\documentclass[11pt,twoside]{article}\makeatletter

\IfFileExists{xcolor.sty}%
  {\RequirePackage{xcolor}}%
  {\RequirePackage{color}}
\usepackage{colortbl}
\usepackage{wrapfig}
\usepackage{ifxetex}
\ifxetex
  \usepackage{fontspec}
  \usepackage{xunicode}
  \catcode`⃥=\active \def⃥{\textbackslash}
  \catcode`❴=\active \def❴{\{}
  \catcode`❵=\active \def❵{\}}
  \def\textJapanese{\fontspec{Noto Sans CJK JP}}
  \def\textChinese{\fontspec{Noto Sans CJK SC}}
  \def\textKorean{\fontspec{Noto Sans CJK KR}}
  \setmonofont{DejaVu Sans Mono}
  
\else
  \IfFileExists{utf8x.def}%
   {\usepackage[utf8x]{inputenc}
      \PrerenderUnicode{–}
    }%
   {\usepackage[utf8]{inputenc}}
  \usepackage[english]{babel}
  \usepackage[T1]{fontenc}
  \usepackage{float}
  \usepackage[]{ucs}
  \uc@dclc{8421}{default}{\textbackslash }
  \uc@dclc{10100}{default}{\{}
  \uc@dclc{10101}{default}{\}}
  \uc@dclc{8491}{default}{\AA{}}
  \uc@dclc{8239}{default}{\,}
  \uc@dclc{20154}{default}{ }
  \uc@dclc{10148}{default}{>}
  \def\textschwa{\rotatebox{-90}{e}}
  \def\textJapanese{}
  \def\textChinese{}
  \IfFileExists{tipa.sty}{\usepackage{tipa}}{}
\fi
\def\exampleFont{\ttfamily\small}
\DeclareTextSymbol{\textpi}{OML}{25}
\usepackage{relsize}
\RequirePackage{array}
\def\@testpach{\@chclass
 \ifnum \@lastchclass=6 \@ne \@chnum \@ne \else
  \ifnum \@lastchclass=7 5 \else
   \ifnum \@lastchclass=8 \tw@ \else
    \ifnum \@lastchclass=9 \thr@@
   \else \z@
   \ifnum \@lastchclass = 10 \else
   \edef\@nextchar{\expandafter\string\@nextchar}%
   \@chnum
   \if \@nextchar c\z@ \else
    \if \@nextchar l\@ne \else
     \if \@nextchar r\tw@ \else
   \z@ \@chclass
   \if\@nextchar |\@ne \else
    \if \@nextchar !6 \else
     \if \@nextchar @7 \else
      \if \@nextchar (8 \else
       \if \@nextchar )9 \else
  10
  \@chnum
  \if \@nextchar m\thr@@\else
   \if \@nextchar p4 \else
    \if \@nextchar b5 \else
   \z@ \@chclass \z@ \@preamerr \z@ \fi \fi \fi \fi
   \fi \fi  \fi  \fi  \fi  \fi  \fi \fi \fi \fi \fi \fi}
\gdef\arraybackslash{\let\\=\@arraycr}
\def\@textsubscript#1{{\m@th\ensuremath{_{\mbox{\fontsize\sf@size\z@#1}}}}}
\def\Panel#1#2#3#4{\multicolumn{#3}{){\columncolor{#2}}#4}{#1}}
\def\abbr{}
\def\corr{}
\def\expan{}
\def\gap{}
\def\orig{}
\def\reg{}
\def\ref{}
\def\sic{}
\def\persName{}\def\name{}
\def\placeName{}
\def\orgName{}
\def\textcal#1{{\fontspec{Lucida Calligraphy}#1}}
\def\textgothic#1{{\fontspec{Lucida Blackletter}#1}}
\def\textlarge#1{{\large #1}}
\def\textoverbar#1{\ensuremath{\overline{#1}}}
\def\textquoted#1{‘#1’}
\def\textsmall#1{{\small #1}}
\def\textsubscript#1{\@textsubscript{\selectfont#1}}
\def\textxi{\ensuremath{\xi}}
\def\titlem{\itshape}
\newenvironment{biblfree}{}{\ifvmode\par\fi }
\newenvironment{bibl}{}{}
\newenvironment{byline}{\vskip6pt\itshape\fontsize{16pt}{18pt}\selectfont}{\par }
\newenvironment{citbibl}{}{\ifvmode\par\fi }
\newenvironment{docAuthor}{\ifvmode\vskip4pt\fontsize{16pt}{18pt}\selectfont\fi\itshape}{\ifvmode\par\fi }
\newenvironment{docDate}{}{\ifvmode\par\fi }
\newenvironment{docImprint}{\vskip 6pt}{\ifvmode\par\fi }
\newenvironment{docTitle}{\vskip6pt\bfseries\fontsize{22pt}{25pt}\selectfont}{\par }
\newenvironment{msHead}{\vskip 6pt}{\par}
\newenvironment{msItem}{\vskip 6pt}{\par}
\newenvironment{rubric}{}{}
\newenvironment{titlePart}{}{\par }

