Skip to main content

Conceptual Framework for Designing Hippocratic APIs

  • Conference paper
  • First Online:
Conceptual Modeling (ER 2024)

Part of the book series: Lecture Notes in Computer Science ((LNCS,volume 15238))

Included in the following conference series:

  • 414 Accesses

Abstract

The rapid proliferation of Application Programming Interfaces (APIs) enhances data exchange. Still, it introduces significant privacy and security risks, especially in the Internet of Things (IoT), where APIs often lack mechanisms to manage privacy and security, leading to vulnerabilities. Hippocratic Databases (HDBs) provide mechanisms, e.g., purpose-based access, to control database use. However, to effectively manage data access to the HDB, proper API design is crucial. This paper proposes a conceptual framework for a Hippocratic API (HAPI), revising traditional API design aiming to protect data subjects’ rights and enhance security. By embedding data protection and ethical standards into API operations, HAPIs rectify inadequacies in consent mechanisms and mitigate privacy risks. We identify non-functional requirements, design objectives, and techniques through extensive research of recent literature, informed by the ethical principles of the GDPR, ISO/IEC 27001, and HDBs. We present our findings by knowledge graphs, providing a comprehensive conceptual view of the relevant design knowledge.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Subscribe and save

Springer+ Basic
$34.99 /Month
  • Get 10 units per month
  • Download Article/Chapter or eBook
  • 1 Unit = 1 Article or 1 Chapter
  • Cancel anytime
Subscribe now

Buy Now

Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

Similar content being viewed by others

Notes

  1. 1.

    https://gdpr-info.eu.

  2. 2.

    https://owasp.org.

  3. 3.

    https://gdpr-info.eu/art-25-gdpr/.

References

  1. Abroshan, H.: A hybrid encryption solution to improve cloud computing security using symmetric and asymmetric cryptography algorithms. Int. J. Adv. Comput. Sci. Appl. 12, 31–37 (2021)

    Google Scholar 

  2. Adach, M., Hänninen, K., Lundqvist, K.: A combined security ontology based on the unified foundational ontology. In: IEEE International Conference on Semantic Computing (ICSC), pp. 187–194. IEEE (2022)

    Google Scholar 

  3. Agrawal, R., Kiernan, J., Srikant, R., Xu, Y.: Hippocratic databases. In: International Conference on Very Large Data Bases (VLDB), pp. 143–154. VLDB (2002)

    Google Scholar 

  4. Aljeraisy, A., Barati, M., Rana, O., Perera, C.: Privacy laws and privacy by design schemes for the internet of things: a developer’s perspective. ACM Comput. Surv. 54(5), 1–38 (2021)

    Google Scholar 

  5. Alkhariji, L., Alhirabi, N., Alraja, M.N., Barhamgi, M., Rana, O., Perera, C.: Synthesising privacy by design knowledge toward explainable internet of things application designing in healthcare. ACM Trans. Multimed. Comput. Commun. Appl. 17, 1–29 (2021)

    Article  Google Scholar 

  6. Amoo, O.O., Atadoga, A., Osasona, F., Abrahams, T.O., Ayinla, B.S., Farayola, O.A., et al.: GDPR’s impact on cybersecurity: a review focusing on USA and European practices. Int. J. Sci. Res. Arch. 11, 1338–1347 (2024)

    Article  Google Scholar 

  7. Aryavalli, S.N.G., Kumar, H.: Top 12 layer-wise security challenges and a secure architectural solution for Internet of Things. Comput. Electr. Eng. 105, 108487 (2023)

    Article  Google Scholar 

  8. Askin, S., Burkhalter, D., Calado, G., El Dakrouni, S.: Artificial intelligence applied to clinical trials: opportunities and challenges. Heal. Technol. 13, 203–213 (2023)

    Article  Google Scholar 

  9. Atlidakis, V., Godefroid, P., Polishchuk, M.: Checking security properties of cloud service REST APIs. In: IEEE International Conference on Software Testing, Validation and Verification (ICST) (2020)

