Conformance Verification of Privacy Policies Xiang Fu Assistant Professor Department of Computer Science Hofstra University

Outline Motivation PV Framework Privacy Properties in Temporal Logic Verification using Alloy Conclusion

Introduction

Web App: Consumer and Producer of INFORMATION Web App SSN Credit Card Medical Record Address Shopping Preference Online Marketing Identity Collection SSN Business Partners Shopping Habits

Privacy Verification Problem Web App Your SSN never be forwarded CC destroyed after transaction Function as PROMISED?

Challenges Business Procedures DB Ops Servlets P3P Privacy Policy Model Checker

PV Framework P rivacy V erification Framework 1. Servlet Control/Data Flow 2. Information Flow 3. Data Operations

Data Model Entity Data Item Operator Servlet Database Business Organization Stakeholder Atomic Real-Being Countable Set CC Card SSN Med Record Transaction ID Name Primitive Type System Flattened Model

Example: Bookstore App Entities

Example: Bookstore App Data Types

Actions Know(e, d) entity data At any moment for any e and d, Know(e,d) is defined Action: transition system expressed using first order on Know predicates

Example: Charge Credit Card Free var, input variable All entities All data

Modeling Privacy Policy Typical Examples: P3P and EPAL Defines: ▫(1) What to protect? ▫(2) Who can receive it? ▫(3) How long?

P3P Example

Temporal Logic for P3P CTL-FO = CTL + First Order Quantifiers Credit Card Info Regularly Purged from DB & is not leaked for any credit cardfor any entities

Verification (1) Translate from PV to Alloy (2) Translate CTL-FO to Alloy Predicates (3) Verification using Alloy

Modeling World Schema module bookstore //1. world schema abstract sig Object {} abstract sig WA, Env, Data extends Object {} abstract sig Actions, Entities extends WA {} … Web App. Set of All Data Items Servlets

Modeling System State Model the transition relation sig State{ know: (WA + Env) -> Data, prev: one State, actstate: Actions -> actionStatus }{ all x: Actions | some status: actionStatus | x -> status in actstate }

Modeling Action pred pChargeCC[s,s’: State, d:CC]{ ChargeCC->READY in s.actstate and ( s’.know = s.know + {DB->d} + {Bank->d} && s’.prev=s && s’.actstate = s.actstate -.. ) }

Modeling CTL-FO Formula pred ef[s:State, d:Data]{ some s’: State | (CEO->d in s’.know) && s in s’.*prev } pred fa[s:State]{ all d: Data | (DB->d in s.know) => ef[s,d] } assert AGProperty{ all s: State | fa[s] }

Initial Experiments StateClausesConstr. Time (ms) Solver Time (ms) 5431k k k Objects

Conclusion PV Framework for Reasoning about Privacy Verification Paradigm using Alloy Problems …

Future Directions (1) Static Program Analysis  Path Transducer Model (Servlet)  Information Flow (Business Rules, Access Right Policies) (2) Customized Relational Constraint Solvers