Data Privacy Validation and Verification in E-Health

Transcription

1 Data Privacy Validation and Verification in E-Health Flora Amato 1, Francesco Moscato 2, Vincenzo Moscato 3, and Antonio Picariello 4 1 DIETI, University of Naples Federico II, Italy, flora.amato@unina.it 2 DiSciPol, University of Campania Luigi Vanvitelli, Italy, francesco.moscato@unicampania.it 3 DIETI, University of Naples Federico II, Italy, vmoscato@unina.it 4 DIETI, University of Naples Federico II, Italy, picus@unina.it Abstract. The few last years experienced the growth of new technologies able to remotely monitor health state of persons. This includes both (even complex) Medical devices and all kind of wearable device. Thus, the problem of assuring data privacy is more and more important in E- Health systems. Privacy requirements in Medical domains are not only defined by service providers or users, but Legal rules regulate the whole management and storage processes of health records. This is a discussion paper on the use of Model Driven techniques for E-Health systems for formal verification of privacy requirements. The whole approach is based on MetaMORP(h)OSY modeling profile in order to explicitly consider privacy requirements for data. This work discusses about a novel model transformation algorithm for the application of Model Checking techniques to privacy verification. Keywords: Privacy Model Driven Engineering E-Health. 1 Introduction The last few years saw Internet of Things (IoT), Smart Devices, Edge and Cloud computing as one of the main research topic in Computer Science and Engineering. In particular E-health is now an hot topic thanks to IoT and Smart devices applications used in health domain. E-Health allows for an increase of efficiency in health care, decreasing costs, sharing diagnostics and information about therapeutic interventions. It also improves quality and reduces delay of medical actions enabling fast second opinion requests and supporting for remote suggestions and training from specialists. E-Health inherits all problems both from Medical and Computer Science domains. In particular Data Privacy is an hard problem to deal with for it unfortunately adds legal requirements (and hence the Legal domain) to the others. The main problems with these new technologies is that they trigger several privacy issues because of the large amount of sensitive data on patients health condition.

2 2 F.Amato et al. In this scenario it is really difficult to verify if a computer system respects data privacy requirements because of the heterogeneity of elements to consider. This work discusses on how Model Driven Engineering (MDE)[30] enables formal, automatic verification of E-Health composite processes with regards to Data Privacy properties. In particular, we exploit MetaMORP(h)OSY framework in order to provide formal modeling profiles and methodologies in order to define models of E-Health Systems and to analyse privacy requirements with formal methods. Model Driven Engineering extends the scope of OMG s Model Driven Architecture (MDA)[31], MDE is wider in scope than MDA. It combines design, automatic generation of system components and requirements verification during all its life-cycle. MDE focuses on creating running components of a system by their abstract (and formal) representation, leaving verification and (some) implementation issues to automatic translators. Requirements on abstract models are easier to analyse and formal verification can be exploited as well during design phase. In order to reduce the introduction of implementation errors, MDE methodologies try to implement automatically components from design models. In this way, introduction of errors that may lead to unsatisfying requirement can be reduced producing systems correct by construction. In this paper we will use MetaMORP(h)OSY MDE framework, that is based on a Multi-Agent modeling paradigm. As we will describe in the following, this paradigm suites well the complexity of E-Health systems. Multi-Agent Systems[34] Models are promising formalisms for the analysis of complex services, where several actors executes actions pro-actively. E-Health systems have this properties for their nature of distributed and heterogeneous systems. It defines actors and system components by using a meta-formalism that extends Unified Modeling Language (UML). The main model is then analysed by means of formal models that are obtained from the UML model with model transformation algorithms. MetaMORP(h)OSY framework was introduced in [2]. In this paper we discuss results of[3]. We show how MetaMORP(h)OSY modeling profile is able to explicitly consider privacy requirements for data. A novel algorithm is described for implementing a horizontal model transformation [23] for the application of Model Checking techniques to privacy verification. 2 Data Privacy: Modelling and Verification In order to specialize MetaMORP(h)OSY methodology to manage verification of data privacy on E-Health systems, we must extend its modeling profiles. A sketch of this profile is reported in Fig.1. On the other hands, this new modelling profile specializes some beliefs too. Known Electronic Health Records (HealthRecord) and eventually their encrypted versions (EnCryptedHR) refers to some Patients and are stored onto DataSubProcessors. Patients may hide some records (HiddenRecord )to any agent able to read his data and can grant authorization (AccessGrant ) to ac-

3 Data Privacy Validation and Verification in E-Health 3 Fig. 1. E-Health Modelling Profile cess to data to any other agent. In particular, access to encrypted data must be coupled with the keys to manage encryption (EncryptKey and DecryptKey). As introduced in section 1, this work manages the verification of privacy requirements as a reachability problem. This also because MetaMORP(h)OSY includes some Observers for Analysis of timed reachability of Agents Goals. Anyway the basic Observer profile has been specialized as show in Fig.2. This new Observer, in fact, explicitly considers the Health records and the authorization granted to access records. Obviously, MetaMORP(h)OSY profile can be extended to manage different properties and architectures related to distributed data problems. For example, E-Health data management may lead to the use of public and private clouds, multi-provider clouds, etc. Requirements for multi-storage architectures can be easily integrated in the model. In particular, the application of Meta- MORP(h)OSY methodology to the case of multi-storage services from multiple parties, which leads to a composite cloud service, is deeply discussed in [24]. Finally, the main MetaMORP(h)OSY profile was defined for description of real-time system and it includes many elements to define time constraints and

