论文标题
转换隐私合规性数据流程图（长版）
Transforming Data Flow Diagrams for Privacy Compliance (Long Version)
论文作者
论文摘要
最近的法规，例如《欧洲一般数据保护法规》（GDPR），对个人数据处理的严格约束。与安全性一样，隐私是一种非功能属性，但大多数软件设计工具都集中在功能方面，例如数据流程图（DFDS）。在以前的工作中，引入了概念模型，其中DFD可以扩展到所谓的隐私感知数据流程图（PA-DFDS），目的是将特定的隐私检查添加到现有DFD中。在本文中，我们提供了一种明确的算法和概念验证实现，以将DFD转换为PA-DFD。我们的工具为软件工程师提供了系统地插入设计过程中的隐私检查的关键但容易出错的任务（我们的工具会自动添加它们），同时仍允许他们检查和编辑。如有必要，PA-DFD。我们还确定并解决了先前工作提出的高级转型中的歧义和错误。我们将方法应用于建筑和在线零售领域的两个现实应用程序。
Recent regulations, such as the European General Data Protection Regulation (GDPR), put stringent constraints on the handling of personal data. Privacy, like security, is a non-functional property, yet most software design tools are focused on functional aspects, using for instance Data Flow Diagrams (DFDs). In previous work, a conceptual model was introduced where DFDs could be extended into so-called Privacy-Aware Data Flow Diagrams (PA-DFDs) with the aim of adding specific privacy checks to existing DFDs. In this paper, we provide an explicit algorithm and a proof-of-concept implementation to transform DFDs into PA-DFDs. Our tool assists software engineers in the critical but error-prone task of systematically inserting privacy checks during design (they are automatically added by our tool) while still allowing them to inspect and edit the. PA-DFD if necessary. We have also identified and addressed ambiguities and inaccuracies in the high-level transformation proposed in previous work. We apply our approach to two realistic applications from the construction and online retail sectors.
