A user requirements-oriented privacy policy self-adaption scheme in cloud computing

Abstract

In an ever-changing environment, Software as a Service (SaaS) can rarely protect users’ privacy. Being able to manage and control the privacy is therefore an important goal for SaaS. Once the participant of composite service is substituted, it is unclear whether the composite service satisfy user privacy requirement or not. In this paper, we propose a privacy policies automatic update method to enhance user privacy when a service participant change in the composite service. Firstly, we model the privacy policies and service variation rules. Secondly, according to the service variation rules, the privacy policies are automatically generated through the negotiation between user and service composer. Thirdly, we prove the feasibility and applicability of our method with the experiments. When the service quantity is 50, ratio that the services variations are successfully checked by monitor is 81%. Moreover, ratio that the privacy policies are correctly updated is 93.6%.

Graphical abstract

Keywords

cloud computing / SaaS service / privacy protection / privacy policies update

Changbo Ke received his PhD degree from Nanjing University of Aeronautics and Astronautics, China in 2014. Now he is an associate professor and master supervisor in Nanjing University of Posts and Telecommunications, China. He has published more than 10 papers in related international conferences and journals, including IEEE TSC, IEEE TR, KBS, and so on. His major research interests include privacy and security in IoT. He is a member of the IEEE Computer Society

Fu Xiao received his PhD degree in computer science and technology from Nanjing University of Science and Technology, China in 2007. He is currently a professor and PhD supervisor in the School of Computer Science, Nanjing University of Posts and Telecommunications, China. He has published more than 20 papers in related international conferences and journals, including IEEE/ACM ToN, IEEE JSAC, IEEE TMC, IEEE TVT, INFOCOM, IPCCC, ICC, and so on. His main research interest include the wireless sensor networksand Internet of Things. He is a member of the IEEE Computer Society and the Association for Computing Machinery

Zhiqiu Huang received his PhD degree from Nanjing University of Aeronautics and Astronautics, China. Now he is a professor and PhD supervisor in Nanjing University of Aeronautics and Astronautics, China. He has published more than 40 papers in related international conferences and journals, including IEEE TSC, KBS, FGCS Computers & Security, IEEE TNSM, ICWS, and so on. His major research interests include formal method, software engineering, and cloud computing

Fangxiong Xiao received his PhD degree from Nanjing University of Aeronautics and Astronautics, China in 2010. Now he is a professor in Jinling Institute of Technology of China. He has published more than 10 papers in related international conferences and journals. His major research interests include software engineering and block chain

References

[1] HayesB. Cloud computing. Communications of the ACM, 2008, 51( 7): 9– 11

[2] JensenM, SchwenkJ, GruschkaN, IaconoL L. On technical security issues in cloud computing. In: Proceedings of the 2009 IEEE International Conference on Cloud Computing. 2009, 109– 116

[3] NguA H H, CarlsonM P, ShengQ Z, PaikH Y. Semantic-based mashup of composite applications. IEEE Transactions on Services Computing, 2010, 3( 1): 2– 15

[4] ZhouM, ZhangR, XieW, QianW, ZhouA. Security and privacy in cloud computing: a survey. In: Proceedings of the 6th International Conference on Semantics, Knowledge and Grids. 2010, 105– 112

[5] TakabiH, JoshiJ B D, AhnG J. Security and privacy challenges in cloud computing environments. IEEE Security & Privacy, 2010, 8( 6): 24– 31

[6] AndrikopoulosV, BenbernouS, PapazoglouM P. On the evolution of services. IEEE Transactions on Software Engineering, 2012, 38( 3): 609– 628

[7] KeC, HuangZ, ChengX. Privacy disclosure checking method applied on collaboration interactions among SaaS services. IEEE Access, 2017, 5: 15080– 15092

[8] QiJ, XuB, XueY, WangK, SunY. Knowledge based differential evolution for cloud computing service composition. Journal of Ambient Intelligence and Humanized Computing, 2018, 9( 3): 565– 574

[9] ChangS E, LiuA Y, ShenW C. User trust in social networking services: a comparison of Facebook and LinkedIn. Computers in Human Behavior, 2017, 69: 207– 217

[10] ChangV, RamachandranM. Towards achieving data security with the cloud computing adoption framework. IEEE Transactions on Services Computing, 2016, 9( 1): 138– 151

