# Obtaining P3P Privacy Policies for Composite Services

Authors: Yi Sun; Zhiqiu Huang; Changbo Ke
Journal: The Scientific World Journal
 (2014)

---

## Abstract

With the development of web services technology, web services have changed from single to composite services. Privacy protection in composite services is becoming an important issue. P3P (platform for privacy preferences) is a privacy policy language which was designed for single web services. It enables service providers to express how they will deal with the privacy information of service consumers. In order to solve the problem that P3P cannot be applied to composite services directly, we propose a method to obtain P3P privacy policies for composite services. In this method, we present the definitions ofPurpose, Recipient, and Retention elements as well as Optional and Required attributes for P3P policies of composite services. We also provide an instantiation to illustrate the feasibility of the method.


---

## Body

## 1. Introduction

Nowadays Internet has become one of the major ways for people to get services. More and more people are accustomed to using web services. And with the development of web services technology, web services have changed from single to composite services. Web service composition is an approach to build new composite services by combining existing services. It not only reuses existing web services to improve the efficiency of service development, but also satisfies service consumers’ multifunctional demands. However, whether services are single or composite, service consumers’ privacy information is inevitably collected by service providers. And it is hard for service consumers to control the disclosure of their privacy information. In order to prevent the privacy information from being misused, service providers are requested to publish their privacy policies. Based on the privacy policies published by service providers, service consumers are able to know what service providers will do with their privacy information.P3P (platform for privacy preferences) [1] was released by World Wide Web Consortium (W3C) in April 2002. It provides a standard and machine-understandable privacy policy. W3C also designs APPEL (A P3P Preference Exchange Language) [2] which allows service consumers to specify their privacy preferences. A P3P user agent can compare the P3P policies of service providers with the privacy preferences of service consumers. The comparison results enable the service consumers to decide whether to use the services or not. Since P3P was originally designed for single services, it cannot be applied for composite services directly. A composite service may consist of several independent web services which are called member services. All these member services have their own P3P policies which may specify different privacy practices of the same private data. How to isolate these discrepancies is one challenge. How to obtain the P3P policy for a composite service consisting of several services is another challenge.In this paper, we firstly present the definitions ofPurpose,Recipient, andRetention elements as well asOptional andRequired attributes for P3P policies of composite services. Secondly, based on these definitions, we obtain P3P privacy policies for composite services. Finally, we provide an instantiation to illustrate how to obtain a P3P privacy policy of a composite service concretely.The rest of this paper is organized as follows. Section2 describes the syntax of P3P privacy policy. Section 3 proposes a method to obtain P3P privacy policies for composite services by defining thePurpose,Recipient, andRetention elements as well as theOptional andRequired attributes for P3P policies of composite services. A case study is presented to prove the feasibility of the method in Section 4. Related work is discussed in Section 5. Section 6 concludes the paper.


## 2. P3P Syntax

P3P privacy policies inform service consumers how service providers will deal with their privacy information. The overall structure of a P3P policy is shown in Algorithm1. A P3P privacy policy is described byPolicy consisting of anEntity element, anAccess element, aDisputes-Group element, zero or moreExtension elements, and one or moreStatement elements.Entity gives a precise description of the legal entity making the representation of the privacy practices.Access indicates whether the site provides access to various kinds of information.Dispute-Group describes dispute resolution procedures that may be followed for disputes about a service’s privacy practices.Algorithm 1:The P3P policy structure and an example P3P policy from http://www.walmart.com/ (the structure of P3P privacy policy).
Policy{Entity, Access, Disputes-Group,
Statement(s) {Purpose[Required],
Recipient[Required],
Retention,
Data-Group{
Data [Optional]{
Categories}}}}Statement is the core of P3P privacy policy. It describes how a website collects and uses the private data of service consumers.Statement comprisesPurpose,Recipient,Retention, andData-Group elements.Purpose states for what purpose the private data of service consumers may be used. It has six predefined values such ascurrent,admin, anddevelop.Recipient describes to whom the private data of service consumers will be exposed.Retention states how long the private data of service consumers will be retained by service providers.Data-Group contains a list of private data (Data element) of service consumers which may be collected by service providers and data categories (Categories element). Moreover,Data,Purpose, andRecipient are either optional or mandatory by taking an optional attribute calledOptional for the former andRequired for the latter two. The value ofOptional is eitherno (default value) when the data must be collected oryes when the data is optional. The value ofRequired can bealways (default value),opt-out, oropt-in.Always means the purpose/recipient is always needed.Opt-out means the data may be used for the purpose/may be distributed to the recipient unless the user requests that it not be used in this way.Opt-in means the data may be used for the purpose/may be distributed to the recipient only when the user affirmatively requests this use. Algorithm 2 shows an example P3P policy from http://www.walmart.com/ [3].Algorithm 2:The P3P policy structure and an example P3P policy from http://www.walmart.com/ (a P3P policy from walmart.com).
Policy{Entity (#business.name): walmart.com,…,
S1{Purpose: (current, contact [opt-in]),
Recipient: (ours),
Retention: (indefinitely),
Data: (#user.login, #user.home-info)}
S2{Purpose: (current, develop [opt-in], contact [opt-in]),
Recipient: (ours),
Retention: (stated-purpose),
Data: (#user.name, #user.login, #user.home-info)}}