\newcolumntype{L}[1]{){\raggedright\arraybackslash}p{#1}}
\newcolumntype{C}[1]{){\centering\arraybackslash}p{#1}}
\newcolumntype{R}[1]{){\raggedleft\arraybackslash}p{#1}}
\newcolumntype{P}[1]{){\arraybackslash}p{#1}}
\newcolumntype{B}[1]{){\arraybackslash}b{#1}}
\newcolumntype{M}[1]{){\arraybackslash}m{#1}}
\definecolor{label}{gray}{0.75}
\def\unusedattribute#1{\sout{\textcolor{label}{#1}}}
\DeclareRobustCommand*{\xref}{\hyper@normalise\xref@}
\def\xref@#1#2{\hyper@linkurl{#2}{#1}}
\begingroup
\catcode`\_=\active
\gdef_#1{\ensuremath{\sb{\mathrm{#1}}}}
\endgroup
\mathcode`\_=\string"8000
\catcode`\_=12\relax

\usepackage[a4paper,twoside,lmargin=1in,rmargin=1in,tmargin=1in,bmargin=1in,marginparwidth=0.75in]{geometry}
\usepackage{framed}

\definecolor{shadecolor}{gray}{0.95}
\usepackage{longtable}
\usepackage[normalem]{ulem}
\usepackage{fancyvrb}
\usepackage{fancyhdr}
\usepackage{graphicx}
\usepackage{marginnote}

\renewcommand{\@cite}[1]{#1}


\renewcommand*{\marginfont}{\itshape\footnotesize}

\def\Gin@extensions{.pdf,.png,.jpg,.mps,.tif}

  \pagestyle{fancy}

\usepackage[pdftitle={Analysis of Existing Privacy-Aware Access Control for E-Commerce Application},
 pdfauthor={}]{hyperref}
\hyperbaseurl{}

	 \paperwidth210mm
	 \paperheight297mm
              
\def\@pnumwidth{1.55em}
\def\@tocrmarg {2.55em}
\def\@dotsep{4.5}
\setcounter{tocdepth}{3}
\clubpenalty=8000
\emergencystretch 3em
\hbadness=4000
\hyphenpenalty=400
\pretolerance=750
\tolerance=2000
\vbadness=4000
\widowpenalty=10000

\renewcommand\section{\@startsection {section}{1}{\z@}%
     {-1.75ex \@plus -0.5ex \@minus -.2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\Large\bfseries}}
\renewcommand\subsection{\@startsection{subsection}{2}{\z@}%
     {-1.75ex\@plus -0.5ex \@minus- .2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\Large}}
\renewcommand\subsubsection{\@startsection{subsubsection}{3}{\z@}%
     {-1.5ex\@plus -0.35ex \@minus -.2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\large}}
\renewcommand\paragraph{\@startsection{paragraph}{4}{\z@}%
     {-1ex \@plus-0.35ex \@minus -0.2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\normalsize}}
\renewcommand\subparagraph{\@startsection{subparagraph}{5}{\parindent}%
     {1.5ex \@plus1ex \@minus .2ex}%
     {-1em}%
     {\reset@font\normalsize\bfseries}}


\def\l@section#1#2{\addpenalty{\@secpenalty} \addvspace{1.0em plus 1pt}
 \@tempdima 1.5em \begingroup
 \parindent \z@ \rightskip \@pnumwidth 
 \parfillskip -\@pnumwidth 
 \bfseries \leavevmode #1\hfil \hbox to\@pnumwidth{\hss #2}\par
 \endgroup}
\def\l@subsection{\@dottedtocline{2}{1.5em}{2.3em}}
\def\l@subsubsection{\@dottedtocline{3}{3.8em}{3.2em}}
\def\l@paragraph{\@dottedtocline{4}{7.0em}{4.1em}}
\def\l@subparagraph{\@dottedtocline{5}{10em}{5em}}
\@ifundefined{c@section}{\newcounter{section}}{}
\@ifundefined{c@chapter}{\newcounter{chapter}}{}
\newif\if@mainmatter 
\@mainmattertrue
\def\chaptername{Chapter}
\def\frontmatter{%
  \pagenumbering{roman}
  \def\thechapter{\@roman\c@chapter}
  \def\theHchapter{\roman{chapter}}
  \def\thesection{\@roman\c@section}
  \def\theHsection{\roman{section}}
  \def\@chapapp{}%
}
\def\mainmatter{%
  \cleardoublepage
  \def\thechapter{\@arabic\c@chapter}
  \setcounter{chapter}{0}
  \setcounter{section}{0}
  \pagenumbering{arabic}
  \setcounter{secnumdepth}{6}
  \def\@chapapp{\chaptername}%
  \def\theHchapter{\arabic{chapter}}
  \def\thesection{\@arabic\c@section}
  \def\theHsection{\arabic{section}}
}
\def\backmatter{%
  \cleardoublepage
  \setcounter{chapter}{0}
  \setcounter{section}{0}
  \setcounter{secnumdepth}{2}
  \def\@chapapp{\appendixname}%
  \def\thechapter{\@Alph\c@chapter}
  \def\theHchapter{\Alph{chapter}}
  \appendix
}
\newenvironment{bibitemlist}[1]{%
   \list{\@biblabel{\@arabic\c@enumiv}}%
       {\settowidth\labelwidth{\@biblabel{#1}}%
        \leftmargin\labelwidth
        \advance\leftmargin\labelsep
        \@openbib@code
        \usecounter{enumiv}%
        \let\p@enumiv\@empty
        \renewcommand\theenumiv{\@arabic\c@enumiv}%
	}%
  \sloppy
  \clubpenalty4000
  \@clubpenalty \clubpenalty
  \widowpenalty4000%
  \sfcode`\.\@m}%
  {\def\@noitemerr
    {\@latex@warning{Empty `bibitemlist' environment}}%
    \endlist}