    Google Scholar 

  10. Bach-Nutman, M.: Understanding the top 10 OWASP vulnerabilities. arXiv preprint arXiv:2012.09960 (2020)

  11. Badawy, M.: Security evaluation of different hashing functions with RSA for digital signature. Int. J. Comput. Inf. 10, 99–116 (2023)

    Google Scholar 

  12. Barati, M., et al.: Privacy-aware cloud auditing for GDPR compliance verification in online healthcare. IEEE Trans. Industr. Inf. 18, 4808–4819 (2021)

    Article  Google Scholar 

  13. Barth, S., Ionita, D., Hartel, P.: Understanding online privacy - a systematic review of privacy visualizations and privacy by design guidelines. ACM Comput. Surv. 55, 1–37 (2022)

    Article  Google Scholar 

  14. Basdekis, I., et al.: Pseudonymisation in the context of GDPR-compliant medical research. In: International Conference on the Design of Reliable Communication Networks (DRCN), pp. 1–6. IEEE (2023)

    Google Scholar 

  15. Besik, S.I., Freytag, J.C.: A formal approach to build privacy-awareness into clinical workflows. SICS Softw. Intensive Cyber-Phys. Syst. 35, 141–152 (2020)

    Article  Google Scholar 

  16. Biehl, M.: RESTful Api Design, vol. 3. API-University Press (2016)

    Google Scholar 

  17. Bincoletto, G., et al.: Data protection by design in the E-health care sector: theoretical and applied perspectives, vol. 22. Nomos Verlagsgesellschaft (2021)

    Google Scholar 

  18. Bollinger, D., Kubicek, K., Cotrini, C., Basin, D.: Automating cookie consent and GDPR violation detection. In: USENIX Security Symposium, pp. 2893–2910 (2022)

    Google Scholar 

  19. Budin-Ljøsne, I., et al.: Dynamic consent: a potential solution to some of the challenges of modern biomedical research. BMC Med. Ethics 18, 1–10 (2017)

    Article  Google Scholar 

  20. Carrera-Rivera, A., Ochoa, W., Larrinaga, F., Lasa, G.: How-to conduct a systematic literature review: a quick guide for computer science research. MethodsX 9, 101895 (2022)

    Article  Google Scholar 

  21. de Chaves, S.A., Barreto Vavassori Benitti, F.: Privacy by design in software engineering: An update of a systematic mapping study. In: ACM/SIGAPP Symposium on Applied Computing (SAC), pp. 1362–1369 (2023)

    Google Scholar 

  22. Chhetri, T.R., Kurteva, A., DeLong, R.J., Hilscher, R., Korte, K., Fensel, A.: Data protection by design tool for automated GDPR compliance verification based on semantically modeled informed consent. Sensors 22, 2763 (2022)

    Article  Google Scholar 

  23. Colombo, P., Ferrari, E.: Enhancing MongoDB with purpose-based access control. IEEE Trans. Dependable Secure Comput. 14, 591–604 (2017)

    Article  Google Scholar 

  24. Diaz, R.A.C., Ghita, M., Copot, D., Birs, I.R., Muresan, C., Ionescu, C.: Context aware control systems: an engineering applications perspective. IEEE Access 8, 215550–215569 (2020)

    Article  Google Scholar 

  25. Drev, M., Delak, B.: Conceptual model of privacy by design. J. Comput. Inf. Syst. 62, 888–895 (2022)

    Google Scholar 

  26. Esteves, B., Rodríguez-Doncel, V.: Analysis of ontologies and policy languages to represent information flows in GDPR. Semant. Web 15, 709–743 (2024)

    Article  Google Scholar 

  27. European Union: Art. 7 GDPR conditions for consent (2016). https://gdpr-info.eu/art-7-gdpr/

  28. Faruque, M.O., Habibullah, S.M.: Privacy as a human right in the digital age: In quest of a safer protection regime in Bangladesh. ELCOP Yearbook of Human Rights, pp. 1–30 (2018)

    Google Scholar 

  29. Feroze, A., Daud, A., Amjad, T., Hayat, M.K.: Group anomaly detection: past notions, present insights, and future prospects. SN Comput. Sci. 2, 1–27 (2021)

