Skip to main content
SpringerLink
Log in

Type Checking Purpose-Based Privacy Policies in the \(\pi \)-Calculus

  • Conference paper
  • First Online:
Web Services, Formal Methods, and Behavioral Types (WS-FM 2014, WS-FM 2015)

Part of the book series: Lecture Notes in Computer Science ((LNPSE,volume 9421))

Abstract

In this paper we propose a formal framework for studying privacy preserving policies based on the notion of purpose. Our framework employs the \(\pi \)-calculus with groups accompanied by a type system for capturing privacy requirements. It also incorporates a privacy policy language which captures how different entities within a system, which are distinguished by their roles, may access sensitive information and the purposes for which they are allowed to process the data. We show that a system respects a policy if the typing of the system is compatible with the policy. We illustrate our methodology via analysis of privacy-aware services of a health-care system.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution
Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 34.99
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 44.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

References

  1. Vanderbilt University Medical Center, My Health at Vanderbilt (2015). http://www.vanderbilthealth.com/main/guide

  2. Accorsi, R., Lehmann, A., Lohmann, N.: Information leak detection in business process models: theory, application, and tool support. Inf. Syst. 47, 244–257 (2015)

    Article  Google Scholar 

  3. Agrawal, R., Kiernan, J., Srikant, R., Xu, Y.: Hippocratic databases. In: Proceedings of VLDB 2002, pp. 143–154. Morgan Kaufmann (2002)

    Google Scholar 

  4. Backes, M., Pfitzmann, B., Schunter, M.: A toolkit for managing enterprise privacy policies. In: Snekkenes, E., Gollmann, D. (eds.) ESORICS 2003. LNCS, vol. 2808, pp. 162–180. Springer, Heidelberg (2003)

    Chapter  Google Scholar 

  5. Barth, A., Datta, A., Mitchell, J.C., Nissenbaum, H.: Privacy, contextual integrity: framework and applications. In: Proceedings of S&P 2006, pp. 184–198 (2006)

    Google Scholar 

  6. Basin, D., Klaedtke, F., Müller, S.: Policy monitoring in first-order temporal logic. In: Touili, T., Cook, B., Jackson, P. (eds.) CAV 2010. LNCS, vol. 6174, pp. 1–18. Springer, Heidelberg (2010)

    Chapter  Google Scholar 

  7. Braghin, C., Gorla, D., Sassone, V.: Role-based access control for a distributed calculus. J. Comput. Secur. 14(2), 113–155 (2006)

    Google Scholar 

  8. Bugliesi, M., Colazzo, D., Crafa, S., Macedonio, D.: A type system for discretionary access control. Math. Struct. Comput. Sci. 19(4), 839–875 (2009)

    Article  MathSciNet  MATH  Google Scholar 

  9. Byun, J., Bertino, E., Li, N.: Purpose based access control of complex data for privacy protection. In: Proceedings of SACMAT 2005, pp. 102–110. ACM (2005)

    Google Scholar 

  10. Capecchi, S., Castellani, I., Dezani-Ciancaglini, M.: Typing access control and secure information flow in sessions. Inf. Comput. 238, 68–105 (2014)

    Article  MathSciNet  MATH  Google Scholar 

  11. Cardelli, L., Ghelli, G., Gordon, A.D.: Secrecy and group creation. Inf. Comput. 196(2), 127–155 (2005)

    Article  MathSciNet  MATH  Google Scholar 

  12. Chowdhury, O., Gampe, A., Niu, J., von Ronne, J., Bennatt, J., Datta, A., Jia, L., Winsborough, W.H.: Privacy promises that can be kept: a policy analysis method with application to the HIPAA privacy rule. In: Proceedings of SACMAT 2013, pp. 3–14. ACM (2013)

    Google Scholar 

  13. Colombo, P., Ferrari, E.: Enforcement of purpose based access control within relational database management systems. IEEE Trans. Knowl. Data Eng. 26(11), 2703–2716 (2014)

    Article  Google Scholar 

  14. Compagnoni, A.B., Gunter, E.L., Bidinger, P.: Role-based access control for boxed ambients. Theor. Comput. Sci. 398(1–3), 203–216 (2008)

    Article  MathSciNet  MATH  Google Scholar 

  15. Cranor, L.F.: Web privacy with P3P- The Platform for Privacy Preferences. O’Reilly, Sebastopol (2002)

    Google Scholar 

  16. Datta, A., Blocki, J., Christin, N., DeYoung, H., Garg, D., Jia, L., Kaynar, D., Sinha, A.: Understanding and protecting privacy: formal semantics and principled audit mechanisms. In: Jajodia, S., Mazumdar, C. (eds.) ICISS 2011. LNCS, vol. 7093, pp. 1–27. Springer, Heidelberg (2011)

    Chapter  Google Scholar 

  17. DeYoung, H., Garg, D., Jia, L., Kaynar, D.K., Datta, A.: Experiences in the logical specification of the HIPAA and GLBA privacy laws. In: Proceedings of WPES 2010, pp. 73–82. ACM (2010)