\def\tableofcontents{\section*{\contentsname}\@starttoc{toc}}
\parskip0pt
\parindent1em
\def\Panel#1#2#3#4{\multicolumn{#3}{){\columncolor{#2}}#4}{#1}}
\newenvironment{reflist}{%
  \begin{raggedright}\begin{list}{}
  {%
   \setlength{\topsep}{0pt}%
   \setlength{\rightmargin}{0.25in}%
   \setlength{\itemsep}{0pt}%
   \setlength{\itemindent}{0pt}%
   \setlength{\parskip}{0pt}%
   \setlength{\parsep}{2pt}%
   \def\makelabel##1{\itshape ##1}}%
  }
  {\end{list}\end{raggedright}}
\newenvironment{sansreflist}{%
  \begin{raggedright}\begin{list}{}
  {%
   \setlength{\topsep}{0pt}%
   \setlength{\rightmargin}{0.25in}%
   \setlength{\itemindent}{0pt}%
   \setlength{\parskip}{0pt}%
   \setlength{\itemsep}{0pt}%
   \setlength{\parsep}{2pt}%
   \def\makelabel##1{\upshape ##1}}%
  }
  {\end{list}\end{raggedright}}
\newenvironment{specHead}[2]%
 {\vspace{20pt}\hrule\vspace{10pt}%
  \phantomsection\label{#1}\markright{#2}%

  \pdfbookmark[2]{#2}{#1}%
  \hspace{-0.75in}{\bfseries\fontsize{16pt}{18pt}\selectfont#2}%
  }{}
      \def\TheFullDate{2012-05-15 (revised: 15 May 2012)}
\def\TheID{\makeatother }
\def\TheDate{2012-05-15}
\title{Analysis of Existing Privacy-Aware Access Control for E-Commerce Application}
\author{}\makeatletter 
\makeatletter
\newcommand*{\cleartoleftpage}{%
  \clearpage
    \if@twoside
    \ifodd\c@page
      \hbox{}\newpage
      \if@twocolumn
        \hbox{}\newpage
      \fi
    \fi
  \fi
}
\makeatother
\makeatletter
\thispagestyle{empty}
\markright{\@title}\markboth{\@title}{\@author}
\renewcommand\small{\@setfontsize\small{9pt}{11pt}\abovedisplayskip 8.5\p@ plus3\p@ minus4\p@
\belowdisplayskip \abovedisplayskip
\abovedisplayshortskip \z@ plus2\p@
\belowdisplayshortskip 4\p@ plus2\p@ minus2\p@
\def\@listi{\leftmargin\leftmargini
               \topsep 2\p@ plus1\p@ minus1\p@
               \parsep 2\p@ plus\p@ minus\p@
               \itemsep 1pt}
}
\makeatother
\fvset{frame=single,numberblanklines=false,xleftmargin=5mm,xrightmargin=5mm}
\fancyhf{} 
\setlength{\headheight}{14pt}
\fancyhead[LE]{\bfseries\leftmark} 
\fancyhead[RO]{\bfseries\rightmark} 
\fancyfoot[RO]{}
\fancyfoot[CO]{\thepage}
\fancyfoot[LO]{\TheID}
\fancyfoot[LE]{}
\fancyfoot[CE]{\thepage}
\fancyfoot[RE]{\TheID}
\hypersetup{citebordercolor=0.75 0.75 0.75,linkbordercolor=0.75 0.75 0.75,urlbordercolor=0.75 0.75 0.75,bookmarksnumbered=true}
\fancypagestyle{plain}{\fancyhead{}\renewcommand{\headrulewidth}{0pt}}

