Abstract
The rapid proliferation of Application Programming Interfaces (APIs) enhances data exchange. Still, it introduces significant privacy and security risks, especially in the Internet of Things (IoT), where APIs often lack mechanisms to manage privacy and security, leading to vulnerabilities. Hippocratic Databases (HDBs) provide mechanisms, e.g., purpose-based access, to control database use. However, to effectively manage data access to the HDB, proper API design is crucial. This paper proposes a conceptual framework for a Hippocratic API (HAPI), revising traditional API design aiming to protect data subjects’ rights and enhance security. By embedding data protection and ethical standards into API operations, HAPIs rectify inadequacies in consent mechanisms and mitigate privacy risks. We identify non-functional requirements, design objectives, and techniques through extensive research of recent literature, informed by the ethical principles of the GDPR, ISO/IEC 27001, and HDBs. We present our findings by knowledge graphs, providing a comprehensive conceptual view of the relevant design knowledge.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Similar content being viewed by others
References
Abroshan, H.: A hybrid encryption solution to improve cloud computing security using symmetric and asymmetric cryptography algorithms. Int. J. Adv. Comput. Sci. Appl. 12, 31–37 (2021)
Adach, M., Hänninen, K., Lundqvist, K.: A combined security ontology based on the unified foundational ontology. In: IEEE International Conference on Semantic Computing (ICSC), pp. 187–194. IEEE (2022)
Agrawal, R., Kiernan, J., Srikant, R., Xu, Y.: Hippocratic databases. In: International Conference on Very Large Data Bases (VLDB), pp. 143–154. VLDB (2002)
Aljeraisy, A., Barati, M., Rana, O., Perera, C.: Privacy laws and privacy by design schemes for the internet of things: a developer’s perspective. ACM Comput. Surv. 54(5), 1–38 (2021)
Alkhariji, L., Alhirabi, N., Alraja, M.N., Barhamgi, M., Rana, O., Perera, C.: Synthesising privacy by design knowledge toward explainable internet of things application designing in healthcare. ACM Trans. Multimed. Comput. Commun. Appl. 17, 1–29 (2021)
Amoo, O.O., Atadoga, A., Osasona, F., Abrahams, T.O., Ayinla, B.S., Farayola, O.A., et al.: GDPR’s impact on cybersecurity: a review focusing on USA and European practices. Int. J. Sci. Res. Arch. 11, 1338–1347 (2024)
Aryavalli, S.N.G., Kumar, H.: Top 12 layer-wise security challenges and a secure architectural solution for Internet of Things. Comput. Electr. Eng. 105, 108487 (2023)
Askin, S., Burkhalter, D., Calado, G., El Dakrouni, S.: Artificial intelligence applied to clinical trials: opportunities and challenges. Heal. Technol. 13, 203–213 (2023)
Atlidakis, V., Godefroid, P., Polishchuk, M.: Checking security properties of cloud service REST APIs. In: IEEE International Conference on Software Testing, Validation and Verification (ICST) (2020)
Bach-Nutman, M.: Understanding the top 10 OWASP vulnerabilities. arXiv preprint arXiv:2012.09960 (2020)
Badawy, M.: Security evaluation of different hashing functions with RSA for digital signature. Int. J. Comput. Inf. 10, 99–116 (2023)
Barati, M., et al.: Privacy-aware cloud auditing for GDPR compliance verification in online healthcare. IEEE Trans. Industr. Inf. 18, 4808–4819 (2021)
Barth, S., Ionita, D., Hartel, P.: Understanding online privacy - a systematic review of privacy visualizations and privacy by design guidelines. ACM Comput. Surv. 55, 1–37 (2022)
