Expressing Privacy Policies Using Authorization Views

In this paper, we design a rule-based privacy policy for the RFID Ecosystem, an RFID-based ubiquitous computing system. We start from the physical access control (PAC) rule (Kriplean et al., IEEE Pervasive Computing 2007) that provides a default level of privacy but constrains the possible set of applications. We extend it by using principled ways of defining other access control rules that retain the simplicity of PAC and yet provide increased flexibility for users and applications. We then propose authorization views as a database technique to implent rule-based privacy policies and demonstrate the use of authorization views over the privacy policy designed for the RFID Ecosystem.