KR102354926B1 - Method and Apparatus for Generating Privacy Assurance Case - Google Patents

Abstract

The present embodiments generate a privacy goal and security attribute goal for a target system based on system design principles, and verify and modify existing privacy requirements, or newly derive privacy goals, security attribute goals, and updated privacy requirements. A method and apparatus for creating a privacy assurance case that can match a security technology suitable for a new privacy requirement by creating an associated privacy assurance case are provided.

Description

Method and Apparatus for Generating Privacy Assurance Case}

The technical field to which the present invention pertains relates to a method and apparatus for generating a privacy assurance instance.

Although various security technologies have been developed to protect personal information and related laws are being revised, personal information leakage still occurs. This problem occurs because, in the process of specifying the system requirements, only the security requirements are specified without clearly defining the privacy requirements.

It is necessary to build a privacy-friendly system in domains such as healthcare and banking where privacy protection must be guaranteed. The method of building the existing privacy-friendly system has a problem in that it derives security requirements without considering the relationship between privacy and security or supplements principles and laws for privacy protection.

The present invention creates a privacy goal and security attribute goal for a target system based on system design principles, and connects the privacy goal, security attribute goal, and updated privacy requirement by modifying or newly derived by verifying existing privacy requirements. By creating a privacy assurance case, the main purpose is to match the appropriate security technology to the new privacy requirements.

Other objects not specified in the present invention may be additionally considered within the scope that can be easily inferred from the following detailed description and effects thereof.

According to an aspect of this embodiment, in a method for generating a privacy guarantee case by a computing device, generating a privacy goal for a target system based on a predefined system design principle, matching a security technology to be applied to the target system generating a security attribute goal corresponding to the privacy goal to Provided is a method for creating a privacy assurance case, comprising the step of creating an associated privacy assurance case.

According to another aspect of this embodiment, a privacy goal generating unit that generates a privacy goal for a target system based on a predefined system design principle, and a security corresponding to the privacy goal to match a security technology to be applied to the target system A security attribute goal generating unit generating an attribute goal, a privacy requirement generating unit generating a privacy requirement necessary for the target system, and concatenating the privacy goal, the security attribute goal, and the privacy requirement using graphic notation There is provided a privacy guarantee case generating device including a privacy guarantee case generating unit for generating a privacy guarantee case.

As described above, according to the embodiments of the present invention, a privacy goal and security attribute goal for a target system are generated based on system design principles, and an existing privacy requirement is verified and modified or newly derived to create a privacy goal and security goal. By creating a privacy assurance case linking the attribute goal and the updated privacy requirements, it is possible to match a security technology suitable for the new privacy requirements, and there is an advantageous effect in terms of reuse during software maintenance or expansion in the future.

Even if effects not explicitly mentioned herein, effects described in the following specification expected by the technical features of the present invention and effects apparent to those skilled in the art are treated as described in the specification of the present invention.

1 is a block diagram illustrating an apparatus for generating a privacy guarantee case according to an embodiment of the present invention.
2 illustrates a privacy goal and a security attribute goal generated by the apparatus for generating a privacy guarantee case according to an embodiment of the present invention.
3 illustrates a keyword thesaurus referenced by the apparatus for generating a privacy guarantee case according to an embodiment of the present invention.
4 illustrates a privacy requirement generated by the apparatus for generating a privacy guarantee case according to an embodiment of the present invention.
5 illustrates a W5H pattern referenced by the apparatus for generating a privacy guarantee case according to an embodiment of the present invention.
6 illustrates a question generated by the apparatus for generating a privacy guarantee case according to an embodiment of the present invention.
7 illustrates a result of evaluating privacy requirements by the apparatus for generating a privacy guarantee case according to an embodiment of the present invention.
8 illustrates a graphic notation used by the apparatus for generating a privacy guarantee case according to an embodiment of the present invention.
9 illustrates a privacy guarantee case generated by the apparatus for generating a privacy guarantee case according to an embodiment of the present invention.
10 is a flowchart illustrating a method of generating a privacy guarantee case according to another embodiment of the present invention.