\date{}
\usepackage{authblk}

\providecommand{\keywords}[1]
{
\footnotesize
  \textbf{\textit{Index terms---}} #1
}

\usepackage{graphicx,xcolor}
\definecolor{GJBlue}{HTML}{273B81}
\definecolor{GJLightBlue}{HTML}{0A9DD9}
\definecolor{GJMediumGrey}{HTML}{6D6E70}
\definecolor{GJLightGrey}{HTML}{929497} 

\renewenvironment{abstract}{%
   \setlength{\parindent}{0pt}\raggedright
   \textcolor{GJMediumGrey}{\rule{\textwidth}{2pt}}
   \vskip16pt
   \textcolor{GJBlue}{\large\bfseries\abstractname\space}
}{%   
   \vskip8pt
   \textcolor{GJMediumGrey}{\rule{\textwidth}{2pt}}
   \vskip16pt
}

\usepackage[absolute,overlay]{textpos}

\makeatother 
      \usepackage{lineno}
      \linenumbers
      
\begin{document}

             \author[1]{Dr. Norjihan Abdul  Ghani}

             \author[2]{Harihodin  Selamat}

             \author[3]{Zailani Mohamed  Sidek}

             \affil[1]{  }

\renewcommand\Authands{ and }

\date{\small \em Received: 7 April 2012 Accepted: 30 April 2012 Published: 15 May 2012}

\maketitle


\begin{abstract}
        


Due to the growing use of the internet, more and more critical processes are running over the web such as e-commerce. Internet allows commerce and business between parties who are physically distant and do not know each other doing the transaction. For the effective operation of the web application and e-commerce applications, security is a key issue. Various aspects of security are relevant to e-commerce such as database security. The availability of e-commerce, user transactions are no longer bound to traditional office-centered environment, but it can be started virtually anywhere at any time. It was moving from closed environment to open environment. In this paper, we clearly define the privacy-aware access control requirements. We also investigated few existing access control in the context of this requirements. We build an assessment criteria in our comparison based on the requirements defined which we finally used it later as a guidelines to design an access control for e-commerce application.

\end{abstract}


\keywords{access control, data privacy, e-commerce.}

\begin{textblock*}{18cm}(1cm,1cm) % {block width} (coords) 
\textcolor{GJBlue}{\LARGE Global Journals \LaTeX\ JournalKaleidoscope\texttrademark}
\end{textblock*}

\begin{textblock*}{18cm}(1.4cm,1.5cm) % {block width} (coords) 
\textcolor{GJBlue}{\footnotesize \\ Artificial Intelligence formulated this projection for compatibility purposes from the original article published at Global Journals. However, this technology is currently in beta. \emph{Therefore, kindly ignore odd layouts, missed formulae, text, tables, or figures.}}
\end{textblock*}


