Automatically Proving Purpose Limitation in Software Architectures - Inria - Institut national de recherche en sciences et technologies du numérique Accéder directement au contenu
Communication Dans Un Congrès Année : 2019

Automatically Proving Purpose Limitation in Software Architectures

Résumé

The principle of purpose limitation is one of the corner stones in the European General Data Protection Regulation. Automatically verifying whether a software architecture is capable of collecting, storing, or otherwise processing data without a predefined, precise, and valid purpose, and more importantly, whether the software architecture allows for re-purposing the data, greatly helps designers, makers, auditors, and customers of software. In our case study, we model the architecture of an existing medical register that follows a rigid Privacy by Design approach and assess its capability to process data only for the defined purposes. We demonstrate the process by verifying one instance that satisfies purpose limitation and two that are at least critical cases. We detect a violation scenario where data belonging to a purpose-specific consent are passed on for a different and maybe even incompatible purpose.
Fichier principal
Vignette du fichier
485650_1_En_24_Chapter.pdf (548.35 Ko) Télécharger le fichier
Origine : Fichiers produits par l'(les) auteur(s)

Dates et versions

hal-03744307 , version 1 (02-08-2022)

Licence

Paternité

Identifiants

Citer

Kai Bavendiek, Tobias Mueller, Florian Wittner, Thea Schwaneberg, Christian-Alexander Behrendt, et al.. Automatically Proving Purpose Limitation in Software Architectures. 34th IFIP International Conference on ICT Systems Security and Privacy Protection (SEC), Jun 2019, Lisbon, Portugal. pp.345-358, ⟨10.1007/978-3-030-22312-0_24⟩. ⟨hal-03744307⟩
15 Consultations
50 Téléchargements

Altmetric

Partager

Gmail Facebook X LinkedIn More