Hereinafter, in the description of the present invention, if it is determined that the subject matter of the present invention may be unnecessarily obscured as it is obvious to those skilled in the art with respect to related known techniques, the detailed description thereof will be omitted, and some embodiments of the present invention will be described. It will be described in detail with reference to exemplary drawings.

The privacy assurance case creation device establishes the relationship between privacy and security throughout the entire software development cycle. The meanings of terms used in this specification are defined as follows.

Privacy is a concept that includes the right of the data subject to know the purpose of use of personal information, the right of the data subject to choose to consent to or reject the use of the information, and the right to be protected from leakage of the personal information collected and used by the data subject to be. The types of information that can be treated as personal information are classified into personal information, physical information, mental information, property information, and social information.

Security is divided into three attributes: confidentiality, integrity, and availability. Information security is an administrative and technical method that prevents information from being damaged, altered, or leaked in the process of information collection, processing, and transmission.

Requirements are the specification of constraints on the services and operations provided by software. It reflects the needs of customers who will use the software and the purpose of the entity providing the service. Privacy requirements are specific specifications based on the law for the use and confidentiality of personal information. Security requirements are technical and administrative specifications to ensure confidentiality, integrity, and availability of a system.

1 is a block diagram illustrating an apparatus for generating a privacy guarantee case according to an embodiment of the present invention. As shown in FIG. 1 , the apparatus 100 for generating a privacy guarantee case includes a privacy bone generator 110 , a security attribute bone generator 120 , a privacy requirement generator 130 , and a privacy guarantee case generator ( 140). The privacy guarantee case generating apparatus 100 may omit some of the various components illustrated by way of example in FIG. 1 or may additionally include other components.

The privacy guarantee case generating apparatus 100 generates a privacy goal and a security attribute goal for a target system, and verifies and modifies or newly derives an existing privacy requirement. The privacy assurance case generating apparatus 100 generates a privacy assurance case by connecting the privacy goal, the security attribute goal, and the updated privacy requirement, and matches a security technology suitable for the new privacy requirement.

Hereinafter, an operation of generating a privacy goal and a security attribute goal generated by the apparatus for generating a privacy guarantee case will be described with reference to FIG. 2 . In FIG. 2, a privacy goal and a security attribute goal generated by the apparatus for generating a privacy guarantee case are exemplified.

1 and 2 , the privacy goal generator 110 generates a privacy goal for a target system based on a predefined system design principle.

The privacy goal generator 110 (i) prepares in advance rather than reactively, (ii) sets revision information protection as a default value, (iii) considers personal information protection from the planning stage, (iv) ensures comprehensive functionality, ( Create a privacy goal by adhering to system design principles that v) protect the entire lifecycle, (vi) ensure visibility and transparency, and (vii) respect individual privacy. Proactive rather than reactive means preventing problems rather than fixing them, guaranteeing comprehensive functionality means pursuing positive sums rather than zero sums, and respecting individual privacy means user-centered design and operation. .

The security attribute goal generator 120 generates a security attribute goal corresponding to the privacy goal in order to match a security technique to be applied to the target system. The security attribute goal generating unit 120 subdivides and generates a security attribute goal based on a predefined Fair Information Practice Principle (FIPs) or Privacy Protection Principles.

Hereinafter, an operation of generating the privacy requirement generated by the privacy guarantee case generating apparatus will be described with reference to FIGS. 3 to 7 .

The privacy requirement generating unit 130 generates a privacy requirement necessary for the target system. The privacy requirement generating unit 130 matches which security attribute goal and privacy goal the existing privacy requirements of the target software are related to.

The privacy requirement generating unit 130 generates a privacy requirement using a Goal Question Metric (GQM) method. The GQM approach declares the goals of the software in the first step and defines the questions to be solved in order to achieve the goals in the second step. In the final step, the software is validated by answering the questions in a quantitative or qualitative way.

The privacy requirement generating unit 130 extracts keywords from the existing privacy requirements for the target system, generates a question for evaluating the existing privacy requirements, and generates the existing privacy requirements based on the generated question. Validate to modify existing privacy requirements or add new privacy requirements.

3 exemplifies a keyword thesaurus referenced by the privacy guarantee case generating device, and FIG. 4 exemplifies the existing privacy requirements derived by the privacy guarantee instance generating device.

