Symbolic Privacy Analysis through Linkability and Detectability

Abstract

Abstract. More and more personal information is exchanged on-line using communication protocols. This makes it increasingly important that such protocols satisfy privacy by data minimisation. Formal methods have been used to verify privacy properties of protocols; but so far, mostly in an ad-hoc way. In previous work, we provided general definitions for the fundamental privacy concepts of linkability and detectability. However, this approach is only able to verify privacy properties for given protocol instances. In this work, by generalising the approach, we formally analyse privacy of communication protocols independently from any instance. We implement the model; identify its assumptions by relating it to the instantiated model; and show how to visualise results. To demonstrate our approach, we analyse privacy in Identity Mixer.

Data Minimisation in Communication Protocols: A Formal Analysis Framework and Application to Identity Management

“…Since the conclusions of an analysis depend on the scenario, it should be chosen carefully to capture all relevant privacy aspects. We refer to [98] for a symbolic extension of our framework which is independent from a particular scenario.…”

“…For instance, to analyse privacy in application domains where the number and timing of transactions is relevant, the model can be extended to take these aspects into account. Other relevant extensions include pieces of information that refer to multiple data subjects (see [98]); or more flexible reasoning about attribute properties. Second, the model of cryptographic primitives can be made more general.…”

“…We are exploring how these limitations can be overcome by modelling cryptographic primitives using an equational theory. Finally, our model depends on the choice of a particular scenario in which requirements are verified; we refer to [98] for a generalisation of our model that is independent from a particular scenario.…”