Privacy and Utility in Business Processes

Abstract

We propose an abstract model of business processes for the purpose of (i) evaluating privacy policy in light of the goals of the process and (ii) developing automated support for privacy policy compliance and audit. In our model, agents that send and receive tagged personal information are assigned organizational roles and responsibilities. We present approaches and algorithms for determining whether a business process design simultaneously achieves privacy and the goals of the organization (utility). The model also allows us to develop a notion of minimal exposure of personal information, for a given process. We investigate the problem of auditing with inexact information and develop methods to identify a set of potentially culpable individuals when privacy is breached. The audit methods draw on traditional causality concepts to reduce the effort needed to search audit logs for irresponsible actions.

Purpose Restrictions on Information Use

“…This differs from purpose restrictions, which do not require the amount of information used to be minimal and often involve purposes that are never fully achieved (e.g., more marketing is always possible). Thus, unlike works on minimal disclosure [28,29], we model purposes as being satisfied to varying degrees. Furthermore, we model probabilistic failures of the agent's plan, which allows us to identify when information use is for a purpose despite not increasing the purpose's satisfaction.…”

Static Provenance Verification for Message Passing Programs

“…We motivate our results by modeling a simple online health system described in [2], which allows patients to interact with their doctors and other healthcare professionals using a web-based message passing system. In the system, users have different roles, such as Patient, Secretary, and Doctor.…”

“…The example MyHealth Portal is described in [2]. We checked if the provenance of a variable is always in the regular language Patient (Secretary + ε) Nurse Doctor + + ε.…”

Fine-Grained Access Control with Object-Sensitive Roles

“…For example, Abdallah and Khayat [1] provide a set-theoretic semantics in a formal specification language, and Barth et al [4] briefly mentions a parameterized role extension to a temporal logic for reasoning about privacy. We adapt a variant of these generalized RBAC models to an object-oriented language, provide a static type system for enforcing access control, and have implemented and validated the approach in Java.…”

“…The emphasis in some prior work [1,15,4] is on clarifying the formal semantics of a parameterized access control model. For example, Abdallah and Khayat [1] provide a set-theoretic semantics in a formal specification language, and Barth et al [4] briefly mentions a parameterized role extension to a temporal logic for reasoning about privacy.…”