1, 3, and 4 , the privacy requirement generating unit 130 extracts the subject, object, and verb related to personal information as personal information related keywords from the existing privacy requirements with reference to the keyword thesaurus. do. When extracting a question, the question is extracted using the W5H pattern based on the personal information development guidelines or laws that must be complied with in the domain of the target system or software. In order to properly match the goal and the requirements, the subject, object, and verb related to personal information are extracted from the privacy requirements as keywords related to personal information. For consistency, a thesaurus of keywords related to personal information is created, and the requirements are matched with the security attribute goal using the extracted keywords.

The privacy requirement generator 130 formalizes a question for evaluating the existing privacy requirements using the W5H pattern based on the personal information protection guidelines related to the target system. 5 exemplifies the W5H pattern referenced by the privacy assurance case generating device, and FIG. 6 exemplifies a question generated by the privacy assurance instance generating device.

7 exemplifies the result of evaluating the privacy requirements by the privacy assurance case generating apparatus. The privacy assurance case generating device evaluates whether the privacy requirements matching the declared privacy goal and security attribute goal are satisfied using the extracted question.

The privacy requirement generating unit 130 uses the generated question based on the rules that must be complied with according to the Personal Information Protection Act related to the target system. For example, according to the enactment and enforcement of the Personal Information Protection Act, a guide to conducting a personal information impact assessment, which is a measure that public institutions must comply with, can be used. The privacy requirement generating unit 130 evaluates the privacy goals by dividing them into (i) applied, (ii) partially applied, (iii) not applied, and (iv) not applicable.

In FIG. 7, the evaluation area means seven privacy goals, and the evaluation target shows privacy requirements matching the privacy goals. If there is no matching requirement, mark the evaluation target with 'X' and check if the requirement is missing. The evaluation result for the question is judged based on the contents of the personal information protection guideline and system development guideline suitable for the domain of the software being verified. In the evaluation grounds and opinions, the reasons for the evaluation results can be written and used to revise the requirements later or to derive additional ones.

The privacy requirement generating unit 130 may determine that the requirements corresponding to partial application and non-application among the question evaluation results do not sufficiently satisfy the privacy goal. Partially applicable and non-applied requirements are subject to modification of requirements or the derivation of new privacy requirements. Consider the evaluation grounds and opinions of the requirements evaluation table, and modify and define the requirements according to the W5H pattern to include the content of the question.

Hereinafter, an operation of generating the privacy guarantee case generated by the privacy guarantee case generating apparatus will be described with reference to FIGS. 8 and 9 .

In FIG. 8 , the graphic notation used by the privacy assurance case generating apparatus is illustrated.

1 and 8 , the privacy guarantee case generating unit 140 generates a privacy guarantee case in which a privacy goal, a security attribute goal, and a privacy requirement are connected by using a graphic notation. The privacy goal, security attribute goal, and requirement element are expressed differently from the existing GSN (Goal Structuring Notation) notation. In other words, the privacy assurance case notation represents the top-level assertion, privacy goal, and security attribute goal differently. It can be identified which privacy goals must be satisfied, and in particular which security attribute goals must be satisfied in order to verify any top-level purpose or assertion. It is possible to indicate which security technology can be finally linked to which security attribute goal is matched with the privacy requirements derived by newly marking the requirements in the assurance case.

The privacy guarantee case generating unit 140 may provide a guide for developing a privacy-friendly system by connecting the modified and derived privacy requirements to security technology. 9 exemplifies a privacy guarantee case generated by the privacy guarantee case generating device.

The privacy guarantee case generating unit 140 refers to a previously stored security technology matching table, analyzes the privacy requirements connected to the security attribute goal, and matches the security technology required for the privacy requirements.

Although the components included in the privacy guarantee case generating apparatus are illustrated separately in FIG. 1 , a plurality of components may be coupled to each other and implemented as at least one module. The components are connected to a communication path connecting a software module or a hardware module inside the device to operate organically with each other. These components communicate using one or more communication buses or signal lines.

The privacy guarantee instance generating apparatus may be implemented in a logic circuit by hardware, firmware, software, or a combination thereof, and may be implemented using a general-purpose or special-purpose computer. The device may be implemented using a hardwired device, a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), or the like. In addition, the device may be implemented as a system on chip (SoC) including one or more processors and controllers.

