Formalization and Verification of Privacy Preserving Protocol Based on User Consent

MA Li; JIANG Huo-wen; PENG Yun

doi:10.12263/DZXB.20230144

您当前的位置：

首页 >

文章列表页 >

Formalization and Verification of Privacy Preserving Protocol Based on User Consent

PAPERS | 更新时间：2025-12-08

- Formalization and Verification of Privacy Preserving Protocol Based on User Consent
- ACTA ELECTRONICA SINICA Vol. 51, Issue 7, Pages: 1842-1849(2023)
- 作者机构：
  
  1.江西科技师范大学大数据科学学院，江西南昌 330038
  2.江西师范大学数字产业学院，江西南昌 330022
- 作者简介：
- 基金信息：
  
  Social Science Foundation Project of Jiangxi Province(21TQ08D);Humanities and Social Science Project of University of Jiangxi Province(JC22115);Natural Science Foundation of Jiangxi Province of China(20224BAB202013)
- DOI：10.12263/DZXB.20230144
  CLC： TP309.2
- Received：17 February 2023，
  
  Revised：2023-06-01，
  
  Published：25 July 2023
- 稿件说明：
移动端阅览
马丽,姜火文,彭云.基于用户同意的隐私保护协议形式化描述与验证[J].电子学报,2023,51(07):1842-1849.

MA Li,JIANG Huo-wen,PENG Yun.Formalization and Verification of Privacy Preserving Protocol Based on User Consent[J].ACTA ELECTRONICA SINICA,2023,51(07):1842-1849.
马丽,姜火文,彭云.基于用户同意的隐私保护协议形式化描述与验证[J].电子学报,2023,51(07):1842-1849. DOI： 10.12263/DZXB.20230144.

MA Li,JIANG Huo-wen,PENG Yun.Formalization and Verification of Privacy Preserving Protocol Based on User Consent[J].ACTA ELECTRONICA SINICA,2023,51(07):1842-1849. DOI： 10.12263/DZXB.20230144.

摘要

将用户同意与访问控制相结合是解决隐私保护的主要方法之一.然而，现有的隐私保护访问控制方法仅从数据控制者的角度，不考虑个人对访问决策的参与，无法满足自主可控的需求.为了解决这个问题，本文提出了一种基于用户同意的隐私保护访问控制协议，将用户同意转化为一种同意权限，形成一种同意加授权的双重访问控制机制.本文给出协议的语法、语义及安全性定义和分析，并采用模型检测的方法对协议应满足的性质进行验证，最终证明本文的设计可以从访问控制的角度满足个人信息保护法规的要求.

Abstract

The combination of user consents and access control is one of the main approaches to address privacy protection today. However

most of privacy protection access control approaches are from the perspective of the data controller

without considering individual participation in access decisions

and can not meet the need for privacy protection in terms of autonomy and control. In order to solve this problem

this paper proposes a privacy-preserving access control protocol based on user consents

which transforms user consents into a kind of consent authority and forms a dual access control mechanism of consent plus authorization. The syntax

semantics and security of the protocol are defined and analyzed. The properties that the protocol should satisfy are verified with the model checking method

which finally proves that the design of this paper can comply with personal information protection regulations from the perspective of access control.

关键词

Keywords

references

BARTOLINI C , DAOUDAGH S , LENZINI G , et al . Towards a lawful authorized access: A preliminary GDPR-based authorized access [C]// Proceedings of the 14th International Conference on Software Technologies . Setubal : SciTePress , 2019 : 331 - 338 .

DAOUDAGH S , MARCHETTI E , SAVARINO V , et al . How to improve the GDPR compliance through consent management and access control [C]// Proceedings of the 7th International Conference on Information Systems Security and Privacy . Setubal : SciTePress , 2021 : 534 - 541 .

BARTOLINI C , DAOUDAGH S , LENZINI G , et al . GDPR-based user stories in the access control perspective [M]// Communications in Computer and Information Science . Cham : Springer International Publishing , 2019 : 3 - 17 .

DROZDOWICZ M , GANZHA M , PAPRZYCKI M . Semantic access control for privacy management of personal sensing in smart cities [J]. IEEE Transactions on Emerging Topics in Computing , 2022 , 10 ( 1 ): 199 - 210 .

NI Q , BERTINO E , LOBO J , et al . Privacy-aware role-based access control [J]. ACM Transactions on Information and System Security , 2010 , 13 ( 3 ): 1 - 31 .

WANG H A , CAO J L , ZHANG Y C . Building access control policy model for privacy preserving and testing policy conflicting problems [M]// Access Control Management in Cloud Environments . Cham : Springer International Publishing , 2020 : 225 - 247 .