    Google Scholar 

  18. Dezani-Ciancaglini, M., Ghilezan, S., Jakšić, S., Pantović, J.: Types for Role-based access control of dynamic web data. In: Mariño, J. (ed.) WFLP 2010. LNCS, vol. 6559, pp. 1–29. Springer, Heidelberg (2011)

    Chapter  Google Scholar 

  19. Garg, D., Jia, L., Datta, A.: Policy auditing over incomplete logs: theory, implementation and applications. In: Proceedings of CCS 2011, pp. 151–162. ACM (2011)

    Google Scholar 

  20. Hennessy, M., Rathke, J., Yoshida, N.: Safedpi: a language for controlling mobile code. Acta Informatica 42(4–5), 227–290 (2005)

    Article  MathSciNet  MATH  Google Scholar 

  21. Hennessy, M., Riely, J.: Resource access control in systems of mobile agents. Inf. Comput. 173(1), 82–120 (2002)

    Article  MathSciNet  MATH  Google Scholar 

  22. Koleini, M., Ritter, E., Ryan, M.: Model checking agent knowledge in dynamic access control policies. In: Piterman, N., Smolka, S.A. (eds.) TACAS 2013 (ETAPS 2013). LNCS, vol. 7795, pp. 448–462. Springer, Heidelberg (2013)

    Chapter  Google Scholar 

  23. Kouzapas, D., Philippou, A.: Type checking privacy policies in the \(\pi \)-calculus. In: Graf, S., Viswanathan, M. (eds.) Formal Techniques for Distributed Objects, Components, and Systems. LNCS, vol. 9039, pp. 181–195. Springer, Heidelberg (2015)

    Chapter  Google Scholar 

  24. Lapadula, A., Pugliese, R., Tiezzi, F.: Regulating data exchange in service oriented applications. In: Arbab, F., Sirjani, M. (eds.) FSEN 2007. LNCS, vol. 4767, pp. 223–239. Springer, Heidelberg (2007)

    Chapter  Google Scholar 

  25. Liu, Y., Müller, S., Xu, K.: A static compliance-checking framework for business process models. IBM Syst. J. 46(2), 335–362 (2007)

    Article  Google Scholar 

  26. May, M.J., Gunter, C.A., Lee, I.: Privacy APIs: Access control techniques to analyze and verify legal privacy policies. In: Proceedings of CSFW 2006, pp. 85–97 (2006)

    Google Scholar 

  27. Ni, Q., Bertino, E., Lobo, J.: An obligation model bridging access control policies and privacy policies. In: Proceedings of SACMAT 2008, pp. 133–142. ACM (2008)

    Google Scholar 

  28. Nissenbaum, H.: Privacy in Context: Technology, Policy and the Integrity of Social Life. Stanford University Press, Palo Alto (2010)

    Google Scholar 

  29. Sokolsky, O., Sammapun, U., Lee, I., Kim, J.: Run-time checking of dynamic properties. Electron. Notes Theor. Comput. Sci. 144(4), 91–108 (2006)

    Article  Google Scholar 

  30. Tschantz, M.C., Datta, A., Wing, J.M.: Formalizing and enforcing purpose restrictions in privacy policies. In: Proceedings of SP 2012, pp. 176–190. IEEE Computer Society (2012)

    Google Scholar 

  31. Tschantz, M.C., Wing, J.M.: Formal Methods for Privacy. In: Cavalcanti, A., Dams, D.R. (eds.) FM 2009. LNCS, vol. 5850, pp. 1–15. Springer, Heidelberg (2009)

    Chapter  Google Scholar 

  32. Yang, N., Barringer, H., Zhang, N.: A purpose-based access control model. In: Proceedings of IAS 2007, pp. 143–148. IEEE Computer Society (2007)

    Google Scholar 

Download references

Author information

Authors and Affiliations

  1. Department of Computer Science, University of Cyprus, Nicosia, Cyprus

    Eleni Kokkinofta & Anna Philippou

Authors
  1. Eleni Kokkinofta
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Anna Philippou
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Anna Philippou .

Editor information

Editors and Affiliations

  1. IT University of Copenhagen, Copenhagen, Denmark

    Thomas Hildebrandt

  2. Universidade NOVA de Lisboa, Caparica, Portugal

    António Ravara

  3. Universiteit Utrecht, Utrecht, The Netherlands

    Jan Martijn van der Werf

  4. Humboldt-Universität zu Berlin, Berlin, Germany

    Matthias Weidlich

Rights and permissions

Reprints and permissions

Copyright information

© 2016 Springer International Publishing Switzerland

About this paper

Cite this paper

Kokkinofta, E., Philippou, A. (2016). Type Checking Purpose-Based Privacy Policies in the \(\pi \)-Calculus. In: Hildebrandt, T., Ravara, A., van der Werf, J., Weidlich, M. (eds) Web Services, Formal Methods, and Behavioral Types. WS-FM WS-FM 2014 2015. Lecture Notes in Computer Science(), vol 9421. Springer, Cham. https://doi.org/10.1007/978-3-319-33612-1_8

Download citation

  • DOI: https://doi.org/10.1007/978-3-319-33612-1_8

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-319-33611-4

  • Online ISBN: 978-3-319-33612-1

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics

Search

Navigation