page for that matter. Also, in-text middle ("here")
% positioning is not used. Most IEEE journals use top floats exclusively.
% However, Computer Society journals sometimes do use bottom floats - bear
% this in mind when choosing appropriate optional arguments for the
% figure/table environments.
% Note that, LaTeX2e, unlike IEEE journals, places footnotes above bottom
% floats. This can be corrected via the \fnbelowfloat command of the
% stfloats package.


\section{Summary}

Unlike most privacy approaches, we focus on helping both data
consumers as well as data owners to share sensitive data according to
privacy policies. We provide consumers with sufficient information to
make correct queries enabling them to comply with complicated policies
associated with accessing and using sensitive data. \comment{Our
  policy-aware approach introduces a declarative policy expression
  language that is not domain dependent and provides detailed
  explanations for every policy result.} Along with this, by
maintaining machine-processable logs the system is able to detect
inappropriate information use through after-the-fact auditing.

Possible future work includes rewriting incoming queries so that they
are compliant with the privacy policies and integration with the
Privacy Integrated Queries (PINQ) toolkit~\cite{sherry09pinq} to allow
the addition of a customizable amount of noise to the result of
aggregate queries in order to prevent the leakage of sensitive
information.

%Rewriting queries is a possible approach

%reasoner to make better decisions possible integration with PINQ


% if have a single appendix:
%\appendix[Proof of the Zonklar Equations]
% or
%\appendix  % for no appendix heading
% do not use \section anymore after \appendix, only \section*
% is possibly needed

% use appendices with more than one appendix
% then use \section to start each appendix
% you must declare a \section before using any
% \subsection or using \label (\appendices by itself
% starts a section numbered zero.)
%

% use section* for acknowledgement
\ifCLASSOPTIONcompsoc
  % The Computer Society usually uses the plural form
  \section*{Acknowledgments}
\else
  % regular IEEE prefers the singular form
  \section*{Acknowledgment}
\fi 

The authors wish to thank their colleagues for their contributions to
this project. This work was supported in part by AFOSR YIP award
FA9550-09-1-0152 and IARPA award number FA8750-07-2-0031.

% Can use something like this to put references on a page
% by themselves when using endfloat and the captionsoff option.
%\ifCLASSOPTIONcaptionsoff
%  \newpage
%\fi

% trigger a \newpage just before the given reference
% number - used to balance the columns on the last page
% adjust value as needed - may need to be readjusted if
% the document is modified later
%\IEEEtriggeratref{8}
% The "triggered" command can be changed if desired:
%\IEEEtriggercmd{\enlargethispage{-5in}}

% references section

% can use a bibliography generated by BibTeX as a .bbl file
% BibTeX documentation can be easily obtained at:
% http://www.ctan.org/tex-archive/biblio/bibtex/contrib/doc/
% The IEEEtran BibTeX style support page is at:
% http://www.michaelshell.org/tex/ieeetran/bibtex/
\bibliographystyle{IEEEtran}
% argument is your BibTeX string definitions and bibliography database(s)
\bibliography{db-privacy}
%
% <OR> manually copy in the resultant .bbl file
% set second argument of \begin to the number of references
% (used to reserve space for the reference number labels box)

% biography section
% 
% If you have an EPS/PDF photo (graphicx package needed) extra braces are
% needed around the contents of the optional argument to biography to prevent
% the LaTeX parser from getting confused when it sees the complicated
% \includegraphics command within an optional argument. (You could create
% your own custom macro containing the \includegraphics command to make things
% simpler here.)
%\begin{biography}[{\includegraphics[width=1in,height=1.25in,clip,keepaspectratio]{mshell}}]{Michael Shell}
% or if you just want to reserve a space for a photo:

%\begin{IEEEbiography}{Michael Shell}
%Biography text here.
%\end{IEEEbiography}

% if you will not have a photo at all:
%\begin{IEEEbiographynophoto}{John Doe}
%Biography text here.
%\end{IEEEbiographynophoto}

% insert where needed to balance the two columns on the last page with
% biographies
%\newpage

%\begin{IEEEbiographynophoto}{Jane Doe}
%Biography text here.
%\end{IEEEbiographynophoto}

% You can push biographies down or up by placing
% a \vfill before or after them. The appropriate
% use of \vfill depends on what kind of text is
% on the last page and whether or not the columns
% are being equalized.

%\vfill

% Can be used to pull up biographies so that the bottom of the last one
% is flush with the other column.
%\enlargethispage{-5in}

% that's all folks
\end{document}