The privacy guarantee instance generating apparatus may be mounted on a computing device provided with hardware elements in the form of software, hardware, or a combination thereof. The computing device may refer to various devices including all or part of a memory for storing data for executing a program, a microprocessor for executing an operation and an instruction by executing the program, and the like.

10 is a flowchart illustrating a method of generating a privacy guarantee case according to another embodiment of the present invention. The method of generating a privacy assurance instance may be performed by a computing device.

In step S1010, the computing device generates a privacy goal for the target system based on a predefined system design principle. The step (S1010) of creating a privacy goal is (i) proactive rather than reactive, (ii) setting revision information protection as a default value, (iii) considering personal information protection from the planning stage, (iv) ensuring comprehensive functionality , (v) full lifecycle protection, (vi) ensuring visibility and transparency, and (vii) respecting individual privacy to create a privacy goal by adhering to the above system design principles.

In step S1020, the computing device generates a security attribute goal corresponding to the privacy goal to match a security technique to be applied to the target system. In the step of generating the security attribute goal ( S1020 ), the security attribute goal is subdivided and generated based on a predefined Fair Information Practice Principle (FIPs) or Privacy Protection Principles.

In step S1030, the computing device generates a privacy requirement necessary for the target system. The step of generating the privacy requirements ( S1030 ) is to extract keywords from the existing privacy requirements for the target system, generate a question for evaluating the existing privacy requirements, and based on the generated question, the existing privacy requirements Modify the existing privacy requirements or add new privacy requirements by verifying the items.

In the step of generating the privacy requirement ( S1030 ), the subject, object, and verb related to personal information are extracted as personal information related keywords from the existing privacy requirements with reference to the keyword thesaurus.

In the step of generating the privacy requirements ( S1030 ), a question for evaluating the existing privacy requirements is formulated using the W5H pattern based on the personal information protection guidelines related to the target system.

The step of generating the privacy requirements (S1030) is to (i) apply, (ii) partially apply, (iii) Not applicable, and (iv) Not applicable.

In step S1040 , the computing device generates a privacy guarantee instance by connecting the privacy trough, the security attribute trough, and the privacy requirement using the graphic notation. In the step (S1040) of creating a privacy guarantee case, a security technology necessary for the privacy requirement is matched by referring to a previously stored security technology matching table, and analyzing the privacy requirement connected to the security attribute goal.

Although it is described that each process is sequentially executed in FIG. 10, this is only an exemplary description, and those skilled in the art change the order described in FIG. Alternatively, various modifications and variations may be applied by executing one or more processes in parallel or adding other processes.

The operations according to the present embodiments may be implemented in the form of program instructions that can be performed through various computer means and recorded in a computer-readable medium. Computer-readable medium represents any medium that participates in providing instructions to a processor for execution. Computer-readable media may include program instructions, data files, data structures, or a combination thereof. For example, there may be a magnetic medium, an optical recording medium, a memory, and the like. A computer program may be distributed over a networked computer system so that computer readable code is stored and executed in a distributed manner. Functional programs, codes, and code segments for implementing the present embodiment may be easily inferred by programmers in the technical field to which the present embodiment pertains.

The present embodiments are for explaining the technical idea of the present embodiment, and the scope of the technical idea of the present embodiment is not limited by these embodiments. The protection scope of this embodiment should be interpreted by the following claims, and all technical ideas within the scope equivalent thereto should be interpreted as being included in the scope of the present embodiment.

100: Privacy Assurance Case Creation Device
110: privacy goal generating unit
120: security attribute goal generator
130: privacy requirements generation unit
140: privacy assurance case generation unit

Claims (16)