4 4 F.Amato et al. Fig. 2. E-Health Observer Profile timed behaviours of agents. Some Observers (both at design and run time) exists that are able to check temporal behaviours of the systems. Previous works ([25, 28, 5]) describes them. Notice that we can use this part of the profile to model time-variant data-policies and storage behaviours, but this is out of the scope of this work. 3 Case Studies In this section we want to show how it is possible to use MetaMORP(h)OSY methodology and the modeling profile described in the previous section in order to define a protocol for managing and storing E-Health records. For Simplicity s sake, we will consider several simplifying assumptions. We consider the communication networks secure; we model data controllers, processors and subprocessors as a unique agent. The problem to solve is the storage of sensitive data (the health record) on a third-party storage server (eventually a cloud storage). Data outputted from the device is encrypted every time. The physician (thedoctor) can access to thepatient s record only if it is authorized by the patient, but thedoctor cannot own the decription key of thepatient. In addition, in order to manage emergencies, an encrypted version of the record has to be stored on the DataProvider too. In order to produce a MetaMORP(h)OSY model of these agents, we must define an Agent Diagram describing the structural view of the agents. The Agent Diagrams declare the structure, the plans, the goals and the beliefs of each agents. In the following we will omit the inner properties of each element in the diagrams for brevity.

5 Data Privacy Validation and Verification in E-Health 5 Fig. 3. thepatient s Agent Diagram Fig.3 depicts the Agent Diagram for thepatient. In order to describe each plan behavior, we must define proper Activity Diagrams that are compliant with the previously exposed modesling profile. Finally, Sequence diagrams constitute a mean to orchestrate agents execution in use cases. They simply declares events that agents assert during their execution. It is possible to verify CTL formulas by means of the Observer. For example: thedoctor.emergencyaccess.initialactivity EGtheDoctor.Read Goal Is true if in the case of Emergency, in any case the Read Goal is reachable and hence the doctor can, in any case, read the record in case of emergency. 4 Conclusions In this paper we have extet the MetaMORP(h)OSY modelling profile in order to explicitly consider privacy requirements for data. A novel algorithm is described

6 6 F.Amato et al. Fig. 4. Save Plan for implementing a horizontal model transformation for the application of Model Checking techniques to privacy verification and to express privacy in terms of a stete reachability problem following an MDE approach. As future works we are considering the introduction of further model transformation algorithms to support more complicated data privacy requirements and models. For example, the approach reported in [20] uses models based on Bayesan Models. Since MetaMORP(h)OSY already embeds Bayesan Observers, we will try to enhance our modelling and verification techniques to include more and more privacy models. References 1. Abdulla, P., Deneux, J., Stalmarck, G., Agren, H., Akerlund, O.: Designing safe, reliable systems using scade. In: Margaria, T., Steffen, B. (eds.) Leveraging Applications of Formal Methods, Lecture Notes in Computer Science, vol. 4313, pp Springer Berlin Heidelberg (2006) 2. Amato, F., Mazzocca, N., Moscato, F.: Model driven design and evaluation of security level in orchestrated cloud services. Journal of Network and Computer Applications 106, (2018) 3. Amato, F., Moscato, F.: A model driven approach to data privacy verification in e-health systems. Trans. Data Privacy 8(3), (2015) 4. Antón, A.I., Earp, J.B., Reese, A.: Analyzing website privacy requirements using a privacy goal taxonomy. In: Requirements Engineering, Proceedings. IEEE Joint International Conference on. pp IEEE (2002) 5. Aversa, R., Di Martino, B., Moscato, F.: Critical systems verification in metamorp (h) osy. In: Computer Safety, Reliability, and Security, pp Springer (2014) 6. Bauer, B.: Uml class diagrams revisited in the context of agent-based systems. In: Agent-Oriented Software Engineering II, pp Springer (2002) 7. Bauer, B., Mller, J.P., Odell, J.: Agent uml: A formalism for specifying multiagent software systems. Int. Journal of Software Engineering and Knowledge Engineering 11, (2000)

