Balancing information privacy and operational utility in healthcare: proposing a privacy impact assessment (PIA) framework

2023 | European Journal of Information Systems | Citations: 0

Authors: Parks, Rachida F; Wigand, Rolf T; Benjamin Lowry, Paul

Abstract: One needs to look only at recent data breaches to be reminded of the severe and ... Expand

Abstract: One needs to look only at recent data breaches to be reminded of the severe and far-reaching damage caused by privacy threats. In light of these threats, global healthcare leaders are striving to understand how to protect patient information without the loss of benefits (utility) that results from privacy-preserving mechanisms. Consequently, our study examines the relatively unexplored issue of simultaneously responding to information privacy threats and maintaining utility in a healthcare privacy compliance context. Counterintuitively, we also identify a symbiotic relationship between these two focal and interdependent efforts. We adopt an interpretive qualitative research method leveraging the value-focused thinking (VFT) approach which results in two major contributions: (1) the development of a value-driven framework presented as a means-end objective network providing a list of 16 means objectives and seven key fundamental objectives enabling higher-quality privacy decision making vis-à-vis privacy and utility. Our second and central contribution (2) is a theoretical framework of privacy impact assessment (PIA) emphasising the interplay and balance between making appropriate decisions in responding to information privacy while not hindering healthcare operations. This work provides the foundation for proposing four compelling propositions for future healthcare privacy research. Collapse

Topics: privacy decision making organizational impact health information system usability

Methods: qualitative interview literature study personal interview triangulation theory development

AI applications of data sharing in agriculture 4.0: A framework for role-based data access control

2021 | International Journal of Information Management | Citations: 0

Authors: Spanaki, Konstantina; Karafili, Erisa; Despoudi, Stella

Abstract: Industry 4.0 and the associated IoT and data applications are evolving rapidly a ... Expand

Abstract: Industry 4.0 and the associated IoT and data applications are evolving rapidly and expand in various fields. Industry 4.0 also manifests in the farming sector, where the wave of Agriculture 4.0 provides multiple oppor­ tunities for farmers, consumers and the associated stakeholders. Our study presents the concept of Data Sharing Agreements (DSAs) as an essential path and a template for AI applications of data management among various actors. The approach we introduce adopts design science principles and develops role-based access control based on AI techniques. The application is presented through a smart farm scenario while we incrementally explore the data sharing challenges in Agriculture 4.0. Data management and sharing practices should enforce defined contextual policies for access control. The approach could inform policymaking decisions for role-based data management, specifically the data-sharing agreements in the context of Industry 4.0 in broad terms and Agri­ culture 4.0 in specific. Collapse

Topics: artificial intelligence data management access control role-based access control industry 4.0

Methods: design science case study

Theories: theory of abduction

An Accurate and Scalable Role Mining Algorithm based on Graph Embedding and Unsupervised Feature Learning

2020 | HICSS | Citations: 0

Authors: Abolfathi, Masoumeh; Raghebi, Zohreh; Jafarian, Jafar Haadi; Banaei-Kashani, Farnoush

Abstract: Role-based access control (RBAC) is one of the most widely authorization models ... Expand

Abstract: Role-based access control (RBAC) is one of the most widely authorization models used by organizations. In RBAC, accesses are controlled based on the roles of users within the organization. The flexibility and usability of RBAC have encouraged organizations to migrate from traditional discretionary access control (DAC) models to RBAC. The most challenging step in this migration is role mining, which is the process of extracting meaningful roles from existing access control lists. Although various approaches have been proposed to address this NP-complete role mining problem in the literature, they either suffer from low scalability, or present heuristics that suffer from low accuracy. In this paper, we propose an accurate and scalable approach to the role mining problem. To this aim, we represent user-permission assignments as a bipartite graph where nodes are users and permissions, and edges are user-permission assignments. Next, we introduce an efficient deep learning algorithm based on random walk sampling to learn low-dimensional representations of the graph, such that permissions that are assigned to similar users are closer in this new space. Then, we use k-means and GMM clustering techniques to cluster permission nodes into roles. We show the effectiveness of our proposed approach by testing it on different datasets. Experimental results show that our approach performs accurate role mining, even for large datasets. Collapse

Topics: access control role-based access control

Methods: computational algorithm cluster analysis experiment fuzzy clustering optimization model

Algorithms and Applications to Weighted Rank-one Binary Matrix Factorization

2020 | ACM Transactions on Management Information Systems | Citations: 0

Authors: Lu, Haibing; Chen, Xi; Shi, Junmin; Vaidya, Jaideep; Atluri, Vijayalakshmi; Hong, Yuan; Huang, Wei

Abstract: Many applications use data that are better represented in the binary matrix form ... Expand