Basdekis, I., et al.: Pseudonymisation in the context of GDPR-compliant medical research. In: International Conference on the Design of Reliable Communication Networks (DRCN), pp. 1–6. IEEE (2023)
Besik, S.I., Freytag, J.C.: A formal approach to build privacy-awareness into clinical workflows. SICS Softw. Intensive Cyber-Phys. Syst. 35, 141–152 (2020)
Biehl, M.: RESTful Api Design, vol. 3. API-University Press (2016)
Bincoletto, G., et al.: Data protection by design in the E-health care sector: theoretical and applied perspectives, vol. 22. Nomos Verlagsgesellschaft (2021)
Bollinger, D., Kubicek, K., Cotrini, C., Basin, D.: Automating cookie consent and GDPR violation detection. In: USENIX Security Symposium, pp. 2893–2910 (2022)
Budin-Ljøsne, I., et al.: Dynamic consent: a potential solution to some of the challenges of modern biomedical research. BMC Med. Ethics 18, 1–10 (2017)
Carrera-Rivera, A., Ochoa, W., Larrinaga, F., Lasa, G.: How-to conduct a systematic literature review: a quick guide for computer science research. MethodsX 9, 101895 (2022)
de Chaves, S.A., Barreto Vavassori Benitti, F.: Privacy by design in software engineering: An update of a systematic mapping study. In: ACM/SIGAPP Symposium on Applied Computing (SAC), pp. 1362–1369 (2023)
Chhetri, T.R., Kurteva, A., DeLong, R.J., Hilscher, R., Korte, K., Fensel, A.: Data protection by design tool for automated GDPR compliance verification based on semantically modeled informed consent. Sensors 22, 2763 (2022)
Colombo, P., Ferrari, E.: Enhancing MongoDB with purpose-based access control. IEEE Trans. Dependable Secure Comput. 14, 591–604 (2017)
Diaz, R.A.C., Ghita, M., Copot, D., Birs, I.R., Muresan, C., Ionescu, C.: Context aware control systems: an engineering applications perspective. IEEE Access 8, 215550–215569 (2020)
Drev, M., Delak, B.: Conceptual model of privacy by design. J. Comput. Inf. Syst. 62, 888–895 (2022)
Esteves, B., RodrĂguez-Doncel, V.: Analysis of ontologies and policy languages to represent information flows in GDPR. Semant. Web 15, 709–743 (2024)
European Union: Art. 7 GDPR conditions for consent (2016). https://gdpr-info.eu/art-7-gdpr/
Faruque, M.O., Habibullah, S.M.: Privacy as a human right in the digital age: In quest of a safer protection regime in Bangladesh. ELCOP Yearbook of Human Rights, pp. 1–30 (2018)
Feroze, A., Daud, A., Amjad, T., Hayat, M.K.: Group anomaly detection: past notions, present insights, and future prospects. SN Comput. Sci. 2, 1–27 (2021)
Feuerriegel, S., Hartmann, J., Janiesch, C., Zschech, P.: Generative AI. Bus. Inf. Syst. Eng. 66, 111–126 (2024)
Regulation (EU) 2016/679 of the European Parliament and of the council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing directive 95/46/ec (general data protection regulation). Official Journal of the European Union (2018). https://eur-lex.europa.eu/eli/reg/2016/679/oj
Georgiadis, G., Poels, G.: Towards a privacy impact assessment methodology to support the requirements of the general data protection regulation in a big data analytics context: A systematic literature review. Comput. Law Secur. Rev. 44, 105640 (2022)
Georgiou, D., Lambrinoudakis, C.: Data protection impact assessment (DPIA) for cloud-based health organizations. Future Internet 13, 66 (2021)
Gharib, M., Giorgini, P., Mylopoulos, J.: Towards an ontology for privacy requirements via a systematic literature review. In: Mayr, H.C., Guizzardi, G., Ma, H., Pastor, O. (eds.) ER 2017. LNCS, vol. 10650, pp. 193–208. Springer, Cham (2017). https://doi.org/10.1007/978-3-319-69904-2_16
Gharib, M., Giorgini, P., Mylopoulos, J.: COPri vol 2 - a core ontology for privacy requirements. Data Knowl. Eng. 133, 101888 (2021)
