@inproceedings{LanzingerUlbrichWeigl22, author = {Florian Lanzinger and Mattias Ulbrich and Alexander Weigl}, title = {A Refactoring for Data Minimisation Using Formal Verification}, booktitle = {11th International Symposium on Leveraging Applications of Formal Methods, Verification and Validation. Software Engineering ({ISoLA} 2022)}, month = oct, year = {2022}, series = {Lecture Notes in Computer Science}, volume = {13702}, pages = {345--364}, abstract = {Concerns about protecting private user data grow as automated data processing by software becomes more ubiquitous in our society. One important principle is data minimisation, which requires that all collected personal data must be limited to what is necessary for the respective declared purpose. For existing software systems, it can be difficult to determine which input data are indeed necessary to compute the result and which data can (in certain cases) be left out. We present a new approach that can be used to adapt an existing program to data minimisation requirements. In this framework a user transmits a set of facts about their data instead of the full data. We formally define the approach and introduce a variety of minimisation notions for it. We have implemented the approach and demonstrate its feasibility on a few selected examples.}, publisher = {Springer}, address = {Cham}, editor = {Tiziana Margaria and Bernhard Steffen}, isbn = {978-3-031-19756-7}, doi = {10.1007/978-3-031-19756-7_19}, url = {https://doi.org/10.1007/978-3-031-19756-7_19} }
A Refactoring for Data Minimisation Using Formal Verification
Autor(en): | Florian Lanzinger, Mattias Ulbrich und Alexander Weigl |
---|---|
In: | 11th International Symposium on Leveraging Applications of Formal Methods, Verification and Validation. Software Engineering (ISoLA 2022) |
Verleger: | Springer |
Reihe: | Lecture Notes in Computer Science |
Band: | 13702 |
Jahr: | 2022 |
Seiten: | 345-364 |
Preprint/PDF: | isola22_DataMinimisation.pdf |
URL: | https://doi.org/10.1007/978-3-031-19756-7_19 |
DOI: | 10.1007/978-3-031-19756-7_19 |
Links: | The final publication is available at Springer. |
Abstract
Concerns about protecting private user data grow as automated data processing by software becomes more ubiquitous in our society. One important principle is data minimisation, which requires that all collected personal data must be limited to what is necessary for the respective declared purpose. For existing software systems, it can be difficult to determine which input data are indeed necessary to compute the result and which data can (in certain cases) be left out. We present a new approach that can be used to adapt an existing program to data minimisation requirements. In this framework a user transmits a set of facts about their data instead of the full data. We formally define the approach and introduce a variety of minimisation notions for it. We have implemented the approach and demonstrate its feasibility on a few selected examples.