Abstract: Many applications use data that are better represented in the binary matrix form, such as click-stream data, market basket data, document-term data, user-permission data in access control, and others. Matrix factorization methods have been widely used tools for the analysis of high-dimensional data, as they automatically extract sparse and meaningful features from data vectors. However, existing matrix factorization methods do not work well for the binary data. One crucial limitation is interpretability, as many matrix factorization methods decompose an input matrix into matrices with fractional or even negative components, which are hard to interpret in many real settings. Some matrix factorization methods, like binary matrix factorization, do limit decomposed matrices to binary values. However, these models are not flexible to accommodate some data analysis tasks, like trading off summary size with quality and discriminating different types of approximation errors. To address those issues, this article presents weighted rank-one binary matrix factorization, which is to approximate a binary matrix by the product of two binary vectors, with parameters controlling different types of approximation errors. By systematically running weighted rank-one binary matrix factorization, one can effectively perform various binary data analysis tasks, like compression, clustering, and pattern discovery. Theoretical properties on weighted rank-one binary matrix factorization are investigated and its connection to problems in other research domains are examined. As weighted rank-one binary matrix factorization in general is NP-hard, efficient and effective algorithms are presented. Extensive studies on applications of weighted rank-one binary matrix factorization are also conducted. Collapse

Topics: database system role-based access control access control information retrieval

Methods: computational algorithm experiment cluster analysis machine learning k-means clustering

Evidence-Based Information Systems: A New Perspective and a Road Map for Research-Informed Practice

2018 | Journal of the Association for Information Systems | Citations: 0

Authors: Wainwright, David W.; Oates, Briony J.; Edwards, Helen M.; Childs, Sue

Abstract: Despite the increasing sophistication and quality of published work, the develop ... Expand

Abstract: Despite the increasing sophistication and quality of published work, the development of a cumulative body of knowledge and an evidence-base for information systems (IS) research still represents a major challenge. IS research is still predominantly undertaken by IS researchers for other IS researchers and not utilized to its full extent by IS practitioners or policy-makers. We focus on this problem and express the need for a new evidence-based research perspective. It is argued that it is time to refocus the efforts of IS academics (and practitioners) to develop a new evidencebase for IS research whereby it can more routinely inform, develop, improve and support IS practice. We contribute to this debate by defining evidence-based practice (EBP), its relevance to IS, and the need to develop an evidence-based approach. We look in particular at its brief history, and its subsequent evolution, development and widespread acceptance in Medicine; making reference to recent arguments and critiques of EBP in other disciplines such as software engineering and management. We espouse the need to develop a similar evidence-based movement and infrastructure within the IS research and practitioner communities and then put forward a possible road map for the development of Evidence-Based Information Systems (EBIS) that comprises 9 key initiatives. We conclude our argument by stating that the current extent, severity and impact of IS failures are unacceptable, emphasizing the need for a new perspective for IS research that encourages and incorporates EBP as a guiding principle to inform better IS practice. Collapse

Topics: decision making role-based access control organizational context IS problem blog

Methods: structured literature research delphi study narrative analysis

Theories: semiotic theory socio technical theory

On Optimal Employee Assignment in Constrained Role-Based Access Control Systems

2017 | ACM Transactions on Management Information Systems | Citations: 0

Authors: Roy, Arindam; Sural, Shamik; Majumdar, Arun Kumar; Vaidya, Jaideep; Atluri, Vijayalakshmi

Abstract: Since any organizational environment is typically resource constrained, especial ... Expand

Abstract: Since any organizational environment is typically resource constrained, especially in terms of human capital, organization managers would like to maximize the utilization of available human resources. However, tasks cannot simply be assigned to arbitrary employees since the employee needs to have the necessary capabilities for executing a task. Furthermore, security policies constrain the assignment of tasks to employees, especially given the other tasks assigned to the same employee. Since role-based access control (RBAC) is the most commonly used access control model for commercial information systems, we limit our attention to consider constraints in RBAC. In this article, we define the Employee Assignment Problem (EAP), which aims to identify an employee to role assignment such that it permits the maximal flexibility in assigning tasks to employees while ensuring that the required security constraints are met. We prove that finding an optimal solution is NP-complete and therefore provide a greedy solution. Experimental evaluation of the proposed approach shows that it is both efficient and effective. Collapse

Topics: role-based access control access control Linux

Methods: computational algorithm integer linear programming literature study experiment optimization model

CBR-based negotiation RBAC model for enhancing ubiquitous resources management

2017 | International Journal of Information Management | Citations: 0

Authors: Tseng, Shian-Shyong; Chen, Hsing-Chung; Hu, Li-Ling; Lin, Yen-Tsung

Abstract: a b s t r a c tWith the progress of new technologies of information management, ... Expand