    Article  Google Scholar 

  30. Feuerriegel, S., Hartmann, J., Janiesch, C., Zschech, P.: Generative AI. Bus. Inf. Syst. Eng. 66, 111–126 (2024)

    Google Scholar 

  31. Regulation (EU) 2016/679 of the European Parliament and of the council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing directive 95/46/ec (general data protection regulation). Official Journal of the European Union (2018). https://eur-lex.europa.eu/eli/reg/2016/679/oj

  32. Georgiadis, G., Poels, G.: Towards a privacy impact assessment methodology to support the requirements of the general data protection regulation in a big data analytics context: A systematic literature review. Comput. Law Secur. Rev. 44, 105640 (2022)

    Article  Google Scholar 

  33. Georgiou, D., Lambrinoudakis, C.: Data protection impact assessment (DPIA) for cloud-based health organizations. Future Internet 13, 66 (2021)

    Article  Google Scholar 

  34. Gharib, M., Giorgini, P., Mylopoulos, J.: Towards an ontology for privacy requirements via a systematic literature review. In: Mayr, H.C., Guizzardi, G., Ma, H., Pastor, O. (eds.) ER 2017. LNCS, vol. 10650, pp. 193–208. Springer, Cham (2017). https://doi.org/10.1007/978-3-319-69904-2_16

    Chapter  Google Scholar 

  35. Gharib, M., Giorgini, P., Mylopoulos, J.: COPri vol 2 - a core ontology for privacy requirements. Data Knowl. Eng. 133, 101888 (2021)

    Article  Google Scholar 

  36. Gharib, M., Mylopoulos, J., Giorgini, P.: COPri - a core ontology for privacy requirements engineering. In: Dalpiaz, F., Zdravkovic, J., Loucopoulos, P. (eds.) RCIS 2020. LNBIP, vol. 385, pp. 472–489. Springer, Cham (2020). https://doi.org/10.1007/978-3-030-50316-1_28

    Chapter  Google Scholar 

  37. Goldsteen, A., Ezov, G., Shmelkin, R., Moffie, M., Farkash, A.: Data minimization for GDPR compliance in machine learning models. AI Ethics 2(3), 477–491 (2022)

    Article  Google Scholar 

  38. Gong, W., Zhang, W., Bilal, M., Chen, Y., Xu, X., Wang, W.: Efficient web APIs recommendation with privacy-preservation for mobile app development in industry 4.0. IEEE Trans. Ind. Inf. 18, 6379–6387 (2022)

    Google Scholar 

  39. Guizzardi, R., Amaral, G., Guizzardi, G., Mylopoulos, J.: An ontology-based approach to engineering ethicality requirements. Softw. Syst. Model. 22, 1897–1923 (2023)

    Article  Google Scholar 

  40. Guo, Y., et al.: A security protection technology based on multi-factor authentication. In: International Conference on Mobile Networks and Wireless Communications (ICMNWC), pp. 1–5 (2022)

    Google Scholar 

  41. Gutub, A.A.A., Khan, F.A.A.: Hybrid crypto hardware utilizing symmetric-key and public-key cryptosystems. In: International Conference on Advanced Computer Science Applications and Technologies (ACSAT), pp. 116–121 (2012)

    Google Scholar 

  42. Hartmann, S., Ma, H., Vechsamutvaree, P.: Providing ontology-based privacy-aware data access through web services and service composition. Transactions on Large-Scale Data-and Knowledge-Centered Systems, pp. 109–131 (2016)

    Google Scholar 

  43. Johnson, G., Runge, J., Seufert, E.: Privacy-centric digital advertising: implications for research. Cust. Needs Solut. 9, 49–54 (2022)

    Article  Google Scholar 

  44. Jordan, S.: Strengths and weaknesses of notice and consent requirements under the GDPR, the CCPA/CPRA, and the FCC broadband privacy order. Cardozo Arts Ent. LJ 40, 113 (2022)