\let\tabcellsep& 	 	 		 \par
particular person is stored in approximately 1000 different databases \hyperref[b5]{[4]}.\par
However, the only support provided by database systems where much sensitive structured data reside is the mechanism for access control \hyperref[b8]{[7]}.\par
A basic idea of access control system is to authorize a user to access only a subset of the data. But, the traditional access control systems having more limitation since in e-commerce we need more reliable and appropriate access control system. The main contribution of this paper is to highlight the main requirements of privacy-aware access control for ecommerce environment.\par
The rest of the paper is organized as follows. Section 2 discusses the related works in this area. Section 3 discovers basic requirements for the privacyaware access control in e-commerce application. In section 4, we reviewed several access control model which tailored to the basic requirements that have been identified. Then, we make a comparison study between the existing access controls based on the existing models in Section 5. Section 6 concludes the paper.\par
We will discuss about previous work in the area of privacy preservation in the categories of extending the basic access control model for privacy preservation in ecommerce application. In the previous years, there are a lots of researches have been done in protecting the personal data. The purpose of the researches is to provide an access control system which tailored to privacy aware. In order to address the shortcomings of traditional access control which is lack support for privacy-related, the concept of Hippocratic Database been introduced in \hyperref[b0]{[1]}. In this concept, the notion of purpose plays a major role in access control models. Motivated by this concept, many researchers used the concept of purpose in introducing the privacy-aware access control \hyperref[b18]{[16]} , \hyperref[b6]{[5]} and \hyperref[b7]{[6]}.\par
Entities are able to choose flexibly what of their data should be accessed to whom, for what purposes and in what circumstances. This concept was not satisfies with the idea that the entities of the data should have more control over the release of their information. The idea of entities having control on access to their data when it stored in e-form has been viewed as an (inalienable) right \hyperref[b3]{[2]}. We also investigated other important factors in e-commerce application such as the heterogeneity of users. User credential has been widely used to support the heterogeneity if users in ecommerce. Various types of credentials are being used by existing applications such as identity credential \hyperref[b12]{[10]} , \hyperref[b17]{[15]} and standard credential \hyperref[b13]{[11]}. The differences of this paper is where we introduce the main requirements of privacy access control which it highlighted three basic requirements; purpose, individual control and the use of credential.\par
Due to the growing use of internet, more and more critical processes are run over the web such as egovernment or e-commerce applications. While current information technology enables people to carry out their business virtually at any time in any place, it also provides the capability to store various types of information the users reveal during their activities. The Federal Trade commission has shown that 97 percent of websites were collecting at least one type of identifying information such as name, e-mail address, or postal address of customers. The current database technology makes it possible to collect and store a massive amount of person-specific data.\par
An important requirement of any information management system is to protect data and resources against unauthorized disclosure (secrecy) and authorized or improper modification (integrity), while at the same time ensuring the availability to legitimate users (no denials-of-services). Data protection is ensured by different components of a database management system (DBMS). In particular, an access control mechanism ensures data confidentiality \hyperref[b4]{[3]}. The advance of database technology has also significantly increased privacy concerns. Enforcing protection therefore requires that every access to a system and its resources be controlled and that all and only authorized accesses can take place. This process goes under access control.\par
This situation was lead to the awareness of privacy-aware access control. Many privacy policy access control models have been proposed in order to protect the privacy of consumers. In \hyperref[b7]{[6]}, the authors pointed out that privacy protection cannot be easily achieved by traditional access control models as it focuses on which user is performing which action on which data object. Agrawal in \hyperref[b0]{[1]} introduces Hippocratic Database, but it was applied at implementation side. This section, we will discuss the requirements for privacy-aware access control model in database system: a) Flexible User Specification Mechanism Based On User Credentials\par
Most web-based applications are characterized by a user population which is far more heterogeneous and dynamic than user population typical of conventional information systems. Traditional access control which based on user identity is not relevant anymore when dealing with large numbers of users in open or distributed environment. There is thus the need for using other properties of subjects (e.g., age, nationality, job position) besides login in the specification and enforcement of access control. In an open and distributed environment data access is required by anyone spontaneously, centralized access control methodologies based on identity verification are not suitable. The credential based access control is found to be more appropriate in such environment \hyperref[b13]{[11]}. b) Supporting Open Environment Government, large companies, and many other organizations are required to offer access to information contained within their information systems to a multitude of users. Users can be internal or external, and typically access the data from their clients connected to a network, refers to open environment. This scenario set the requirements that cannot be easily support with traditional authorization and access control solutions \hyperref[b14]{[12]}. 
\section[{c) Purpose Based Data Privacy Protection}]{c) Purpose Based Data Privacy Protection}\par
