Privacy can sufficiently be protected at the interaction level

level

The proposed framework provides the protection mechanisms at the interaction level. It extends the interaction protocol with essential messages and sequences to protect the sensitive information that is shared or disclosed in the original interaction protocol.

Theorem 3: For any incomplete knowledge CDS where entities adopt message-based interaction, P-Model can be sufficiently addressed at the interaction level.

To provide the supporting materials for the above theorem, it is essential that we prove the following points:

 All the information that is shared or disclosed to other entities are decided at the interaction level

 Any class of privacy protection mechanism happens at the interaction level. The computation entity in CDS has autonomy on coordinating activities with others. The interaction layer manages the necessary processes to identify the adequate messages to communicate to resolve the interdependency problem. The communication layer is responsible for exchanging messages. However, it does not have the decision-making authority on the messages to be sent and it is not aware of the intent that initiates the exchange of messages.

Lemma 1: Let 𝑒𝑖 ≡< 𝐾𝑖, 𝑃𝑆𝑖, 𝐼𝑛𝑖, 𝐶𝑜𝑚𝑖 > be the computation entity. For any information

𝐼_𝑖,𝑟 that is going to be shared with 𝑒_𝑗, 𝑆(𝐼_𝑖,𝑟, 𝑒_𝑗) is decided in 𝐼𝑛_𝑖

If 𝑃𝑆𝑖 realizes that to achieve a goal, there is interdependency problem, 𝐼𝑛𝑖 finds a coordination solution 𝐶𝑆_𝑖,𝑗with an entity such as 𝑒_𝑗 .

If 𝐼_𝑖,𝑟 is shared with 𝑒_𝑗,

∃ 𝐼𝑖,𝑟, ∈ (𝐼𝑖,𝑟, 𝐼𝑖𝑘)|𝑆(𝐼𝑖,𝑟, 𝑒𝑗)

Then there are two possibilities:

1. It is discovered at 𝑃𝑆𝑖 that 𝐼𝑖,𝑟is required to perform the 𝐶𝑆𝑖,𝑗 therefore

𝐶𝑆_𝑖,𝑗 → 𝑆(𝐼_𝑖,𝑟, 𝑒_𝑗)

2. It is discovered at 𝐼𝑛𝑖 that 𝐼𝑖,𝑟 has to be shared with 𝑒𝑗

𝐼𝑛_𝑖 → 𝑆(𝐼_𝑖,𝑟, 𝑒_𝑗)

In both cases, the shared information is processed and decided by the interaction layer.

Lemma 2: Let 𝐼_𝑖,𝑟 be the information that is disclosed. For any 𝐼_𝑖,𝑟 there is explicit information that is shared

∃ 𝐼𝑖,𝑟, 𝑒𝑗 , ∈ (𝐼𝑖,𝑟, 𝐼𝑖𝑘)| 𝐷(𝐼𝑖,𝑟, 𝑒𝑗)

When information is implicitly disclosed:

𝐷(𝐼_𝑖,𝑟, 𝑒_𝑗) → ∃ 𝐼_𝑖,𝑟′, 𝑜_𝑗,𝑤| 𝑜_𝑗,𝑤(𝐼_𝑖,𝑟′, 𝐼𝑎𝑢𝑥)

Assuming 𝐼_𝑖,𝑟′ is not shared through interaction. Then there are two possibilities:

1. Fact A: 𝐼_𝑖,𝑟′ is an auxiliary information disseminated by a third party 𝑒_𝑡 then:

If 𝐼_𝑖,𝑟′ is shared to 𝑒_𝑡, then it has been decided at interaction

2. 𝐼_𝑖,𝑟′ is not shared with any entity, therefore:

a. Either 𝐷(𝐼_𝑖,𝑟′, 𝑒_𝑡) so that Fact A occurs

b. Or it has not been shared by interaction. This contradicts Lemma 1.

This proves that any information that is shared or disclosed has initiated sharing point at the interaction.

In equation 8, Privacy protection in privacy model is defined as :

PP(e_j, (PS(I_i)), Ô_j) ≡ ∀ t , w| ⊂ (t, PS(I_i)) ∧ ô̿̃ _j,wt _(t)

To achieve ô̿̃ , the privacy protection mechanisms are applied. The privacy _j,wt _(t)

protection mechanisms can be classified at information or operation level.

Lemma 3: If a preventive protection mechanism at information exists, it happens at the interaction.