    Google Scholar 

  45. Khovratovich, D., Beltrán, M.M., Mennink, B.: Generic security of the SAFE API and its applications. In: Guo, J., Steinfeld, R. (eds.) Advances in Cryptology - ASIACRYPT 2023. ASIACRYPT 2023. LNCS, vol. 14445, pp. 301–327. Springer, Singapore (2023). https://doi.org/10.1007/978-981-99-8742-9_10

  46. Kitchenham, B.: Procedures for performing systematic reviews. Keele, UK, Keele Univ. 33 (2004)

    Google Scholar 

  47. Koçi, R., Franch, X., Jovanovic, P., Abelló, A.: Web API evolution patterns: a usage-driven approach. J. Syst. Softw. 198, 111609 (2023)

    Article  Google Scholar 

  48. Konow, J.: Coercion and consent. J. Inst. Theor. Econ. JITE 170, 49–74 (2014)

    Google Scholar 

  49. Kovic, Ž., et al.: Valid consent in the acute hospital setting: perspectives of patients and members of the public. Ir. J. Med. Sci. (1971-), 1–12 (2024)

    Google Scholar 

  50. Krasnashchok, K., Mustapha, M., Al Bassit, A., Skhiri, S.: Towards privacy policy conceptual modeling. In: Dobbie, G., Frank, U., Kappel, G., Liddle, S.W., Mayr, H.C. (eds.) ER 2020. LNCS, vol. 12400, pp. 429–438. Springer, Cham (2020). https://doi.org/10.1007/978-3-030-62522-1_32

    Chapter  Google Scholar 

  51. Lala, S.K., Kumar, A., T., S.: Secure web development using OWASP guidelines. In: International Conference on Intelligent Computing and Control Systems (ICICCS), pp. 323–332 (2021)

    Google Scholar 

  52. Lamothe, M., Guéhéneuc, Y.G., Shang, W.: A systematic review of API evolution literature. ACM Comput. Surv. 54, 1–36 (2021)

    Article  Google Scholar 

  53. Li, C., Palanisamy, B.: Privacy in Internet of Things: from principles to technologies. IEEE Internet Things J. 6, 488–505 (2018)

    Article  Google Scholar 

  54. Liestyowati, D.: Public Key Cryptography. J. Phys: Conf. Ser. 1477, 052062 (2020)

    Google Scholar 

  55. Majumdar, S., et al.: ProSAS: proactive security auditing system for clouds. IEEE Trans. Dependable Secure Comput. 19, 2517–2534 (2021)

    Article  Google Scholar 

  56. Manos, P., Konstantinos, F., George, S., Sotiris, I.: Defining IoT orchestrations with security and privacy by design: a gap analysis. IEEE Internet Things Mag. 4, 80–87 (2021)

    Article  Google Scholar 

  57. Mohamed, A.K.Y.S., Auer, D., Hofer, D., Küng, J.: A systematic literature review of authorization and access control requirements and current state of the art for different database models. Int. J. Web Inf. Syst. 20, 1–23 (2024)

    Article  Google Scholar 

  58. Nguyen, T.T., Backes, M., Stock, B.: Freely given consent? Studying consent notice of third-party tracking and its violations of GDPR in Android apps. In: ACM SIGSAC Conference on Computer and Communications Security (CCS), pp. 2369–2383 (2022)

    Google Scholar 

  59. Nyst, C., Falchetta, T.: The right to privacy in the digital age. J. Hum. Rights Pract. 9, 104–118 (2017)

    Article  Google Scholar 

  60. Oh, S.R., Kim, Y.G.: Interoperable OAuth 2.0 framework. In: International Conference on Platform Technology and Service (PlatCon), pp. 1–5 (2019)

    Google Scholar 

  61. Oliveira, Í., Sales, T.P., Baratella, R., Fumagalli, M., Guizzardi, G.: An ontology of security from a risk treatment perspective. In: Ralyté, J., Chakravarthy, S., Mohania, M., Jeusfeld, M.A., Karlapalem, K. (eds.) Conceptual Modeling. ER 2022. LNCS, vol. 13607, pp. 365–379. Springer, Cham (2022). https://doi.org/10.1007/978-3-031-17995-2_26