Privacy-aware access control deals with privacy specification and private data management systems. In privacy-aware access control models, the notion of purpose plays a central role as the purpose is the basic concepts around which privacy protection is built. The notion of appears in all privacy codes and legislations such as Data Quality Principle in the OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data. 
\section[{d) Data Subject Involvement}]{d) Data Subject Involvement}\par
Privacy preservation is an important requirement whenever personal data is collected, stored and disclosed. One of the main challenges is to share the information while complying with the data-owner privacy preferences.\par
There are however, a number of applications that require individual entities to be able to choose flexibly what of their data should be accessible to whom, for what purpose, and in what circumstances \hyperref[b3]{[2]}. The idea of this owner controlled access control arise when data subjects should have more control over the release of their information to selected recipients and having more control when accessing their information when released it. F ebruary model. In this section, we will briefly discuss several modern access control model which tailored to privacyaware in e-commerce scenario. a) AC \#1 : Self-Managed Access Control Self-managed access control (SMAC) is also known as abstract meta-model access control. The idea of this access control arise when data subjects should have more control over the release of their information to selected recipients and having more control when accessing their information when released it \hyperref[b3]{[2]}. SMAC focus on providing data subjects to define the access controls on their data in order to ensure its confidentiality and so that the data may be used for the data subject's personal advantage.\par
SMAC policies provide data subjects so that they can provide the purposes for their data. Another feature of SMAC is that policies on access to personal data are facilitated in a distributed as well as a dynamic context. SMAC allow data subjects to choose freely what sources of information are to be used to determine authorized access to their data. Data subjects may revise a data controller's policy on the release of their personal data or the data subject may define its policy on the release of this data. This access control model separates the data and policy and there is no annotation of data with purpose. It allows for dynamic policies on private data access to be effected autonomously and our logic language allows for executable specifications of access control policies. The limitations of this access control are it not considers obligations, audit policies, and hierarchies of objects or of purposes \hyperref[b3]{[2]}. Assumptions have been made that data is stored and transmitted securely and that sound methods of authentication of data subjects, controllers and recipients are fully employed. 
\section[{b) AC \#2 Purpose-Based Access Control}]{b) AC \#2 Purpose-Based Access Control}\par
Privacy preservation of individuals is a challenging problem in the data-mining environment. Enterprises collect customer's personal identification information along with other attributes during any kinds of marketing systems. It is a natural expectation that the enterprise will use this information for various purposes, this leads to concern that the personal data may be misused. These types of access control permits that the particular data element can be conditionally or unconditionally accessed only for the specific purposes with certain conditions. P3P introduced by World Wide Web Consortium defines purpose as "the reason(s) for data collection and use" and specifies a set of purposes.\par
Since privacy policies are concerned with the purposes that data object is used for rather than the actions that users perform on the data object, traditional access control models cannot easily achieve privacy protection, and the notion of purpose should play a major role in access control model to protect privacy.\par
Today, the concept of purpose is used as the basis of access control policy \hyperref[b6]{[5]}. c) AC \#3 : Privacy-Aware Role-Based Access Control Privacy-aware Role Based Access Control (P-RBAC) system is based on three requirements as following; the access must be both secure and privacy preserving, the access must be allowed to individuals from different organizations; the access could be confined based on meta information of the system. The idea behind access control is when we need to share sensitive information in a large distributed and heterogeneous environment. In P-RBAC, access permissions are assigned to roles and users obtain such permissions by being assigned to rules.\par
The distinctive feature of Core P-RBAC lies in the complex structure of privacy permissions, which reflects the highly structured ways of expressing privacy rules to represent the essences of OECD principles. Hence, aside from the data and the action to be performed on it, privacy permission explicitly states the intended purpose of the action along with the conditions under which the permission can be granted and the obligations that are to be finally performed. The notion of data profile is a key in our approach in that it records all information about data that are relevant for privacy enforcement. A data profile is organized as a record storing attributes, that is, properties about a data item or a set of data items. 
\section[{d) AC \#4 : Cryptography-Based Access Control}]{d) AC \#4 : Cryptography-Based Access Control}\par
Cryptography access control is a new access control paradigm designed for information systems. It defines an implicit access control mechanism which relies absolutely on cryptography to ensure the data confidentiality and integrity. The basic idea of this access control is to provide a unique key for each resource type so that all users belonging to a class are assigned the key of that class \hyperref[b15]{[13]}. Cryptography based access control mechanism is designed to operate in an open environment, where establishing the identity of the client suggests no information about the likely behavior of the client and, thus, is unrelated to the secure operation of the server. 
\section[{e) AC \#5 : Credential-Based Access Control}]{e) AC \#5 : Credential-Based Access Control}\par
Traditional access control approaches are based on identity based authentication where it is assumed that the users are known to provide generally through a process of registration. In an open system environment where data is accessed by anyone anytime, centralized access control is not suitable \hyperref[b13]{[11]}.\par
