A soft computing approach for privacy requirements engineering: The PriS framework

Abstract

Soft computing continuously gains interest in many fields of academic and industrial domain; among the most notable characteristics for using soft computing methodological tools is the ability to handle with vague and imprecise data in decision making processes. Similar conditions are often encountered in requirements engineering. In this paper, we introduce the PriS approach, a security and privacy requirements engineering framework which aims at incorporating privacy requirements early in the system development process. Specifically, PriS provides a set of concepts for modelling privacy requirements in the organisation domain and a systematic way-of-working for translating these requirements into system models. The conceptual model of PriS uses a goal hierarchy structure. Every privacy requirement is either applied or not on every goal. To this end every privacy requirement is a variable that can take two values [0,1] on every goal meaning that the requirements constraints the goal (value 1) or not (value 0). Following this way of working PriS ends up suggesting a number of implementation techniques based on the privacy requirements constraining the respective goals. Taking into account that the mapping of privacy variables to a crisp set consisting of two values [0,1] is constraining, we extend also the PriS framework so as to be able to address the degree of participation of every privacy requirement towards achieving the generic goal of privacy. Therefore, we propose a fuzzification of privacy variables that maps the expression of the degree of participation of each privacy variable to the [0,1] interval. We also present a mathematical framework that allows the concurrent management of combined independent preferences towards the necessity of a privacy measure; among the advantages of the presented extended framework is the scalability of the approach in such a way that the results are not limited by the number of independent opinions or by the number of factors considered while reasoning for a specific selection of privacy measures.

Introduction

Privacy as a social and legal issue, traditionally, has been the concern of social scientists, philosophers and lawyers [1]. However, the extended use of various software applications in the context of basic e-services sets additional technology-related requirements for protecting the electronic privacy of individuals.

Nowadays, protecting privacy is focused on reducing the information collected and stored to a minimum, and deleting the information as soon as it has served its purpose. Most of today's e-services are relying on stored data, identifying the customer, his preferences and previous record of transactions. However, combining such data will in many cases constitute an invasion of privacy.

Privacy-related issues are many and varied, as privacy itself is a multifaceted concept. Privacy comes in many forms, relating to what one wishes to keep private. Review of current research, highlights the path for user privacy protection in terms of eight privacy requirements namely identification, authentication, authorization, data protection, anonymity, pseudonymity, unlinkability and unobservability [2], [3], [4]. The first three requirements are mainly security requirements but they are included due to their key role in the privacy protection. By addressing these requirements one aims to minimize or eliminate the collection of user identifiable data.

Research efforts aiming to the protection of user privacy fall in two main categories: security-oriented requirement engineering methodologies and privacy enhancing technologies. The former focus on methods and techniques for considering security issues (including privacy) during the early stages of system development and the latter describe technological solutions for assuring user privacy during system implementation. The main limitation of security requirement engineering methodologies is that they do not link the identified requirements with implementation solutions. Understanding the relationship between user needs and the capabilities of the supporting software systems is of critical importance. Privacy enhancing technologies, on the other hand, focus on the software implementation alone, irrespective of the organizational context in which the system will be incorporated. This lack of knowledge makes it difficult to determine which software solution best fits the organizational needs. A review on a number of well-known privacy requirements engineering methods can be found in Ref. [5].

To this end, PriS, a new security requirements engineering methodology, has been introduced aiming to incorporate privacy requirements early in the system development process. PriS models privacy requirements in terms of business goals and uses the concept of privacy process patterns for describing the impact of privacy goals onto the business processes and the associated software systems supporting these processes.

The conceptual model of PriS uses a goal hierarchy structure. Every privacy requirement is either applied or not on every goal. The representation of a privacy requirement that constraints a goal is achieved by the use of a variable which can take two values, zero and one. If one of the privacy requirements is applied on a specific goal the respective privacy variable will be assigned with the value of one otherwise will remain zero which was also its initial value. Thus, on every privacy-related goal seven privacy variables are applied and representing which privacy requirements constraint the goal and which not (since pseudonymity can be considered as part of anonymity, they are both addressed in one pattern). Following this way of working PriS ends up suggesting a number of implementation techniques based on the privacy requirements constraining the respective goals. While PriS successfully guides the developers through the implementation phase by suggesting a number of implementation techniques it fails to address the degree of participation of every privacy requirement for achieving the generic goal of privacy.

The contributions of this paper are the following: We present the PriS conceptual framework for privacy management in requirements engineering, along with a formal representation of PriS; we extend also the presented framework using a soft computing approach that enables the expression of preferences from independent participants in the system design process and their combined management using fuzzy metrics; the presented approach has also the advantage that it is not limited by the number of factors considered while evaluating a metric nor by the number of preferences considered.

The rest of this paper is structured as follows: Section 2 describes the PriS conceptual framework and way of working. Formal PriS is presented in Section 3. Section 4 presents the fuzzy extension of PriS. Finally, Section 5 concludes with pointers to future work.