BYUN J W , LI N H . Purpose based access control for privacy protection in relational database systems [J]. The VLDB Journal , 2008 , 17 ( 4 ): 603 - 619 .

PEYRONE N , WICHADAKUL D . Formal models for consent-based privacy [J]. Journal of Logical and Algebraic Methods in Programming , 2022 , 128 : 100789 .

DAVARI M , BERTINO E . Access control model extensions to support data privacy protection based on GDPR [C]// 2019 IEEE International Conference on Big Data (Big Data) . Piscataway : IEEE , 2020 : 4017 - 4024 .

WU G J , WANG S P , NING Z L , et al . Blockchain-enabled privacy-preserving access control for data publishing and sharing in the Internet of medical things [J]. IEEE Internet of Things Journal , 2022 , 9 ( 11 ): 8091 - 8104 .

KABIR M E , WANG H . Conditional purpose based access control model for privacy protection [C]// Proceedings of the Twentieth Australasian Conference on Australasian Database - Volume 92 . New York : ACM , 2009 : 135 - 142 .

COLOMBO P , FERRARI E . Efficient enforcement of action-aware purpose-based access control within relational database management systems [J]. IEEE Transactions on Knowledge and Data Engineering , 2015 , 27 ( 8 ): 2134 - 2147 .

MAJEED A , LEE S . Anonymization techniques for privacy preserving data publishing: A comprehensive survey [J]. IEEE Access , 2020 , 9 : 8512 - 8545 .

VOIGT P , VON DEM BUSSCHE A . The EU General Data Protection Regulation (GDPR): A Practical Guide [M]. 1st Ed . Cham : Springer International Publishing , 2017 .

IT Governance Privacy Team , I T Governance . EU General Data Protection Regulation (GDPR) — An Implementation And Compliance Guide [M]. 4th edition . Ely : IT Governance Ltd , 2020 .

ČTVRTNÍK M . Data Minimisation—Storage limitation—archiving [M]// Archives and Records . Cham : Springer International Publishing , 2023 : 197 - 240 .

SANDHU R S , COYNE E J , FEINSTEIN H L , et al . Role-based access control models [J]. Computer , 1996 , 29 ( 2 ): 38 - 47 .

SANDHU R , BHAMIDIPATI V , MUNAWER Q . The ARBAC97 model for role-based administration of roles [J]. ACM Transactions on Information and System Security , 1999 , 2 ( 1 ): 105 - 135 .

FERRAIOLO D F , SANDHU R , GAVRILA S , et al . Proposed NIST standard for role-based access control [J]. ACM Transactions on Information and System Security , 2001 , 4 ( 3 ): 224 - 274 .

TRUONG N B , SUN K , LEE G M , et al . GDPR-compliant personal data management: A blockchain-based solution [J]. IEEE Transactions on Information Forensics and Security , 2019 , 15 : 1746 - 1761 .

TOKAS S , OWE O . A formal framework for consent management [C]// Formal Techniques for Distributed Objects, Components, and Systems—FORTE 2020 . Lecture Notes in Computer Science . Cham : Springer International Publishing , 2020 : 169 - 186 .

COLOMBO P , FERRARI E . Enhancing MongoDB with purpose-based access control [J]. IEEE Transactions on Dependable and Secure Computing , 2017 , 14 ( 6 ): 591 - 604 .

LAMPORT L, Specifying Systems: The TLA+ Language and Tools for Hardware and Software Engineers [M]. Boston : Addison-Wesley Longman Publishing Co, Inc , 2002 .

纪业 , 魏恒峰 , 黄宇 , 等 . CRDT协议的TLA+描述与验证 [J]. 软件学报 , 2020 , 31 ( 5 ): 1332 - 1352 .

JI Y , WEI H F , HUANG Y , et al . Specifying and verifying CRDT protocols using TLA+ [J]. Journal of Software , 2020 , 31 ( 5 ): 1332 - 1352 . (in Chinese)

Views

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

A CP-ABE Scheme with Cloud Proxy Re-Encryption

Research Progress on Attribute-Based Access Control

Progress of Cryptographic Access Control and Encryption Security Database

Fine-Grained Role Delegation Model Based on Mapping Mechanism

Related Author

ZHAO Kai-qiang

KANG Ping

LIU Bin

GUO Zhen

FENG Chao-sheng

QING Yu

FONT face

Verdana

Related Institution

The No.30 institute of China Electronic Technology Corporation

Network and Data Security Key Laboratory of Sichuan Province， University of Electronic Science and Technology of China

Department of Computer Science， Sichuan Normal University

School of Computer Science and Technology, Shaanxi Normal University

College of InformationShenzhen UniversityShenzhenGuangdong 518060China

⁰