User credentials are used to define access control policy and anyone who posses desired credentials is granted access to shared data source. The main advantage of credential-based access control is that it does not require central control and allows users to specify their own trust specification. It has been observed that various kinds of credentials are being used by existing applications and different credentials are found suitable in different environment such as identity credential, attribute credentials and standard credential. CBAC systems are based on authorization. Users do not need to specifically identify themselves, only their authority over a resource. Credentials enable departing from traditional authentication means avoiding the needs for users to remember logins and passwords, at the same time increasing the difficulty for adversaries of impersonating users and improperly acquire access priviledge.\par
Comparisons in Table  {\ref 1} highlight several issues in the current access control. Assessment criteria have been derived from the access control in database system requirements discussed previously. The following summarize the criteria used to characterize the access control models as follows : a) Permission Decision Permission decision is a structure of the authorization in an access control model. Basic tuple of access control is ?subject, object, operation? paradigm was used in a traditional access control. A typical features of this criteria is that a way how the permissions decisions are represented as approvals of access to an object in specific access mode. 
\section[{b) Policy Specification}]{b) Policy Specification}\par
Access control models are based on the specification and representation of policies that govern a database access system. The model should support the ways of specifying the access control policies and syntaxes, rules of languages that allows extension and modification in a simple and transparent manner. This helps to ensure the scalability of the model. 
\section[{c) Authorization-Based}]{c) Authorization-Based}\par
Authorization-based criteria define the way how the authorization is executed. In this case we examine Today, more people rely on online or web services in their daily life transactions such as buying groceries, renew driving license, even though checking their health. This may lead to increasing amount of PI disclosing via internet. The more data being disclose, the more owner lose his/her own privacy. This is because people will lose their control towards the PI once disclosing it. Data privacy is growing concern among businesses and other organizations in a variety sectors. A first important class of techniques deals with privacy preservation when data are to be released to third parties. In this case, data once are released are no longer under the control of the organizations owning them are made. to the -organization's data?. This access control focus on providing data subjects with means for defining access controls on their data, to help to ensure its confidentiality and so that the data may be used for the data subject's personal advantage.\par
Most of the current access control system focus on privacy-aware access control. But, due to the changes of consumer's perception of e-commerce, we have paid more attention in developing an access control which support open environment. Other than that, the notion of purpose is important in developing the access control model for privacy protection. This paper highlighted three basic requirements in proposing the access control system for e-commerce; purpose, individual control and the use of credential. This paper will give a better understanding and will be used as our future research in extending the current access control to a new one which it will be built based on those requirements. Our future research are trying to develop a privacy-aware access control system for e-commerce which applying all the requirements needed.\begin{figure}[htbp]
\noindent\textbf{}\includegraphics[]{image-2.png}
\caption{\label{fig_0}}\end{figure}
  \begin{figure}[htbp]
\noindent\textbf{.} \par 
\begin{longtable}{P{0.4317460317460317\textwidth}P{0.14436507936507936\textwidth}P{0.05261904761904762\textwidth}P{0.06746031746031746\textwidth}P{0.05801587301587301\textwidth}P{0.03373015873015873\textwidth}P{0.062063492063492064\textwidth}}
\tabcellsep Characteristics\tabcellsep AC \#1\tabcellsep AC \#2\tabcellsep AC \#3\tabcellsep AC \#4\tabcellsep AC \#5\\
\multicolumn{3}{l}{1 Policy specification Identificatio}\tabcellsep Object\tabcellsep Roles,\tabcellsep Unique\tabcellsep Credential\\
\tabcellsep \tabcellsep n-based\tabcellsep Data, Role,\tabcellsep data,\tabcellsep key\tabcellsep \\
\tabcellsep \tabcellsep Logic\tabcellsep Purpose,\tabcellsep actions,\tabcellsep \tabcellsep \\
\tabcellsep \tabcellsep program\tabcellsep Access\tabcellsep Purpose,\tabcellsep \tabcellsep \\
2\tabcellsep Authorization-\tabcellsep Identity\tabcellsep Purpose\tabcellsep Role\tabcellsep Key\tabcellsep Identity/\\
\tabcellsep based\tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep attribute\\
3\tabcellsep Support Data\tabcellsep N\tabcellsep Y\tabcellsep Y\tabcellsep Y\tabcellsep Y\\
\tabcellsep Privacy (purpose)\tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep \\
4\tabcellsep Supporting\tabcellsep Open\tabcellsep Open\tabcellsep Open\tabcellsep Open\tabcellsep Open/\\
\tabcellsep environment\tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep Close\\
5\tabcellsep Data Subject\tabcellsep Y\tabcellsep N\tabcellsep N\tabcellsep NA\tabcellsep N\\
\tabcellsep Involvement\tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep \\
\multicolumn{4}{l}{the authorization rely on identity-based or other factors.}\tabcellsep \tabcellsep \tabcellsep \\
\multicolumn{4}{l}{Emerging trends in web-based applications and}\tabcellsep \tabcellsep \tabcellsep \\
\multicolumn{4}{l}{database technology where a large amount of data}\tabcellsep \tabcellsep \tabcellsep \\
\multicolumn{4}{l}{stored in a database, traditional access control which it}\tabcellsep \tabcellsep \tabcellsep \\
\multicolumn{3}{l}{refers to identity-based is not suitable anymore.}\tabcellsep \tabcellsep \tabcellsep \tabcellsep \\
\multicolumn{2}{l}{d) Support Data Privacy}\tabcellsep \tabcellsep \tabcellsep \tabcellsep \tabcellsep \end{longtable} \par
 
