Security and Privacy Policy Management in Dynamic and Context-Aware User-Centric Systems

Abstract

Considering user-centric systems, the problem of controlling the access to reserved resources is still open, especially due to the big amount of personal data generated every day by users. These data come primarily from mobile devices that became the main repository of personal information and source of user-generated contents as well as the principal controller of our social networked life. These data comes also from other connected devices of the everyday life, belonging to different domains (eg. in-car systems, TVs). In a multi-domain cross-platform scenario, in which web browsers represent the main vehicle for apps, currently there is a lack of consistent access control for security and privacy. To cope with this, a platform which aims to provide a single, cross-device policy system for web applications on a wide range of web-enabled devices including TVs, smartphones, in-car systems and PCs has been developed. This platform, named webinos, solves the existing deficiencies in web authorisation by introducing the concept of a personal zone, the set of all devices and services owned by a particular user. All devices in this zone can synchronize their access control policies through interoperable middleware and can create flexible rules which may refer to an individual user, device or the entire zone. Details of the architecture are provided and also the explanation of how the experience during design highlighted several conceptual challenges.