  62. Oath, P.: The Hippocratic oath. Am. J. Med. Genet. 58, 187–94 (1995)

    Google Scholar 

  63. Pallas, F., et al.: Towards application-layer purpose-based access control. In: Annual ACM Symposium on Applied Computing, pp. 1288–1296 (2020)

    Google Scholar 

  64. Pandita, R., Xiao, X., Zhong, H., Xie, T., Oney, S., Paradkar, A.: Inferring method specifications from natural language API descriptions. In: International Conference on Software Engineering (ICSE), pp. 815–825 (2012)

    Google Scholar 

  65. Papadogiannakis, E., Papadopoulos, P., Kourtellis, N., Markatos, E.P.: User tracking in the post-cookie era: how websites bypass GDPR consent to track users. In: Web Conference, pp. 2130–2141 (2021)

    Google Scholar 

  66. Phillips, M.: International data-sharing norms: from the OECD to the general data protection regulation (GDPR). Hum. Genet. 137, 575–582 (2018)

    Article  Google Scholar 

  67. Pozzobon, L., Ermis, B., Lewis, P., Hooker, S.: On the challenges of using black-box APIs for toxicity evaluation in research. arXiv preprint arXiv:2304.12397 (2023)

  68. Rajmohan, T., Nguyen, P.H., Ferry, N.: A decade of research on patterns and architectures for IoT security. Cybersecurity 5, 2 (2022)

    Article  Google Scholar 

  69. Ramadan, Q., Strüber, D., Salnitri, M., Jürjens, J., Riediger, V., Staab, S.: A semi-automated BPMN-based framework for detecting conflicts between security, data-minimization, and fairness requirements. Softw. Syst. Model. 19, 1191–1227 (2020)

    Article  Google Scholar 

  70. Rao, P.M., Deebak, B.D.: Security and privacy issues in smart cities/industries: technologies, applications, and challenges. J. Ambient. Intell. Humaniz. Comput. 14, 10517–10553 (2023)

    Article  Google Scholar 

  71. Rivadeneira, J.E., Silva, J.S., Colomo-Palacios, R., Rodrigues, A., Boavida, F.: User-centric privacy preserving models for a new era of the internet of things. J. Netw. Comput. Appl. 217, 103695 (2023)

    Article  Google Scholar 

  72. Sadi, M.H., Yu, E.: RAPID: a knowledge-based assistant for designing web APIs. Requirements Eng. 26, 185–236 (2021)

    Article  Google Scholar 

  73. Sadi, M.H., Yu, E.: WEBAPIK: a body of structured knowledge on designing web APIs. Requirements Eng. 28, 441–479 (2023)

    Article  Google Scholar 

  74. Samariya, D., Thakkar, A.: A comprehensive survey of anomaly detection algorithms. Ann. Data Sci. 10, 829–850 (2023)

    Google Scholar 

  75. Sánchez, D., Viejo, A., Batet, M.: Automatic assessment of privacy policies under the GDPR. Appl. Sci. 11, 1762 (2021)

    Article  Google Scholar 

  76. Saxena, U.R., Alam, T.: Provisioning trust-oriented role-based access control for maintaining data integrity in cloud. Int. J. Syst. Assur. Eng. Manag. 14, 2559–2578 (2023)

    Article  Google Scholar 

  77. Serbout, S., El Malki, A., Pautasso, C., Zdun, U.: API rate limit adoption - a pattern collection. In: European Conference on Pattern Languages of Programs, pp. 1–20 (2023)

    Google Scholar 

  78. Sinha, G.A.: A real-property model of privacy. DePaul L. Rev. 68, 567 (2018)

    Google Scholar 

  79. Storey, V.C., Lukyanenko, R., Castellanos, A.: Conceptual modeling: topics, themes, and technology trends. ACM Comput. Surv. 55, 1–38 (2023)

    Article  Google Scholar 

  80. Sun, P., Shen, S., Wan, Y., Wu, Z., Fang, Z., Gao, X.z.: A survey of IoT privacy security: architecture, technology, challenges, and trends. IEEE Internet Things J. 1–1 (2024). https://doi.org/10.1109/JIOT.2024.3372518

