Privacy and trust policies within SOA

Abstract

Privacy for Service-Oriented Architecture (SOA) is required to gain the trust of those who would use the technology. Through the use of an independent Privacy Service (PS), the privacy policies of a service consumer and provider can be compared to create an agreed upon privacy contract. In this paper we further define a metamodel for privacy policy creation and comparison. A trust element is developed as an additional criterion for a privacy policy. We define the PS and what operations it must perform to accomplish its goals. We believe this PS combined with the presented metamodel provide a strong solution to providing privacy for SOA.

Trust-based Service-Oriented Architecture

“…The term 'sid' refers to the service's ID number. We assume that the security and privacy SSTM ratings are obtained from security and privacy rating systems (El Yamany et al, 2010;Allison et al, 2009;Anisetti et al, 2012) and, for simplicity, use a two-scale rating of either 1 or 10, i.e, T SSTMsec ¼ 1 or T SSTMsec ¼ 10.…”

“…The certification and rating process for security and privacy is beyond the scope of this paper. However, security and privacy can be certified as detailed in (Anisetti et al, 2012;Anisetti et al, 2013;Katopodis et al, 2014;Kaluvuri et al, 2013;Cimato et al, 2013) or their ratings can be obtained from security and priTrust-based Service-Oriented Architecture vacy rating systems (Mayer, 1990;El Yamany, 2009;Allison et al, 2009;Diego, 2011). For example (Anisetti et al, 2012), security certification provides a security-enhanced service discovery and selection approach and enhances requestors' security requirements.…”

Service-Oriented Digital Identity-Related Privacy Interoperability: Implementation Framework of Privacy-as-a-Set-of-Services (PaaSS)

“…This is due to the tightly-coupled nature of DigIdeRP requirements. Metamodel for privacy policies within SOA of [21][22][23] in which researchers have made a decomposition of privacy policies, and it is inspiring us to conduct future research to explore whether the service identification starts from requirements disassembling rather than from service design.…”