Privacy promises that can be kept: a policy analysis method with application to the HIPAA privacy rule
Privacy promises that can be kept: a policy analysis method with application to the HIPAA privacy rule
复制标题
可兑现的隐私承诺：适用于 HIPAA 隐私规则的策略分析方法
DOI：
--
复制
发表时间：
2013
期刊：
影响因子：
--
通讯作者：
W. Winsborough
中科院分区：
文献类型：
--
作者：
Omar Chowdhury;Andreas Gampe;Jianwei Niu;J. Ronne;Jared Bennatt;Anupam Datta;Limin Jia;W. Winsborough
组织从个人收集个人信息以履行其业务职能。联邦隐私法规，如《健康保险流通与责任法案》（HIPAA），规定了组织如何共享所收集的信息。因此，组织有责任采取手段来检查对适用法规的遵守情况。Barth等人先前的工作引入了两种合规性概念，弱合规性（WC）和强合规性（SC）。WC确保能够满足政策的当前要求，而SC还确保能够履行义务。如果一个行为既是弱合规的又是强合规的，那么它就符合隐私政策。然而，他们对合规性的定义仅限于命题线性时态逻辑（pLTL），无法合理地规定HIPAA。为此，我们提出一种基于一阶时态逻辑（FOTL）受限子集的政策规范语言，它能够捕捉HIPAA的隐私要求。然后，我们针对我们这种形式的政策正式规定WC和SC。我们证明检查WC是可行的，而检查SC是不可判定的。然后我们正式规定WC蕴含SC这一属性，用Δ表示，它要求每个弱合规的行为也是强合规的。要检查一个行为是否符合这样的政策，只需检查该行为是否对该政策是弱合规的就足够了。我们还证明当一个政策℘具有Δ属性时，该政策的当前要求可简化为℘所施加的安全要求。然后我们开发一种合理的、半自动化的技术来检查实际政策是否具有Δ属性。最后我们以HIPAA作为案例研究来展示我们的政策分析技术的有效性。
Organizations collect personal information from individuals to carry out their business functions. Federal privacy regulations, such as the Health Insurance Portability and Accountability Act (HIPAA), mandate how this collected information can be shared by the organizations. It is thus incumbent upon the organizations to have means to check compliance with the applicable regulations. Prior work by Barth et. al. introduces two notions of compliance, weak compliance (WC) and strong compliance (SC). WC ensures that present requirements of the policy can be met whereas SC also ensures obligations can be met. An action is compliant with a privacy policy if it is both weakly and strongly compliant. However, their definitions of compliance are restricted to only propositional linear temporal logic (pLTL), which cannot feasibly specify HIPAA. To this end, we present a policy specification language based on a restricted subset of first order temporal logic (FOTL) which can capture the privacy requirements of HIPAA. We then formally specify WC and SC for policies of our form. We prove that checking WC is feasible whereas checking SC is undecidable. We then formally specify the property WC entails SC, denoted by Δ, which requires that each weakly compliant action is also strongly compliant. To check whether an action is compliant with such a policy, it is sufficient to only check whether the action is weakly compliant with that policy. We also prove that when a policy ℘ has the Δ-property, the present requirements of the policy reduce to the safety requirements imposed by ℘. We then develop a sound, semi-automated technique for checking whether practical policies have the Δ-property. We finally use HIPAA as a case study to demonstrate the efficacy of our policy analysis technique.
基于历史的访问控制和信誉系统的逻辑框架
影响因子：
1.2
作者：
Krukow K
通讯作者：
Krukow K