[11] PhamV V H, LiuX, ZhengX, FuM, Deshpande S V, XiaW, ZhouR, AbdelrazekM. PaaS-black or white: an investigation into software development model for building retail industry SaaS. In: Proceedings of the 39th IEEE/ACM International Conference on Software Engineering Companion (ICSE-C). 2017, 285– 287

[12] SongW, JacobsenH A, ZhangC, MaX. Dependence-based data-aware process conformance checking. IEEE Transactions on Services Computing, 2021, 14( 3): 654– 667

[13] GuzekM, BouvryP, TalbiE G. A survey of evolutionary computation for resource management of processing in cloud computing. IEEE Computational Intelligence Magazine, 2015, 10( 2): 53– 67

[14] ZhangL, LiX Y, LiuK, JungT, LiuY. Message in a sealed bottle: privacy preserving friending in mobile social networks. IEEE Transactions on Mobile Computing, 2015, 14( 9): 1888– 1902

[15] MaQ, ZhangS, ZhuT, LiuK, ZhangL, HeW, LiuY. PLP: Protecting location privacy against correlation analyze Attack in crowdsensing. IEEE Transactions on Mobile Computing, 2017, 16( 9): 2588– 2598

[16] KeC, XiaoF, HuangZ, MengY, CaoY. Ontology-based privacy data chain disclosure discovery method for big data. IEEE Transactions on Services Computing, 2022, 15( 1): 59– 68

[17] LutzC, MiličićM. A tableau algorithm for description logics with concrete domains and general tboxes. Journal of Automated Reasoning, 2007, 38( 1): 227– 259

[18] ReayI, DickS, MillerJ. A large-scale empirical study of P3P privacy policies: stated actions vs. legal obligations. ACM Transactions on the Web, 2009, 3( 2): 6

[19] HadarI, HassonT, AyalonO, TochE, BirnhackM, ShermanS, BalissaA. Privacy by designers: software developers’ privacy mindset. Empirical Software Engineering, 2018, 23( 1): 259– 289

[20] SuchJ M, RovatsosM. Privacy policy negotiation in social media. ACM Transactions on Autonomous and Adaptive Systems, 2016, 11( 1): 4

[21] LeeY, SarangiD, KwonO, KimM Y. Lattice based privacy negotiation rule generation for context-aware service. In: Proceedings of the 6th International Conference on Ubiquitous Intelligence and Computing. 2009, 340– 352

[22] KeC, HuangZ, TangM. Supporting negotiation mechanism privacy authority method in cloud computing. Knowledge-Based Systems, 2013, 51: 48– 59

[23] TbahritiS E, GhediraC, MedjahedB, MrissaM. Privacy-enhanced web service composition. IEEE Transactions on Services Computing, 2014, 7( 2): 210– 222

[24] BhatiaJ, BreauxT D. Semantic incompleteness in privacy policy goals. In: Proceedings of the 26th IEEE International Requirements Engineering Conference (RE). 2018, 159– 169

[25] YuL, ZhangT, LuoX, XueL, ChangH. Toward automatically generating privacy policy for android apps. IEEE Transactions on Information Forensics and Security, 2017, 12( 4): 865– 880

[26] ZimmeckS, BellovinS M. Privee: An architecture for automatically analyzing web privacy policies. In: Proceedings of the 23rd USENIX Security Symposium. 2014, 1– 16

[27] AntonA I, EarpJ B, HeQ, StufflebeamW, BolchiniD, JensenC. Financial privacy policies and the need for standardization. IEEE Security & Privacy, 2004, 2( 2): 36– 45

[28] MasseyA K, EisensteinJ, AntónA I, SwireP P. Automated text mining for requirements analysis of policy documents. In: Proceedings of the 21st IEEE International Requirements Engineering Conference (RE). 2013, 4– 13

[29] BhatiaJ, BreauxT D. A data purpose case study of privacy policies. In: Proceedings of the 25th IEEE International Requirements Engineering Conference (RE). 2017, 394– 399

[30] BreauxT D, SmullenD, HibshiH. Detecting repurposing and over-collection in multi-party privacy requirements specifications. In: The 23rd IEEE International Requirements Engineering Conference (RE). 2015, 166– 175

[31] SquicciariniA C, LinD, SundareswaranS, WedeJ. Privacy policy inference of user-uploaded images on content sharing sites. IEEE Transactions on Knowledge and Data Engineering, 2015, 27( 1): 193– 206

[32] LindenT, KhandelwalR, HarkousH, FawazK. The privacy policy landscape after the GDPR. Proceedings on Privacy Enhancing Technologies, 2020, 2020( 1): 47– 64