Gharib, M., Mylopoulos, J., Giorgini, P.: COPri - a core ontology for privacy requirements engineering. In: Dalpiaz, F., Zdravkovic, J., Loucopoulos, P. (eds.) RCIS 2020. LNBIP, vol. 385, pp. 472–489. Springer, Cham (2020). https://doi.org/10.1007/978-3-030-50316-1_28
Goldsteen, A., Ezov, G., Shmelkin, R., Moffie, M., Farkash, A.: Data minimization for GDPR compliance in machine learning models. AI Ethics 2(3), 477–491 (2022)
Gong, W., Zhang, W., Bilal, M., Chen, Y., Xu, X., Wang, W.: Efficient web APIs recommendation with privacy-preservation for mobile app development in industry 4.0. IEEE Trans. Ind. Inf. 18, 6379–6387 (2022)
Guizzardi, R., Amaral, G., Guizzardi, G., Mylopoulos, J.: An ontology-based approach to engineering ethicality requirements. Softw. Syst. Model. 22, 1897–1923 (2023)
Guo, Y., et al.: A security protection technology based on multi-factor authentication. In: International Conference on Mobile Networks and Wireless Communications (ICMNWC), pp. 1–5 (2022)
Gutub, A.A.A., Khan, F.A.A.: Hybrid crypto hardware utilizing symmetric-key and public-key cryptosystems. In: International Conference on Advanced Computer Science Applications and Technologies (ACSAT), pp. 116–121 (2012)
Hartmann, S., Ma, H., Vechsamutvaree, P.: Providing ontology-based privacy-aware data access through web services and service composition. Transactions on Large-Scale Data-and Knowledge-Centered Systems, pp. 109–131 (2016)
Johnson, G., Runge, J., Seufert, E.: Privacy-centric digital advertising: implications for research. Cust. Needs Solut. 9, 49–54 (2022)
Jordan, S.: Strengths and weaknesses of notice and consent requirements under the GDPR, the CCPA/CPRA, and the FCC broadband privacy order. Cardozo Arts Ent. LJ 40, 113 (2022)
Khovratovich, D., Beltrán, M.M., Mennink, B.: Generic security of the SAFE API and its applications. In: Guo, J., Steinfeld, R. (eds.) Advances in Cryptology - ASIACRYPT 2023. ASIACRYPT 2023. LNCS, vol. 14445, pp. 301–327. Springer, Singapore (2023). https://doi.org/10.1007/978-981-99-8742-9_10
Kitchenham, B.: Procedures for performing systematic reviews. Keele, UK, Keele Univ. 33 (2004)
Koçi, R., Franch, X., Jovanovic, P., Abelló, A.: Web API evolution patterns: a usage-driven approach. J. Syst. Softw. 198, 111609 (2023)
Konow, J.: Coercion and consent. J. Inst. Theor. Econ. JITE 170, 49–74 (2014)
Kovic, Ž., et al.: Valid consent in the acute hospital setting: perspectives of patients and members of the public. Ir. J. Med. Sci. (1971-), 1–12 (2024)
Krasnashchok, K., Mustapha, M., Al Bassit, A., Skhiri, S.: Towards privacy policy conceptual modeling. In: Dobbie, G., Frank, U., Kappel, G., Liddle, S.W., Mayr, H.C. (eds.) ER 2020. LNCS, vol. 12400, pp. 429–438. Springer, Cham (2020). https://doi.org/10.1007/978-3-030-62522-1_32
Lala, S.K., Kumar, A., T., S.: Secure web development using OWASP guidelines. In: International Conference on Intelligent Computing and Control Systems (ICICCS), pp. 323–332 (2021)
Lamothe, M., Guéhéneuc, Y.G., Shang, W.: A systematic review of API evolution literature. ACM Comput. Surv. 54, 1–36 (2021)
Li, C., Palanisamy, B.: Privacy in Internet of Things: from principles to technologies. IEEE Internet Things J. 6, 488–505 (2018)
Liestyowati, D.: Public Key Cryptography. J. Phys: Conf. Ser. 1477, 052062 (2020)
Majumdar, S., et al.: ProSAS: proactive security auditing system for clouds. IEEE Trans. Dependable Secure Comput. 19, 2517–2534 (2021)
Manos, P., Konstantinos, F., George, S., Sotiris, I.: Defining IoT orchestrations with security and privacy by design: a gap analysis. IEEE Internet Things Mag. 4, 80–87 (2021)