## 3. P3P Policies in Composite Services

Web service composition uses web services, no matter single or composite, as fundamental elements to create new services. It not only reuses existing services but also improves the efficiency of service development. The application of service composition is supported by many techniques, such as BPEL [4] and WSDL [5]. BPEL specifies the internal business process of a composite service. WSDL describes the interfaces of member services. Through these interfaces, member services can be invoked. At present there are many existing approaches to service composition, some of which are abstract methods and some of which aim to be industry standards [6–9].P3P is one of the structured privacy policy languages widely used in the world today [10, 11]. It specifies how service providers will deal with the privacy information of service consumers. However, P3P cannot be applied for composite services directly because it was originally designed for single services. There is a need to research on P3P privacy policies for composite services.Statement element states the way service providers will handle the privacy information of service consumers, which is a top concern to service consumers. Therefore, the main emphasis of our research on P3P privacy policies for composite services is theStatement element. And in aStatement, the major elements areData,Purpose,Recipient, andRetention.As a composite service consists of several member services, the service providers of these member services have their own P3P policies that may specify different privacy practices of the same private data. For example, a composite service called Service A is constituted of three single services, and the P3P privacy policies of these services are called Policy1, Policy2, and Policy3 as shown in Algorithms 3, 4, and 5. From Algorithms 3, 4, and 5 theRetention value of #user.name in Policy1 isindefinitely which means the data is retained for an indeterminate period of time while theRetention value of #user.name in Policy2 isstated-purpose which means the data is retained to meet the stated purpose. ThePurpose value of #user.name in Policy1 iscurrent while thePurpose value of #user.name in Policy2 iscurrent andtelemarketing. TheRecipient value of #user.home-info in Policy2 isours andunrelated while theRecipient value of #user.home-info in Policy3 isours andsame. In addition, theOptional value of #user.name in Policy1 isno which means the data must be collected while theOptional value of #user.name in Policy2 isyes which means the data is optional. Then what are thePurpose,Recipient, andRetention values of #user.name and #user.home-info in the P3P policy of Service A? What are theOptional values of #user.name and #user.home-info? In this connection, we define the values ofPurpose,Recipient, andRetention elements as well as the values ofOptional andRequired attributes for the P3P privacy policies of composite services. Based on these definitions, we can obtain P3P privacy policies for composite services. It should be noted that the semantic associations ofPurpose,Recipient,Retention, andData inStatement are not changed all the time. That is to say, the corresponding relationships amongPurpose,Recipient,Retention, andData keep the same.Algorithm 3:P3P privacy policies of three single services (Policy1).
Policy1{Entity (#business.name): ,…,
S{Purpose: (current),
Recipient: (ours),
Retention: (indefinitely),
Data: (#user.name)}}Algorithm 4:P3P privacy policies of three single services (Policy2).
Policy2{Entity (#business.name): ,…,
S1{Purpose: (current, telemarketing),
Recipient: (ours),
Retention: (stated-purpose),
Data: (#user.name [yes], #user.home-info)}
S2{Purpose: (telemarketing),
Recipient: (unrelated [opt-out]),
Retention: (stated-purpose),
Data: (#user.home-info)}}Algorithm 5:P3P privacy policies of three single services (Policy3).
Policy3{Entity (#business.name): ,…,
S{Purpose: (telemarketing),
Recipient: (ours, same),
Retention: (indefinitely),
Data: (#user.home-info)}}


### 3.1.Purpose Definition

InStatement,Purpose indicates the intended use of privacy information. It has twelve predefined values such ascurrent,admin, anddevelop. When several services are combined into a composite service, their functions have not changed. These services are just reused to form a more powerful service. So when a web service is turned from an independent service to a member service, thePurpose values in its privacy policy do not change. We definePurpose values of aData element in privacy policy of composite service by the union ofPurpose values of theData element in privacy policies of member services. And if aData element is not included in the privacy policy of a member service, we set thePurposevalues of theData element in the service’s privacy policy to be an empty set.Definition 1.
A composite service consists ofn member services. The sets ofPurpose values of aData element in privacy policies of member services are denoted by P, noted as PS1,PS2,…,PSn. The set ofPurpose values of theData element in privacy policy of composite service is denoted by PCS, PCS=PS1∪PS2∪⋯∪PSn.
According to Definition1, we can get the sets ofPurpose values ofData elements in privacy policy of Service A:
(1)PA_user.name=P1_user.name∪P2_user.name∪P3_user.name={current}∪{current,telemarketing}∪∅={current,telemarketing},PA_user.home-info=P1_user.home-info∪P2_user.home-info∪P3_user.home-info=∅∪{current,telemarketing}∪{telemarketing}={current,telemarketing}.