Abstract: a b s t r a c tWith the progress of new technologies of information management, Ubiquitous Resource Management (URM) is a dominant areas of research which requires efficient access management approaches. There have been huge challenges of controlling access to ubiquitous resources among collaborative multiservers based on the negotiating security policies on URMs. However, the traditional access control mechanisms were insufficient to meet the requirements of role assignment management for URMs that allow accessing services via huge clients. Therefore, Ubiquitous RBAC (Role-based Access Control) with CBR (case-based reasoning) based negotiation technique is proposed in this paper. The novel RBAC scheme could efficiently manage not only one ubiquitous server, but also multiple ubiquitous servers on the cooperation domain through supporting both negotiating role assignment (NRA) task and cooperative role assignment (CRA) task in URM-platform by using a spiral negotiating process. Furthermore, it solves the difficulties in reducing the costs of ubiquitous computing resources, e.g., the role reassigned rate, handover rate, bandwidth, and power consumption, etc. Due to the ease of use and its efficiency in negotiating and managing the user-to-role as well as virtual role assignment by applying CBR approach, it is a highly powerful strategy of information management for conducting the innovative research and design for ubiquitous RBAC scheme. Collapse

Topics: knowledge representation ubiquitous computing smart device information management mobile system

Methods: literature study

Theories: theory of case-based reasoning

Modeling Support for Role-Based Delegation in Process-Aware Information Systems

2014 | Business & Information Systems Engineering | Citations: 0

Authors: Schefer-Wenzl, Sigrid; Strembeck, Mark

Abstract: The paper presents an integrated approach for the modeling and enforcement of d ... Expand

Abstract: The paper presents an integrated approach for the modeling and enforcement of delegation policies in process-aware information systems. Based on a generic formal metamodel, the detection of delegation-related conflicts is discussed and a set of pre-defined resolution strategies for these conflicts is provided. Moreover, a corresponding UML extension, a prototypical proof of concept implementation, and a case study with real-world business processes is provided. Collapse

Topics: business process management role-based access control access control system support model driven development

Methods: design science unified modeling language case study metamodel computational algorithm

Evaluating A Uml-Based Modeling Framework For Process-Related Security Properties: A Qualitative Multi-Method Study

2013 | European Conference On Information Systems | Citations: 0

Authors: Schefer-Wenzl, Sigrid; Sobernig, Stefan; Strembeck, Mark

Abstract: In recent years, we developed a modeling framework for process-related security ... Expand

Abstract: In recent years, we developed a modeling framework for process-related security properties, the BusinessActivities Framework. This paper reports on a long-term empirical study to evaluate the applicability of four UML extensions included in the BusinessActivities Framework. We used an exploratory research design employing four interpretative case studies followed by three semistructured interviews based on 30 real-world business processes from a large Austrian school center. The case work resulted in 23 process models. By assessing the model complexity quantitatively and by interpreting the case as well as the interview material, we found that modelers are predominantly affected by the upfront effort of establishing a conceptual background on process-related security concepts and by the semantic complexity of control-flow modeling in UML activity diagrams. Nontechnical domain experts considered the visual process models as suitable communication instruments. The findings demonstrate the potential value of applying our modeling framework in a practitioner’s setting. Collapse

Topics: business process management systems development IT security model driven development role-based access control

Methods: case study design science unified modeling language qualitative interview business process modeling

Secure XML querying based on authorization graphs

2012 | Information Systems Frontiers | Citations: 0

Authors: Chebotko, Artem; Chang, Seunghan; Lu, Shiyong; Fotouhi, Farshad

Abstract: XML is rapidly emerging as a standard for data representation and exchange over ... Expand

Abstract: XML is rapidly emerging as a standard for data representation and exchange over the World Wide Web and an increasing amount of sensitive business data is processed in XML format. Therefore, it is critical to have control mechanisms to restrict a user to access only the parts of XML documents that she is authorized to access. In this paper, we propose the first DTD-based access control model that employs graph matching to analyze if an input query is fully acceptable, fully rejectable, or partially acceptable. In this way, there will be no further security overhead for the processing of fully acceptable and rejectable queries. For partially acceptable queries, we propose a graph-matching based authorization model for an optimized rewriting procedure in which a recursive query (query with descendant axis ‘//’) will be rewritten into an equivalent recursive one if possible and into a non-recursive one only if necessary, resulting queries that can fully take advantage of structural join based query optimization techniques. Moreover, we propose an index structure for XML element types to speed up the query rewriting procedure, a facility that is potentially useful for applications with large DTDs. Our performance study results showed that our algorithms armed with rewriting indexes are promising. Collapse

Topics: extensible markup language authorization access control Java Microsoft Windows

Methods: computational algorithm experiment optimization model survey literature study