Mohamed, A.K.Y.S., Auer, D., Hofer, D., Küng, J.: A systematic literature review of authorization and access control requirements and current state of the art for different database models. Int. J. Web Inf. Syst. 20, 1–23 (2024)
Nguyen, T.T., Backes, M., Stock, B.: Freely given consent? Studying consent notice of third-party tracking and its violations of GDPR in Android apps. In: ACM SIGSAC Conference on Computer and Communications Security (CCS), pp. 2369–2383 (2022)
Nyst, C., Falchetta, T.: The right to privacy in the digital age. J. Hum. Rights Pract. 9, 104–118 (2017)
Oh, S.R., Kim, Y.G.: Interoperable OAuth 2.0 framework. In: International Conference on Platform Technology and Service (PlatCon), pp. 1–5 (2019)
Oliveira, Í., Sales, T.P., Baratella, R., Fumagalli, M., Guizzardi, G.: An ontology of security from a risk treatment perspective. In: Ralyté, J., Chakravarthy, S., Mohania, M., Jeusfeld, M.A., Karlapalem, K. (eds.) Conceptual Modeling. ER 2022. LNCS, vol. 13607, pp. 365–379. Springer, Cham (2022). https://doi.org/10.1007/978-3-031-17995-2_26
Oath, P.: The Hippocratic oath. Am. J. Med. Genet. 58, 187–94 (1995)
Pallas, F., et al.: Towards application-layer purpose-based access control. In: Annual ACM Symposium on Applied Computing, pp. 1288–1296 (2020)
Pandita, R., Xiao, X., Zhong, H., Xie, T., Oney, S., Paradkar, A.: Inferring method specifications from natural language API descriptions. In: International Conference on Software Engineering (ICSE), pp. 815–825 (2012)
Papadogiannakis, E., Papadopoulos, P., Kourtellis, N., Markatos, E.P.: User tracking in the post-cookie era: how websites bypass GDPR consent to track users. In: Web Conference, pp. 2130–2141 (2021)
Phillips, M.: International data-sharing norms: from the OECD to the general data protection regulation (GDPR). Hum. Genet. 137, 575–582 (2018)
Pozzobon, L., Ermis, B., Lewis, P., Hooker, S.: On the challenges of using black-box APIs for toxicity evaluation in research. arXiv preprint arXiv:2304.12397 (2023)
Rajmohan, T., Nguyen, P.H., Ferry, N.: A decade of research on patterns and architectures for IoT security. Cybersecurity 5, 2 (2022)
Ramadan, Q., Strüber, D., Salnitri, M., Jürjens, J., Riediger, V., Staab, S.: A semi-automated BPMN-based framework for detecting conflicts between security, data-minimization, and fairness requirements. Softw. Syst. Model. 19, 1191–1227 (2020)
Rao, P.M., Deebak, B.D.: Security and privacy issues in smart cities/industries: technologies, applications, and challenges. J. Ambient. Intell. Humaniz. Comput. 14, 10517–10553 (2023)
Rivadeneira, J.E., Silva, J.S., Colomo-Palacios, R., Rodrigues, A., Boavida, F.: User-centric privacy preserving models for a new era of the internet of things. J. Netw. Comput. Appl. 217, 103695 (2023)
Sadi, M.H., Yu, E.: RAPID: a knowledge-based assistant for designing web APIs. Requirements Eng. 26, 185–236 (2021)
Sadi, M.H., Yu, E.: WEBAPIK: a body of structured knowledge on designing web APIs. Requirements Eng. 28, 441–479 (2023)
Samariya, D., Thakkar, A.: A comprehensive survey of anomaly detection algorithms. Ann. Data Sci. 10, 829–850 (2023)
Sánchez, D., Viejo, A., Batet, M.: Automatic assessment of privacy policies under the GDPR. Appl. Sci. 11, 1762 (2021)
Saxena, U.R., Alam, T.: Provisioning trust-oriented role-based access control for maintaining data integrity in cloud. Int. J. Syst. Assur. Eng. Manag. 14, 2559–2578 (2023)
Serbout, S., El Malki, A., Pautasso, C., Zdun, U.: API rate limit adoption - a pattern collection. In: European Conference on Pattern Languages of Programs, pp. 1–20 (2023)