7 Data Privacy Validation and Verification in E-Health 7 8. Behrmann, G., David, A., Larsen, K.G., Pettersson, P., Yi, W.: Developing uppaal over 15 years. Software: Practice and Experience 41(2), (2011) 9. Bresciani, P., Perini, A., Giorgini, P., Giunchiglia, F., Mylopoulos, J.: Tropos: An agent-oriented software development methodology. Autonomous Agents and Multi- Agent Systems 8(3), (2004) 10. Commission, E.: Article 29 Working Party. data-protection/article-29/index_en.htm (2013), [Online; Last update: 06/08/2013] 11. Ding, Y., Klein, K.: Model-driven application-level encryption for the privacy of e- health data. In: Availability, Reliability, and Security, ARES 10 International Conference on. pp (Feb 2010) Dolin, R.H., Alschuler, L., Boyer, S., Beebe, C., Behlen, F.M., Biron, P.V., Shvo, A.S.: Hl7 clinical document architecture, release 2. Journal of the American Medical Informatics Association 13(1), (2006) 13. Farines, J., De Queiroz, M., da Rocha, V., Carpes, A., Vernadat, F., Cregut, X.: A model-driven engineering approach to formal verification of plc programs. In: Emerging Technologies Factory Automation (ETFA), 2011 IEEE 16th Conference on. pp. 1 8 (Sept 2011) Fernndez-Caballero, A., Gascuea, J.: Developing multi-agent systems through integrating prometheus, ingenias and icaro-t. In: Filipe, J., Fred, A., Sharp, B. (eds.) Agents and Artificial Intelligence, Communications in Computer and Information Science, vol. 67, pp Springer Berlin Heidelberg (2010) 15. Fredriksen, R., Kristiansen, M., Gran, B.A., Stølen, K., Opperud, T.A., Dimitrakos, T.: The coras framework for a model-based risk management process. In: Computer Safety, Reliability and Security, pp Springer (2002) 16. Fuxman, A., Pistore, M., Mylopoulos, J., Traverso, P.: Model checking early requirements specifications in tropos. In: Requirements Engineering, Proceedings. Fifth IEEE International Symposium on. pp IEEE (2001) 17. Gascuea, J.M., Navarro, E., Fernndez-Caballero, A.: Model-driven engineering techniques for the development of multi-agent systems. Engineering Applications of Artificial Intelligence 25(1), (2012). http: // 18. Hafer, T., Thomas, W.: Computation tree logic ctl* and path quantifiers in the monadic theory of the binary tree. In: Automata, Languages and Programming, pp Springer (1987) 19. Kalra, D.: Electronic health record standards (2006) 20. Liu, J., Xiong, L., Luo, J.: Semantic security: Privacy definitions revisited. Transactions on Data Privacy 6(3), (2013) 21. Lodderstedt, T., Basin, D., Doser, J.: Secureuml: A uml-based modeling language for model-driven security. In: UML 2002The Unified Modeling Language, pp Springer (2002) 22. Massacci, F., Prest, M., Zannone, N.: Using a security requirements engineering methodology in practice: the compliance with the italian data protection legislation. Computer Standards & Interfaces 27(5), (2005) 23. Mens, T., Gorp, P.V.: A taxonomy of model transformation. Electronic Notes in Theoretical Computer Science 152(0), (2006). science/article/pii/s , proceedings of the International Workshop on Graph and Model Transformation (GraMoT 2005), Graph and Model Transformation 2005

8 8 F.Amato et al. 24. Moscato, F.: Model driven engineering and verification of composite cloud services in metamorp(h)osy. In: Intelligent Networking and Collaborative Systems (INCoS), 2014 International Conference on. pp (Sept 2014) Moscato, F., Venticinque, S., Aversa, R., Di Martino, B.: Formal modeling and verification of real-time multi-agent systems: The remm framework. Studies in Computational Intelligence 162, (2008) 26. Moscato, F., Aversa, R., Martino, B.D., Fortis, T.F., Munteanu, V.I.: An analysis of mosaic ontology for cloud resources annotation. In: IEEE Proc. of FedCSIS 2011 Conference. pp (2011) 27. Moscato, F., Martino, B.D., Aversa, R.: Enabling model driven engineering of cloud services by using mosaic ontology. Scalable Computing: Practice and Experience 13(1) (2012) 28. Moscato, F., Venticinque, S., Aversa, R., Di Martino, B.: Formal modeling and verification of real-time multi-agent systems: The remm framework. In: Badica, C., Mangioni, G., Carchiolo, V., Burdescu, D. (eds.) Intelligent Distributed Computing, Systems and Applications, Studies in Computational Intelligence, vol. 162, pp Springer Berlin / Heidelberg (2008) 29. Moscato, F., Vittorini, V., Amato, F., Mazzeo, A., Mazzocca, N.: Solution workflows for model-based analysis of complex systems. IEEE T. Automation Science and Engineering 9(1), (2012) 30. Schmidt, D.C.: Model-driven engineering. COMPUTER-IEEE COMPUTER SOCIETY- 39(2), 25 (2006) 31. Soley, R., et al.: Model driven architecture. OMG white paper 308, 308 (2000) 32. Toval, A., Olmos, A., Piattini, M.: Legal requirements reuse: a critical success factor for requirements quality and personal data protection. In: Requirements Engineering, Proceedings. IEEE Joint International Conference on. pp IEEE (2002) 33. Trencansky, I., Cervenka, R.: Agent modeling language (aml): A comprehensive approach to modeling mas. Whitestein Series in Software Agent Technologies and Autonomic Computing 29, (2005) 34. Wooldridge, M.: Agent-based software engineering. In: IEE Proceedings on Software Engineering. pp (1997)