\caption{\label{tab_0}Table . 2}\end{figure}
 			\footnote{© 2012 Global Journals Inc. (US) Global Journal of Computer Science and Technology Volume XII Issue IV Version I} 			\footnote{© 2012 Global Journals Inc. (US)} 			\footnote{© 2012 Global Journals Inc. (US) F ebruary} 		 		\backmatter  			 
\subsection[{This page is intentionally left blank}]{This page is intentionally left blank}			 			  				\begin{bibitemlist}{1}
\bibitem[Agrawal et al. ()]{b0}\label{b0} 	 		\textit{},  		 			R Agrawal 		,  		 			J Kiernan 		,  		 			R Srikant 		.  		2002a.  	 
\bibitem[Yang et al. ()]{b18}\label{b18} 	 		\textit{},  		 			N Yang 		,  		 			H Barringer 		,  		 			N Zhang 		.  		2008.  	 
\bibitem[Chauduri et al. ()]{b8}\label{b8} 	 		\textit{},  		 			S Chauduri 		,  		 			R Kaushik 		,  		 			R Ramamurthy 		.  		2011.  	 
\bibitem[Nirmal and Ruchi ()]{b13}\label{b13} 	 		‘Access Control Methodology For Sharing Of Open And Domain Confined Data Using Standard Credentials’.  		 			D Nirmal 		,  		 			V Ruchi 		.  	 	 		\textit{International Journal on Computer Science and Engineering}  		2009. 2009. 1  (3)  p. .  	 
\bibitem[Samarati ()]{b14}\label{b14} 	 		‘Access control: Policies, models, and mechanisms’.  		 			V Samarati 		.  	 	 		\textit{FOSAD'00: International School on Foundations of Security Analysis and Design},  				2001.  	 
\bibitem[Johnston et al. ()]{b17}\label{b17} 	 		\textit{Authorization and Attribute Certificates for widely Distributed Access Control?},  		 			William Johnston 		,  		 			Srilekha Mudumbai 		,  		 			Mary Thompson 		.  		1998. IEEE WETICE.  	 
\bibitem[Bertino and Sandhu ()]{b4}\label{b4} 	 		 			E Bertino 		,  		 			R Sandhu 		.  		\textit{Database Security -Concepts, Approaches, and Challenges. IEEE Transactions on Dependable and Secure Computing},  				2005. 2.  	 
\bibitem[Wasim and Al-Hamdani ()]{b15}\label{b15} 	 		‘Cryptography based access control in healthcare web systems’.  		 			A Wasim 		,  		 			Al-Hamdani 		.  	 	 		\textit{Information Security Curriculum Development Conference},  				2010. 2010. p. .  	 
\bibitem[Database Access Control & Privacy: Is there a Commom Ground? 5 th Biennial Conference on Innovative Data Systems Research. (CIDR '11)]{b9}\label{b9} 	 		\textit{Database Access Control \& Privacy: Is there a Commom Ground? 5 th Biennial Conference on Innovative Data Systems Research. (CIDR '11)},  				 	 
\bibitem[Hippocratic Database]{b1}\label{b1} 	 		\textit{Hippocratic Database},  		 	 	 (Paper presented at the 28th) 
\bibitem[International Conference on Very Large Data Bases]{b2}\label{b2} 	 		\textit{International Conference on Very Large Data Bases},  				 (Hong Kong, China)  		 	 
\bibitem[Lefevre et al. ()]{b10}\label{b10} 	 		‘Limiting Disclosure in Hippocratic Databases’.  		 			K Lefevre 		,  		 			R Agrawal 		,  		 			V Ercegovac 		,  		 			R Ramakrishnan 		.  	 	 		\textit{Paper presented at the 30th international Conference on Very},  				2004.  	 
\bibitem[Barker ()]{b3}\label{b3} 	 		‘Personalizing access control by generalizing access control’.  		 			S Barker 		.  	 	 		\textit{Proceeding of the 15th ACM symposium on Access control models and technologies},  				 (eeding of the 15th ACM symposium on Access control models and technologies)  		2010. p. .  	 
\bibitem[Westin ()]{b16}\label{b16} 	 		\textit{Privacy and Freedom},  		 			A Westin 		.  		1967. New York: Atheneum.  	 
\bibitem[Large Data Bases et al. ()]{b11}\label{b11} 	 		‘Privacy-aware role based access control’.  		 			Large Data Bases 		,  		 			Canada Toronto 		,  		 			Q Ni 		,  		 			A Trombetta 		,  		 			E Bertino 		,  		 			J Lobo 		.  	 	 		\textit{Proceedings of the 12th ACM symposium on Access control models and technologies},  				 (the 12th ACM symposium on Access control models and technologies)  		2007. p. .  	 
\bibitem[Byun and Li ()]{b7}\label{b7} 	 		‘Purpose based access control for privacy protection in relational database systems’.  		 			J.-W Byun 		,  		 			N Li 		.  	 	 		\textit{The International Journal on Very Large Data Bases}  		2008. 17  (4)  p. .  	 
\bibitem[Byun et al. ()]{b6}\label{b6} 	 		‘Purpose based access control of complex data for privacy protection’.  		 			J Byun 		,  		 			E Bertino 		,  		 			N Li 		.  	 	 		\textit{Symposium on Access Control Model and Technologies},  				2005. SACMAT.  	 
\bibitem[Brands ()]{b5}\label{b5} 	 		\textit{Rethinking Public Key Infrastructures and Digital Certificates : Building in Privacy},  		 			S A Brands 		.  		2000. Cambridge, Massachusetts.  	 	 (Document Number) 
\bibitem[Thompson and Essiari (2003)]{b12}\label{b12} 	 		‘Srilekha Madumbai, -Certificate-based Authorization policy in a PKI Environment?’.  		 			Mary R Thompson 		,  		 			Abdellilah Essiari 		.  	 	 		\textit{ACM Transactions on Information and System Security (TISSEC)}  		November 2003. 6  (4)  p. .  	 
\end{bibitemlist}
 			 		 	 
\end{document}