Sinha, G.A.: A real-property model of privacy. DePaul L. Rev. 68, 567 (2018)
Storey, V.C., Lukyanenko, R., Castellanos, A.: Conceptual modeling: topics, themes, and technology trends. ACM Comput. Surv. 55, 1–38 (2023)
Sun, P., Shen, S., Wan, Y., Wu, Z., Fang, Z., Gao, X.z.: A survey of IoT privacy security: architecture, technology, challenges, and trends. IEEE Internet Things J. 1–1 (2024). https://doi.org/10.1109/JIOT.2024.3372518
Suphakul, T., Senivongse, T.: Development of privacy design patterns based on privacy principles and UML. In: IEEE/ACIS International Conference on Software Engineering, Artificial Intelligence, Networking and Parallel/Distributed Computing (SNPD), pp. 369–375. IEEE (2017)
Truong, N.B., Sun, K., Lee, G.M., Guo, Y.: GDPR-compliant personal data management: a blockchain-based solution. IEEE Trans. Inf. Forensics Secur. 15, 1746–1761 (2019)
Unabhängiges Landeszentrum für Datenschutz: The standard data protection model - a method for data protection advising and controlling on the basis of uniform protection goals. Unabhängiges Landeszentrum für Datenschutz: Kiel, Germany (2019)
Voigt, P., von dem Bussche, A.: The EU General Data Protection Regulation (GDPR). Springer, Cham (2017). https://doi.org/10.1007/978-3-319-57959-7
Von Grafenstein, M., Jakobi, T., Stevens, G.: Effective data protection by design through interdisciplinary research methods: the example of effective purpose specification by applying user-centred UX-design methods. Comput. Law Secur. Rev. 46, 105722 (2022)
Weiss, J.B.: Data processing agreements: coordination, drafting & negotiation. In: International Association of Privacy Professionals (IAPP) (2019)
Weng, J.H., Chi, P.W.: Multi-level privacy preserving k-anonymity. In: Asia Joint Conference on Information Security (AsiaJCIS), pp. 61–67 (2021)
Wolford, B.: What is GDPR, the EU’s new data protection law? GDPR EU (2018). https://gdpr.eu/what-is-gdpr/
Wulf, A.J., Seizov, O.: Please understand we cannot provide further information: evaluating content and transparency of GDPR-mandated AI disclosures. AI Soc. 39, 235–256 (2024)
Yasmin, J., Tian, Y., Yang, J.: A first look at the deprecation of RESTful APIs: an empirical study. In: IEEE International Conference on Software Maintenance and Evolution (ICSME), pp. 151–161. IEEE (2020)
Zeng, M.L., Qin, J.: Metadata. Facet Publishing (2020)
Zhang, Q.: An overview and analysis of hybrid encryption: the combination of symmetric encryption and asymmetric encryption. In: International Conference on Computing and Data Science (CDS), pp. 616–622. IEEE (2021)
Zhang, R., Liu, G., Kang, H., Wang, Q., Wan, B., Luo, N.: Anonymity in attribute-based access control: framework and metric. IEEE Trans. Dependable Secure Comput. 21, 463–475 (2023)
Zhou, C., Barati, M., Shafiq, O.: A compliance-based architecture for supporting GDPR accountability in cloud computing. Futur. Gener. Comput. Syst. 145, 104–120 (2023)
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2025 The Author(s), under exclusive license to Springer Nature Switzerland AG
About this paper
Cite this paper
Rezayat, S., Burmester, G., Ma, H., Hartmann, S. (2025). Conceptual Framework for Designing Hippocratic APIs. In: Maass, W., Han, H., Yasar, H., Multari, N. (eds) Conceptual Modeling. ER 2024. Lecture Notes in Computer Science, vol 15238. Springer, Cham. https://doi.org/10.1007/978-3-031-75872-0_19
Download citation
DOI: https://doi.org/10.1007/978-3-031-75872-0_19
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-031-75871-3
Online ISBN: 978-3-031-75872-0
eBook Packages: Computer ScienceComputer Science (R0)