Supporting model-based privacy analysis by exploiting privacy level agreements

Proceedings of the International Conference on Cloud Computing Technology and Science, CloudCom

Volumn 0, Issue , 2016, Pages 360-365

  Ahmadian, Amir Shayan ^a   Jurjens, Jan ^a,b  

^a University of Koblenz   (Germany)

^b Fraunhofer Institute for Software and Systems Engineering (ISST)   (Germany)

Author keywords

[No Author keywords available]

Indexed keywords

CLOUD COMPUTING;

CLOUD SECURITIES; CLOUD SERVICE PROVIDERS; INDUSTRY CASE STUDIES; PRIVACY ANALYSIS; PRIVACY AND SECURITY; SECURITY AND PRIVACY; SERVICE LEVEL AGREEMENTS; SERVICE PROVIDER;

SECURITY OF DATA;

EID: 85013025310     PISSN: 23302194     EISSN: 23302186     Source Type: Conference Proceeding    
DOI: 10.1109/CloudCom.2016.0063     Document Type: Conference Paper

References (31)

1. Fujitso Research Institute, "Personal data in the cloud: The importance of trust," Tokyo 105-7123, JAPAN, Sep. 2010
2. Cloud Security Alliance, "Privacy Level Agreement [V2]: A compliance tool for providing cloud services in the european union," https://cloudsecurityalliance.org/download/privacy-level-agreementversion-2, 2009
3. VisiOn Project. [Online]. Available: http://www.visioneuproject. eu/ 2016
4. Cloud Security Alliance. Accessed: 2016-08-07. [Online]. Available: http://cloudsecurityalliance.org/
5. J. Jürjens, Secure systems development with UML. Springer, 2005. [Online]. Available: http://dx.doi.org/10.1007/b137706
6. J. Jürjens, "Model-based security engineering with UML," in Foundations of Security Analysis, and Desing III: FOSAD 2004/2005 Tutorial Lectures, ser. Lecture Notes in Computer Science, A. Aldini, R. Gorrieri, and F. Martinelli, Eds., 2005, vol. 3655, pp. 42-77
7. Object Management Group (OMG), "UML 2.4.1 Superstructure Specification," 2011
8. S. Höhn, and J. Jürjens, "Rubacon: Automated support for modelbased compliance engineering," in International Conference on Software Engineering (ICSE). ACM, 2008, pp. 875-878
9. (2016, May) CARiSMA. [Online]. Available: https://rgse.uni-koblenz. de/carisma/
10. J. Jürjens, "Secure information flow for concurrent processes," in 11th International Conference on Concurrency Theory (CONCUR 2000), ser. Lecture Notes in Computer Science, vol. 1877. Springer Verlag, 2000, pp. 395-409
11. J. Jürjens, and G. Wimmel, "Security modelling for electronic commerce: The Common Electronic Purse Specifications," in First IFIP Conference on e-Commerce, e-Business, and e-Government (I3E). Kluwer, 2001, pp. 489-505
12. J. Jürjens, "Modelling audit security for smart-card payment schemes with UMLsec," in 16th International Conference on Information Security (IFIPSEC"01), IFIP. Kluwer, 2001, pp. 93-108
13. J. Jürjens, and G. Wimmel, "Formally testing fail-safety of electronic purse protocols," in 16th International Conference on Automated Software Engineering (ASE 2001). IEEE, 2001, pp. 408-411
14. S. H. Houmb, G. Georg, J. Jürjens, and R. B. France, "An integrated security verification, and security solution design trade-off analysis approach," in Integrating Security, and Software Engineering: Advances, and Future Vision, H. Mouratidis, Ed. Idea Group, 2006, pp. 190-219, invited chapter
15. E. Fernández-Medina, J. Jürjens, J. Trujillo, and S. Jajodia, "Modeldriven development for secure information systems," Information & Software Technology, vol. 51, no. 5, pp. 809-814, 2009
16. D. Petriu, M. Woodside, D. Petriu, J. Xu, T. Israr, G. Georg, R. France, J. Bieman, S. H. Houmb, and J. Jürjens, "Performance analysis of security aspects in UML models," in Sixth International Workshop on Software, and Performance (WOSP 2007). Buenos Aires, Argentina: ACM, 2007, pp. 91-102