A method of generating a privacy assurance case by a computing device, the method comprising:
generating a privacy goal for a target system based on a predefined system design principle;
generating a security attribute goal corresponding to the privacy goal to match a security technique to be applied to the target system;
generating necessary privacy requirements for the target system; and
generating a privacy assurance instance linking the privacy trough, the security attribute trough, and the privacy requirement using graphical notation;
The step of generating the privacy requirement comprises:
Extracting keywords from the existing privacy requirements for the target system, generating a question for evaluating the existing privacy requirements, and verifying the existing privacy requirements based on the generated questions A method for creating a Privacy Assurance Case, comprising amending privacy requirements or adding new privacy requirements. According to claim 1,
The step of generating the privacy goal comprises:
(i) proactive rather than reactive, (ii) set revision information protection as default, (iii) consider privacy protection from the planning stage, (iv) ensure comprehensive functionality, (v) protect the entire lifecycle, ( vi) securing visibility and transparency, and (vii) generating the privacy goal in compliance with the system design principle that respects individual privacy. According to claim 1,
The step of generating the security attribute goal,
A method for generating a privacy guarantee case, characterized in that the security attribute goal is subdivided and generated based on a predefined Fair Information Practice Principle (FIPs) or Privacy Protection Principles. delete According to claim 1,
The step of generating the privacy requirement comprises:
A method for generating a privacy guarantee case, characterized in that the subject, object, and verb related to personal information are extracted as keywords related to personal information from the existing privacy requirements with reference to a keyword thesaurus. According to claim 1,
The step of generating the privacy requirement comprises:
A method for generating a privacy assurance case, characterized in that the question for evaluating the existing privacy requirements is formulated using a W5H pattern based on the privacy guidelines related to the target system. According to claim 1,
The step of generating the privacy requirement comprises:
(i) apply, (ii) partially apply, (iii) non-applicable, and (iv) the above privacy goal using a question generated based on the rules that are obligatory under the privacy laws related to the target system. A method for generating a privacy assurance case, characterized in that the evaluation is classified as not applicable. According to claim 1,
The step of creating the privacy guarantee case comprises:
A method for generating a privacy guarantee case, characterized in that referring to a previously stored security technology matching table, and analyzing the privacy requirements connected to the security attribute goal to match a security technology required for the privacy requirements. a privacy goal generating unit that generates a privacy goal for a target system based on a predefined system design principle;
a security attribute goal generating unit that generates a security attribute goal corresponding to the privacy goal in order to match a security technique to be applied to the target system;
a privacy requirement generating unit that generates a privacy requirement necessary for the target system; and
A privacy guarantee case generating unit for generating a privacy guarantee case connecting the privacy goal, the security attribute goal, and the privacy requirement by using a graphic notation,
The privacy requirement generating unit,
Extracting keywords from the existing privacy requirements for the target system, generating a question for evaluating the existing privacy requirements, and verifying the existing privacy requirements based on the generated questions A privacy assurance case creation device, characterized in that it modifies privacy requirements or adds new privacy requirements. 10. The method of claim 9,
The privacy goal generating unit,
(i) proactive rather than reactive, (ii) set revision information protection as default, (iii) consider privacy protection from the planning stage, (iv) ensure comprehensive functionality, (v) protect the entire lifecycle, ( vi) securing visibility and transparency, and (vii) generating the privacy goal in compliance with the system design principle that respects individual privacy. 10. The method of claim 9,
The security attribute goal generating unit,
A privacy guarantee case generating apparatus, characterized in that the security attribute goal is subdivided and generated based on a predefined Fair Information Practice Principle (FIPs) or Privacy Protection Principles. delete 10. The method of claim 9,
The privacy requirement generating unit,
A privacy guarantee case generating apparatus, characterized in that the subject, object, and verb related to personal information are extracted as keywords related to personal information from the existing privacy requirements with reference to the keyword thesaurus. 10. The method of claim 9,
The privacy requirement generating unit,
A privacy assurance case generating device, characterized in that it formulates a question for evaluating the existing privacy requirements using a W5H pattern based on the privacy guidelines related to the target system. 10. The method of claim 9,
The privacy requirement generating unit,
(i) apply, (ii) partially apply, (iii) non-applicable, and (iv) the above privacy goal using a question generated based on the rules that are obligatory under the privacy laws related to the target system. A privacy assurance case generating device, characterized in that the evaluation is classified as not applicable. 10. The method of claim 9,
The privacy guarantee case generation unit,
A privacy guarantee case generating apparatus, characterized in that by referring to a pre-stored security technology matching table, and analyzing the privacy requirements connected to the security attribute goal, a security technology necessary for the privacy requirements is matched.

Images