Conformance Verification of Privacy Policies

Conformance Verification of Privacy Policies Xiang Fu Assistant ProfessorDepartment of Computer ScienceHofstra University

Outline • Motivation • PV Framework • Privacy Properties in Temporal Logic • Verification using Alloy • Conclusion

Introduction

Web App: Consumer and Producerof INFORMATION Online Marketing Web App Email Identity Collection SSN SSN Credit Card Medical Record Address Shopping Preference Shopping Habits Business Partners

Privacy Verification Problem Your SSN never be forwarded CC destroyed after transaction Web App Function as PROMISED?

Challenges Servlets Servlets P3P Privacy Policy DB Ops Business Procedures Model Checker

PV Framework • Privacy Verification Framework 1. Servlet Control/Data Flow 2. Information Flow 3. Data Operations

Data Model • Entity • Data Item Operator CC Card Servlet SSN Database Med Record Atomic Real-Being Business Organization Transaction ID Countable Set Stakeholder Name Primitive Type System Flattened Model

Example: Bookstore App Entities

Example: Bookstore App Data Types

Actions At any moment for any e and d, Know(e,d) is defined • Know(e, d) entity Action: transition system expressed using first order on Know predicates data

Example: Charge Credit Card Free var, input variable All data All entities

Modeling Privacy Policy • Typical Examples: P3P and EPAL • Defines: • (1) What to protect? • (2) Who can receive it? • (3) How long?

P3P Example

Temporal Logic for P3P • CTL-FO = CTL + First Order Quantifiers Credit Card Info Regularly Purged from DB & is not leaked for any credit card for any entities

Verification • (1) Translate from PV to Alloy • (2) Translate CTL-FO to Alloy Predicates • (3) Verification using Alloy

Modeling World Schema module bookstore //1. world schema abstract sig Object {} abstract sig WA, Env, Data extends Object {} abstract sig Actions, Entities extends WA {} … Set of All Data Items Web App. Servlets

Modeling System State • Model the transition relation sig State{ know: (WA + Env) -> Data, prev: one State, actstate: Actions -> actionStatus }{ all x: Actions | some status: actionStatus | x -> status in actstate }

Modeling Action predpChargeCC[s,s’: State, d:CC]{ ChargeCC->READY in s.actstate and ( s’.know = s.know + {DB->d} + {Bank->d} && s’.prev=s && s’.actstate = s.actstate - .. ) }

Modeling CTL-FO Formula predef[s:State, d:Data]{ some s’: State | (CEO->d in s’.know) && s in s’.*prev } predfa[s:State]{ all d: Data | (DB->d in s.know) => ef[s,d] } assert AGProperty{ all s: State | fa[s] }

Initial Experiments 20 Objects

Conclusion • PV Framework for Reasoning about Privacy • Verification Paradigm using Alloy • Problems …

Future Directions • (1) Static Program Analysis • Path Transducer Model (Servlet) •  Information Flow (Business Rules, Access Right Policies) • (2) Customized Relational Constraint Solvers

Conformance Verification of Privacy Policies