Upload
kellie-waters
View
218
Download
0
Tags:
Embed Size (px)
Citation preview
Towards End-to-End Privacy Control in the Outsourcing of
Marketing Activities: A Web Service Integration
Patrick C. K. Hung Dickson K.W. Chiu
W.W. Fung William K. CheungRaymond Wong Samuel P.M. ChoiEleanna Kafeza James KwokJousha C.C. Pun Vivying S.Y. Cheng
1BSIM0012
RECORDS MANAGEMENT
1. Introduction2. Background Information3. Towards End-to-End Privacy Control4. Conclusions and Future Works
AgendaAgenda
RECORDS MANAGEMENT
IntroductionIntroduction Marketing is a strategy for selling products more
efficiently.◦ sales promotion strategies for making consumers
recognize a product’s existence ◦ persuading them to take purchase actions◦ circulation strategies for efficiently delivering the desired
product◦ continuation strategies such as after-sales service and
claim processing. Outsourcing of marketing activities widely
adopted ◦ raises the concern of privacy issues.
RECORDS MANAGEMENT
PrivacyPrivacy Privacy is a state or condition of limited
access to a person.◦ Ref: SCHOEMAN, E. D. 1984. Philosophical Dimensions of Privacy: An
Anthology. New York, NY, Cambridge Univ. Press.
Information privacy relates to an individual’s right to determine how, when, and to what extent information about the self will be released to another person or to an organization.
RECORDS MANAGEMENT
Example ScenarioExample Scenario A bank performs a marketing campaign by calling
its credit card holders. Outsource the calling activity to a third-party
service provider◦ resource problems / other economic reasons
Personal information required◦ name, credit card number, gender, age group, salary
range, and even addresses activity Under current practices, all the necessary credit
card holders’ data are transferred in bulk from the bank to the marketing company.◦ large amount of personal information.
RECORDS MANAGEMENT
Example Process with Example Process with Web Service Solution Web Service Solution
Logon Select compaign
Dial another customer
Ask customer if interested
Tell details and pursuate customer
Bank Web service 1:get phone number
Bank Web service 2: surname, salutation
Bank Web service 3: more demographic data
Confirm transaction
Bank Web service 4: card number, perso...
Record and housekeeping
[ get through ]
[ fail ]
[ customer interested ]
[ fail ]
[ customer agree ][ fail ]
[ logout ]
[ more customer ]
RECORDS MANAGEMENT
What is Web ServiceWhat is Web Service
Web Services Clients
Web Server
Web Services
XML Messages/HTTP Binding
W3C definition of a Web Service◦ has a unique Uniform Resource Identifier (URI)
URI are commonly in the form of URL◦ can be defined, described, and discovered using
XML◦ supports exchange of XML messages via
Internet-based protocols◦ http://www.w3.org/2002/ws/
Supported by all major computing companies, e.g., IBM, Microsoft, Sun, and etc.
RECORDS MANAGEMENT
Access Control ConceptsAccess Control Concepts
Retention
Access Control
Role Based Access Control
RequestPurpose Recipient
Obligation
PermissionRetentionObligation
Input Output
RECORDS MANAGEMENT
Access Control LanguagesAccess Control Languages Enterprise Privacy Authorization Language
(EPAL) ◦ By IBM -
www.zurich.ibm.com/security/enterprise-privacy/◦ encode an enterprise’s privacy-related data-
handling policies and practices. ◦ An EPAL policy defines lists of hierarchies of data-
categories, data-users, and purposes, and sets of actions, obligations, and conditions.
Platform for Privacy Preferences (P3P)◦ Current W3C standard◦ http://www.w3.org/P3P/
RECORDS MANAGEMENT
A Layered Framework for A Layered Framework for Tackling Privacy ProtectionTackling Privacy Protection
RECORDS MANAGEMENT
Conceptual Model of Web-Service Conceptual Model of Web-Service Based Privacy Access ControlBased Privacy Access Control
PersonnelRole
Customer
Response Record
Marketing Process
Transactionbring
Data ViewMarketing
Task
peform
EPAL specification
authorize
+purposecontrol
Bank Web Service access
return via
call
controlspecify
RECORDS MANAGEMENT
Implementation Implementation ArchitectureArchitecture
Bank
MarketingCompany
Credit Card User Data
Credit Card Data Ontology
Organizational Structure Ontology
Privacy Access Control Policy
Privacy Access Control Preferences
Persons
Step 1
Step 1
Step 2
Step 2
Step 3 Step 3Step 4
Web Service
Web Service
Customer
RECORDS MANAGEMENT
ConclusionConclusion A layered architecture and methodology for the facilitation
of privacy control based-on Web services. A conceptual model of Web-service-based privacy access
control to facilitate the design of an implementation architecture.
Outsourced marketing companies can be integrated with adequate control and auditing.
Practicability showing how the call center software for a typical marketing activity can be integrated effectively with the banks’ Web service
Only the required part of a customer record is retrieved through the appropriate data views and sent one at a time to achieve strict end-to-end privacy.
RECORDS MANAGEMENT
Future WorkFuture Work Use P3P instead of EPAL Ontology: Adopt OWL vocabularies for
classifications Critical success factors Cost and technical requirements Implementation issues Extending the framework to other applicable
scenarios such as credit reference agencies.