Towards Modelling Obligations in Event-B

et al. 2014

Int. J. Inf. Secur.

Web interactions usually require the exchange of personal and confidential information for a variety of purposes, including enabling business transactions and the provisioning of services. A key issue affecting these interactions is the lack of trust and control on how data are going to be used and processed by the entities that receive it. In the traditional world, this problem is addressed using contractual agreements, those are signed by the involved parties, and law enforcement. This could be done electronically as well but, in addition to the trust issue, there is currently a major gap between the definition of legal contracts regulating the sharing of data, and the software infrastructure required to support and enforce them. How to enable organisations to provide more automation in this process? How to ensure that legal contracts can be actually enforced by the underlying IT infrastructure? How to enable end-users to express their preferences and constraints within these contracts? This article describes our R&D work to make progress towards addressing this gap via the usage of electronic Data Sharing Agreements (e-DSA). The aim is to share our vision, discuss the involved challenges and stimulate further research and development in this space. We specifically focus on a cloud scenario because it provides a rich set of use cases involving M. Casassa-Mont interactions and information sharing among multiple stakeholders, including users and service providers.

Section: Related Workmentioning

confidence: 99%

Towards safer information sharing in the cloud

Casassa-Mont

Matteucci

et al. 2014

Int. J. Inf. Secur.

“…Work in [17] proposes a refined conflict detection technique. In [8], it is shown that the Event-B language (www.event-b.org) can be used to model obliged events. The Rodin platform provides an animation and a model checking toolset for analyzing specifications written in Event-B, thus leading to capability of obligations analysis [4].…”

Section: Related Workmentioning

confidence: 99%

PERSONA - A Personalized Data Protection Framework

Egea

Paci

et al. 2013

Trust Management VII

Abstract. The European Directive on Data Protection recognizes the right of data subjects to control the usage of their information. However, to date there are no data protection solutions that involve data subjects in the definition and enforcement of data protection policies. In this paper we present the foundation of a novel approach to personalized data protection in which users play a central role in the authoring and enforcement of the policies governing the access and usage to their data. We discuss the challenges of designing a personalized data protection framework using personalized medicine as an illustrative scenario.

“…Also, the Rodin platform provides animation and model-checking toolset, for developing specifications based on the Event-B language (www.event-b.org). In [17], it is shown that the Event-B language can be used to model obliged events. This could be useful in the case of analysing obligations in DSA.…”

Section: Related Workmentioning

confidence: 99%

A Formal Support for Collaborative Data Sharing

Martinelli

Matteucci

Lecture Notes in Computer Science

et al. 2012

Abstract. Collaborating entities usually require the exchange of personal information for the achievement of a common goal, including enabling business transactions and the provisioning of critical services. A key issue affecting these interactions is the lack of control on how data is going to be used and processed by the entities that share it. To partially solve the issue, parties may have defined a set of data sharing policies regulating the exchange of data they own, or over which they have jurisdiction. However, distinct set of policies, defined by different authorities, may lead to conflicts once enacted, since, e.g., different subjects may have defined different permissions on the same data set. This paper focuses on policy analysis and offers a formal support for coming up with a conflict-free set of data sharing policies. We illustrate the methodology on the example of an emergency management.