17. F. Dupressoir, A. D. Gordon, J. Jürjens, and D. Naumann, "Guiding a general-purpose c verifier to prove cryptographic protocols," Journal of Computer Security, vol. 22, no. 5, pp. 823-866, 2014, special issue with best papers from the 24th IEEE Computer Security Foundations Symposium (CSF
18. R. Breu, K. Burger, M. Hafner, J. Jürjens, G. Popp, G. Wimmel, and V. Lotz, "Key issues of a formally based process model for security engineering," in Sixteenth International Conference "Software & Systems Engineering & their Applications", Paris, 2003
19. K. Schneider, E. Knauss, S. Houmb, S. Islam, and J. Jürjens, "Enhancing security requirements engineering by organisational learning," Requirements Engineering Journal (REJ), vol. 17, no. 1, pp. 35-56, 2012
20. European Parliament, Council of the European Union, "Directive 95/46/EC of the European Parliament, and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data, and on the free movement of such data," Official Journal of the European Union, vol. L 281, 1995
21. European Parliament, "Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data, and on the free movement of such data ," Official Journal of the European Union, vol. L 119, 2016
22. K. Barker, M. Askari, M. Banerjee, K. Ghazinour, B. Mackas, M. Majedi, S. Pun, and A. Williams, "A data privacy taxonomy," in Dataspace: The Final Frontier, 26th British National Conference on Databases, BNCOD 26, Birmingham, UK, July 7-9, 2009. Proceedings, 2009, pp. 42-54
23. K. Ghazinour, M. Majedi, and K. Barker, "A lattice-based privacy aware access control model," in Computational Science, and Engineering, 2009. CSE 09. International Conference on, vol. 3, Aug 2009, pp. 154-159
24. R. S. Sandhu, E. J. Coyne, H. L. Feinstein, and C. E. Youman, "Rolebased access control models," Computer, vol. 29, no. 2, pp. 38-47, Feb. 1996. [Online]. Available: http://dx.doi.org/10.1109/2.485845
25. X. Jin, R. Sandhu, and R. Krishnan, RABAC: Role-Centric Attribute-Based Access Control. Springer Berlin Heidelberg, 2012, pp. 84-96. [Online]. Available: http://dx.doi.org/10.1007/978-3-642-33704-8 8
26. A. S. Ahmadian, F. Coerschulte, and J. Jürjens, Supporting the Security Certification, and Privacy Level Agreements in the Context of Clouds. Springer International Publishing, 2016, pp. 80-95. [Online]. Available: http://dx.doi.org/10.1007/978-3-319-40512-4 5
27. "ISO/IEC 27001 Information Security Management System (ISMS) standard," International Organization for Standardization, Geneva, Switzerland, ISO 27001: 2013, Oct. 2013
28. M. DErrico, and S. Pearson, "Towards a formalised representation for the technical enforcement of privacy level agreements," in Cloud Engineering (IC2E), 2015 IEEE International Conference on, March 2015, pp. 422-427
29. S. Islam, H. Mouratidis, and J. Jürjens, "A framework to support alignment of secure software engineering with legal regulations," Software & Systems Modeling, vol. 10, no. 3, pp. 369-394, 2011. [Online]. Available: http://dx.doi.org/10.1007/s10270-010-0154-z
30. S. Pearson, and D. Allison, "A model-based privacy compliance checker," IJEBR, vol. 5, no. 2, pp. 63-83, 2009. [Online]. Available: http://dx.doi.org/10.4018/jebr.2009040104
31. S. Pearson, "Taking account of privacy when designing cloud computing services," in Proceedings of the 2009 ICSE Workshop on Software Engineering Challenges of Cloud Computing, ser. CLOUD 09. IEEE Computer Society, 2009, pp. 44-52. [Online]. Available: http://dx.doi.org/10.1109/CLOUD.2009.5071532