  81. Suphakul, T., Senivongse, T.: Development of privacy design patterns based on privacy principles and UML. In: IEEE/ACIS International Conference on Software Engineering, Artificial Intelligence, Networking and Parallel/Distributed Computing (SNPD), pp. 369–375. IEEE (2017)

    Google Scholar 

  82. Truong, N.B., Sun, K., Lee, G.M., Guo, Y.: GDPR-compliant personal data management: a blockchain-based solution. IEEE Trans. Inf. Forensics Secur. 15, 1746–1761 (2019)

    Article  Google Scholar 

  83. Unabhängiges Landeszentrum für Datenschutz: The standard data protection model - a method for data protection advising and controlling on the basis of uniform protection goals. Unabhängiges Landeszentrum für Datenschutz: Kiel, Germany (2019)

    Google Scholar 

  84. Voigt, P., von dem Bussche, A.: The EU General Data Protection Regulation (GDPR). Springer, Cham (2017). https://doi.org/10.1007/978-3-319-57959-7

    Book  Google Scholar 

  85. Von Grafenstein, M., Jakobi, T., Stevens, G.: Effective data protection by design through interdisciplinary research methods: the example of effective purpose specification by applying user-centred UX-design methods. Comput. Law Secur. Rev. 46, 105722 (2022)

    Article  Google Scholar 

  86. Weiss, J.B.: Data processing agreements: coordination, drafting & negotiation. In: International Association of Privacy Professionals (IAPP) (2019)

    Google Scholar 

  87. Weng, J.H., Chi, P.W.: Multi-level privacy preserving k-anonymity. In: Asia Joint Conference on Information Security (AsiaJCIS), pp. 61–67 (2021)

    Google Scholar 

  88. Wolford, B.: What is GDPR, the EU’s new data protection law? GDPR EU (2018). https://gdpr.eu/what-is-gdpr/

  89. Wulf, A.J., Seizov, O.: Please understand we cannot provide further information: evaluating content and transparency of GDPR-mandated AI disclosures. AI Soc. 39, 235–256 (2024)

    Article  Google Scholar 

  90. Yasmin, J., Tian, Y., Yang, J.: A first look at the deprecation of RESTful APIs: an empirical study. In: IEEE International Conference on Software Maintenance and Evolution (ICSME), pp. 151–161. IEEE (2020)

    Google Scholar 

  91. Zeng, M.L., Qin, J.: Metadata. Facet Publishing (2020)

    Google Scholar 

  92. Zhang, Q.: An overview and analysis of hybrid encryption: the combination of symmetric encryption and asymmetric encryption. In: International Conference on Computing and Data Science (CDS), pp. 616–622. IEEE (2021)

    Google Scholar 

  93. Zhang, R., Liu, G., Kang, H., Wang, Q., Wan, B., Luo, N.: Anonymity in attribute-based access control: framework and metric. IEEE Trans. Dependable Secure Comput. 21, 463–475 (2023)

    Google Scholar 

  94. Zhou, C., Barati, M., Shafiq, O.: A compliance-based architecture for supporting GDPR accountability in cloud computing. Futur. Gener. Comput. Syst. 145, 104–120 (2023)

    Article  Google Scholar 

Download references

Author information

Authors and Affiliations

Authors

Corresponding author

Correspondence to Sarmad Rezayat .

Editor information

Editors and Affiliations

Rights and permissions

Reprints and permissions

Copyright information

© 2025 The Author(s), under exclusive license to Springer Nature Switzerland AG

About this paper

Check for updates. Verify currency and authenticity via CrossMark

Cite this paper

Rezayat, S., Burmester, G., Ma, H., Hartmann, S. (2025). Conceptual Framework for Designing Hippocratic APIs. In: Maass, W., Han, H., Yasar, H., Multari, N. (eds) Conceptual Modeling. ER 2024. Lecture Notes in Computer Science, vol 15238. Springer, Cham. https://doi.org/10.1007/978-3-031-75872-0_19

Download citation

  • DOI: https://doi.org/10.1007/978-3-031-75872-0_19

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-031-75871-3

  • Online ISBN: 978-3-031-75872-0

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics