An Integrated Knowledge Graph to Automate GDPR and PCI DSS Compliance
An Integrated Knowledge Graph to Automate GDPR and PCI DSS Compliance
复制标题
用于自动化 GDPR 和 PCI DSS 合规性的集成知识图
DOI：
10.1109/bigdata.2018.8622236
复制
发表时间：
2018
期刊：
影响因子：
--
通讯作者：
K. Joshi
中科院分区：
文献类型：
--
作者：
Lavanya Elluri;Ankur Nagar;K. Joshi
与消费者行为、市场分析、意见和推荐相关的大数据分析通常处理最终用户的派生和推断数据以及观察到的数据。为了确保消费者数据保护，每个使用个人身份信息(PII)数据进行大数据分析的组织都必须遵守欧盟一般数据保护条例(EU GDPR)定义的规则。同样，支付卡行业数据安全标准(PCIDSS)有专门针对处理消费者支付卡数据的组织的政策指南。这两项数据监管政策目前仅以文本格式提供，需要大量人工努力才能确保其遵守。我们已经开发了一个集成的、语义丰富的知识图(或本体)来表示由PCIDSS和EU GDPR授权的规则。在本体论中，我们还确定了这些法规中定义的义务，并将其与相应的云安全联盟(CSA)控制相关联。我们已经根据处理大数据的主要供应商的数据政策验证了此知识图谱。大数据从业者可以使用公共领域提供的这一知识图谱来自动化其组织中的数据保护合规性。
Big data analytics related to consumer behavior, market analysis, opinions, and recommendation often deal with end user's derived and inferred data, along with the observed data. To ensure consumer data protection, rules defined by the European Union’s General Data Protection Regulation (EU GDPR) must be adhered to by every organization using Personally Identifiable Information (PII) data for Big Data analysis. Similarly, Payment Card Industry Data Security Standard (PCI DSS) has policy guidelines specifically for organizations handling consumer’s payment card data. Both data regulation policies are currently available only in textual format and require significant manual effort to ensure their compliance. We have developed an integrated, semantically rich Knowledge Graph (or Ontology) to represent the rules mandated by both PCI DSS and EU GDPR. In the Ontology, we have also identified the obligations defined in these regulations and related them with corresponding Cloud Security Alliance (CSA) controls. We have validated this Knowledge Graph against the data policies of major vendors that deal with Big Data. This Knowledge Graph that is available in the public domain can be used by Big Data practitioners to automate data protection compliance in their organization.