Policy representation and reasoning with preferences and reactivity

Policy-based privacy protection in open decentralized information systems such as the Web attracted a lot of research effort in the last years. Policies provide a flexible means to define access control conditions, to realize advanced trust-establishment techniques, and to describe and guide the behaviour of systems. The change in the use of the Web and its movement from a static information system to a user generated, highly dynamic environment requires policy-based techniques to keep step. New requirements to policy specification and reasoning are set up because, on the one hand, users expose more and more personal data and, on the other hand, the role of the Web as a communication platform gained momentum yielding an increasing dynamicy. In this thesis, the limitations of nowadays’ policy frameworks are analyzed towards two fundamental principles, the specification of preferences and the representation of reactive behaviour. Based on these observations two new approaches for policy representation and reasoning are introduced, namely preference-enabled policies and reactive policies. These approaches allow to incorporate arbitrary preference statements in policy specifications expressed by rule-based languages. They further extend policies to the dimension of events and reactions to go beyond the rather strict grant-or-deny-access principle of current policy-based systems. It is further described how both, preferenceenabled and reactive policies can be exploited in policy-based Trust Negotiation, and policy languages as well as protocols for advanced trust establishment based on preference-enabled and reactive policies are developed. Finally, this thesis describes how policies in general and reactive policies in particular can be exploited for privacy control and trust establishment in dynamic Social Web applications and showcases these findings by describing implementations of the new principles in the context of online Social Networks.