Let 𝜇 be a preventive mechanism at information level for protecting 𝐼𝑠_(𝐼

𝑖,𝑟, 𝑒𝑗) in

which enables ô̿̃ . _j,wt _(t)

𝜇̿ → PP (ej, {Ii,r}, ô̿̃ ) j,wt (t)

In Equation 10,

𝜇 ≡< 𝐼𝜇, 𝑂𝜇 >

𝑂𝜇 = {𝑜𝑚,1, … , 𝑜𝑚,𝑑, … , 𝑜𝑚,𝐷} , 1 ≤ 𝑑 ≤ 𝐷

Based on the execution of preventive protection mechanisms at information level in equation 11:

𝑜̿𝑚,𝐷(𝑜̿𝑚,𝐷−1(𝑜̿𝑚,𝐷−2(I_𝑖,k) (𝑜̿𝑚,𝐷−3(I_𝑖,k) (… (𝑜̿𝑚,1(I_𝑖,k)))))) = 𝐼𝜇

This results in sharing information that is manipulated by the operations in protection mechanisms.

𝜇̿ → 𝑆(𝐼_𝑖,𝑟′, 𝑒_𝑗)

Based on Lemma 1, 𝐼_𝑖,𝑟′has to go through interactions. Therefore, the preventive

mechanisms at the information level can happen at the interaction level.

Lemma 4: If a preventive mechanism at operation level exists, it happens at interaction level

Let 𝐼𝑖,𝑟be the sensitive information that can implicitly be disclosed to 𝑒𝑗 through

𝑜̂_𝑗,𝑤𝑡 when 𝐼_𝑖,𝑟′ is shared.

∃ 𝐼_𝑖,𝑟, 𝐼_𝑖,𝑟′, 𝑒_𝑗, 𝑜̂_𝑗,𝑤𝑡 | 𝐼𝑠(𝐼_𝑖,𝑟, 𝑒_𝑗, 𝑜̂_𝑗,𝑤𝑡 ) ∧ 𝑜̂_𝑗,𝑤𝑡 (𝐼_𝑖,𝑟′, 𝐼𝑎𝑢𝑥) ≡ 𝐼_𝑖,𝑟 ∧ 𝑆(𝐼_𝑖,𝑟′, 𝑒_𝑗)

Let 𝜇 be the protection mechanism at the operation level that can protect 𝐼𝑖,𝑟.

𝜇 ≡< 𝐼𝜇, 𝑂𝜇 >

𝑂𝜇 = {𝑜𝑚,1, … , 𝑜𝑚,𝑑, … , 𝑜𝑚,𝐷} , 1 ≤ 𝑑 ≤ 𝐷

Based on the execution of the protection mechanisms at the operation:

𝑜̿𝑚,𝐷({𝑜𝑗,𝑤, 𝑜̿𝑚,𝐷−1({𝑜𝑗,𝑤, 𝑜̿𝑚,𝐷−2({𝑜𝑗,𝑤, … , 𝑜̿𝑚,1(𝑜𝑗,𝑤, I𝑖,r)})})})

= { ∅ 𝑖𝑓 ∈ (𝑜𝑗,𝑤, 𝑂̂𝑗

𝑖₎

I_𝑖,r" 𝑖𝑓 ∉ (𝑜_𝑗,𝑤, 𝑂̂_𝑗𝑖)

which results in sharing I_𝑖,r" or ∅. Therefore, based on Lemma 1, it happens at the interaction level.

Lemma 5: if there is punishing privacy protection mechanisms, it happens at the interaction level.

Let 𝜇 ≡< 𝐼𝜇, 𝑂𝜇 > be the punishing protection mechanism that protects 𝐼𝑠(𝐼_𝑖,𝑟, 𝑒_𝑗). Based on the execution of punishing mechanisms in equation 13:

∀ 𝑡,

𝑜

̂_𝑗,𝑡𝑖,𝑘| o̿̿̿̿̿̿ ({m,D

𝑜

_̂ 𝑗,𝑡 𝑖,𝑘 , o̿̿̿̿̿̿̿̿̿({m,D−1

𝑜

_̂ 𝑗,𝑡 𝑖,𝑘 , o̿̿̿̿̿̿̿̿̿(m,D−2

𝑜

_̂ 𝑗,𝑡 𝑖,𝑘 , … , o̿̿̿̿̿̿(m,1

𝑜

_̂ 𝑗,𝑡 𝑖,𝑘 )})})}) ≡ 𝐼𝜇

The generated information in this mechanism is shared with the entity that has executed the non-authorized operations.

𝜇̿ → 𝑆(𝐼𝜇, 𝑒𝑗)

This indicates that the punishing mechanisms happen at the interaction level.

Given Lemma 1, Lemma 2, Lemma 3, Lemma 4 and Lemma 5, it is proven that any protection mechanisms will be applied at the interaction level. Therefore, it is sufficient to capture the privacy protection at the interaction level.

In document Privacy in Cooperative Distributed Systems: Modeling and Protection Framework (Page 71-75)