[33] WilsonS, SchaubF, LiuF, SathyendraK M, SmullenD, ZimmeckS, RamanathR, StoryP, LiuF, SadehN, SmithN A. Analyzing privacy policies at scale: from crowdsourcing to automated annotations. ACM Transactions on the Web, 2019, 13( 1): 1

[34] YuL, LuoX, QianC, WangS, LeungH K. Enhancing the description-to-behavior fidelity in android apps with privacy policy. IEEE Transactions on Software Engineering, 2018, 44( 9): 834– 854

[35] YuL, LuoX, ChenJ, ZhouH, ZhangT, ChangH, LeungH K N. PPChecker: towards accessing the trustworthiness of android Apps’ privacy policies. IEEE Transactions on Software Engineering, 2021, 47( 2): 221– 242

[36] KhuratA, SuntisrivarapornB, GollmannD. Privacy policies verification in composite services using OWL. Computers & Security, 2017, 67: 122– 141

[37] ZaeemR N, GermanR L, BarberK S. PrivacyCheck: automatic summarization of privacy policies using data mining. ACM Transactions on Internet Technology, 2018, 18( 4): 53

[38] SuchJ M, CriadoN. Resolving multi-party privacy conflicts in social media. IEEE Transactions on Knowledge and Data Engineering, 2016, 28( 7): 1851– 1863

[39] WangX, QinX, HosseiniM B, SlavinR, BreauxT D, NiuJ. Guileak: Tracing privacy policy claims on user input data for android applications. In: Proceedings of the 40th IEEE/ACM International Conference on Software Engineering (ICSE). 2018, 37− 47

[40] AmatoF, CoppolinoL, D’AntonioS, MazzoccaN, MoscatoF, SgaglioneL. An abstract reasoning architecture for privacy policies monitoring. Future Generation Computer Systems, 2020, 106: 393– 400

[41] OuederniM, SalaünG, PimentelE. Client update: a solution for service evolution. In: Proceedings of 2011 IEEE International Conference on Services Computing. 2011, 394− 401

[42] RyuS H, CasatiF, SkogsrudH, BenatallahB, Saint-PaulR. Supporting the dynamic evolution of web service protocols in service-oriented architectures. ACM Transactions on the Web, 2008, 2( 2): 13

[43] WuL, GeY, LiuQ, ChenE, HongR, DuJ, WangM. Modeling the evolution of users’ preferences and social links in social networking services. IEEE Transactions on Knowledge and Data Engineering, 2017, 29( 6): 1240– 1253

[44] RobolM, BreauxT D, PajaE, GiorginiP. Consent verification under evolving privacy policies. In: Proceedings of the 27th IEEE International Requirements Engineering Conference (RE). 2019, 422− 427

[45] AlomZ, CarminatiB, FerrariE. Adapting users’ privacy preferences in smart environments. In: Proceedings of the 2019 IEEE International Congress on Internet of Things (ICIOT). 2019, 165− 172

[46] JoshiK P, GuptaA, MittalS, PearceC, JoshiA, FininT. Semantic approach to automating management of big data privacy policies. In: Proceedings of the 2016 IEEE International Conference on Big Data (Big Data). 2016, 482− 491

[47] SlavinR, WangX, HosseiniM B, HesterJ, KrishnanR, BhatiaJ, BreauxT D, NiuJ. Toward a framework for detecting privacy policy violations in android application code. In: Proceedings of the 38th International Conference on Software Engineering. 2016, 25− 36

[48] LiY, Zhang Y, ZhuH, DuS. Toward automatically generating privacy policy for smart home apps. In: Proceedings of IEEE INFOCOM 2021-IEEE Conference on Computer Communications Workshops (INFOCOM WKSHPS). 2021, 1− 7

Acknowledgements

We thank doctoral candidate Yunfei Meng of Nanjing University of Aeronautics and Astronautics (NUAA), for his participation of beneficial discussions. We appreciate the anonymous referees for comments that will lead to the improvements of our paper. This work was supported by the Nature Science Foundation of Jiangsu for Distinguished Young Scientist (BK20170039), Guangxi Natural Science Foundation (2018GXNSFAA050046), Fund for Talents for Scientific Research at Jinling Institute of Technology, and Science Foundations of Nanjing Institute of Technology (CKJB201906).

RIGHTS & PERMISSIONS

2023 Higher Education Press