### 3.2.Recipient Definition

In a P3P privacy policy,Recipient element has six predefined values which areours,delivery,same,other-recipient,unrelated, andpublic.Ours refers to the service provider and/or a third party that processes data only on behalf of the service provider for the completion of the stated purposes.Delivery refers to legal entities performing delivery services that may use data for purposes other than completion of the stated purpose.Same represents legal entities that use the data on their own behalf under equable practices.Other-recipient represents legal entities that are constrained by and accountable to the original service provider but may use the data in a way not specified in the service provider’s practices.Unrelated represents legal entities whose data usage practices are not known by the original service provider.Public refers to public fora. In addition toours andpublic, the other four predefined values represent a set of recipients, respectively. These recipients have been known explicitly by service providers. Therefore,delivery,same,other-recipient, andunrelated denote, respectively, the set of delivery services possibly following different practices, the set of legal entities following equable practices, the set of legal entities following different practices, and the set of legal entities whose data usage practices are not known. We define the six predefined values ofRecipient element in privacy policies of composite services as follows.Definition 2.
A composite service consists ofn member services. IfRecipient values of aData element in privacy policies of member services includeours, theRecipient values of theData element in privacy policy of composite service includeours as well.Definition 3.
A composite service consists ofn member services. The sets ofdelivery values of aData element in privacy policies of member services are noted as deliveryS1 , deliveryS2,…,deliverySn. The set ofdelivery values of theData element in privacy policy of composite service is denoted as deliveryCS, deliveryCS=deliveryS1 ∪ deliveryS2∪⋯∪deliverySn.
If aData element is not included in privacy policy of a member service orRecipient values of theData element in privacy policy of a member service do not includedelivery, the set ofdelivery values in the service’s privacy policy is set to be an empty set.Definition 4.
A composite service consists ofn member services. The sets ofsame values of aData element in privacy policies of member services are noted as sameS1,sameS2,…,sameSn. The set ofsame values of theData element in privacy policy of composite service is denoted as sameCS, sameCS=sameS1∪sameS2∪⋯∪sameSn.
If aData element is not included in privacy policy of a member service orRecipient values of theData element in privacy policy of a member service do not includesame, the set ofsame values in the service’s privacy policy is set to be an empty set.Definition 5.
A composite service consists ofn member services. The sets ofother-recipient values of aData element in privacy policies of member services are noted as other-recipientS1,other-recipientS2,…,other-recipientSn. The set ofother-recipient values of theData element in privacy policy of composite service is denoted as other-recipientCS, other-recipientCS=other-recipientS1∪other-recipientS2∪⋯∪other-recipientSn.
If aData element is not included in privacy policy of a member service orRecipient values of theData element in privacy policy of a member service do not includeother-recipient, the set ofother-recipient values in the service’s privacy policy is set to be an empty set.Definition 6.
A composite service consists ofn member services. The sets ofunrelated values of aData element in privacy policies of member services are noted as unrelatedS1,unrelatedS2,…,unrelatedSn. The set ofunrelated values of theData element in privacy policy of composite service is denoted as unrelatedCS, unrelatedCS=unrelatedS1∪unrelatedS2∪⋯∪unrelatedSn.
If aData element is not included in privacy policy of a member service orRecipient values of theData element in privacy policy of a member service do not includeunrelated, the set ofunrelated values in the service’s privacy policy is set to be an empty set.Definition 7.
A composite service consists ofn member services. IfRecipient values of aData element in privacy policies of member services includepublic, theRecipient value of theData element in privacy policy for composite service ispublic. And sameCS=other-recipientCS=unrelatedCS=deliveryCS=∅ will be set.
According to Definitions2~7, we can getRecipient values ofData elements in privacy policy of Service A as shown in Table 1. TheRecipient value of #user.name in privacy policy of Service A is ours. TheRecipientvalues of #user.home-info in privacy policy of Service A are ours, same3_user.home-info, and unrelated2_user.home-info.Table 1
Recipient values of Data elements in Service A.
Recipient
Policy1
Policy2
Policy3
PolicyA
Oursuser.name
Including
Including
Not including
Including
Deliveryuser.name
∅
∅
∅
∅
Sameuser.name
∅
∅
∅
∅
Other-recipientuser.name
∅
∅
∅
∅
Unrelateduser.name
∅
∅
∅
∅
Publicuser.name
Not including
Not including
Not including
Not
Oursuser.home-info
Not including
Including
Including
Including
Deliveryuser.home-info
∅
∅
∅
∅
Sameuser.home-info
∅
∅
Sam
e
3_user.home-info
Sam
e
3_user.home-info
Other-recipientuser.home-info
∅
∅
∅
∅
Unrelateduser.home-info
∅
Unrelate
d
2_user.home-info
∅
Unrelate
d
2_user.home-info
Publicuser.home-info
Not including
Not including
Not including
Not


### 3.3.Retention Definition

In P3P privacy policies,Retention element has five predefined values which areno-retention,stated-purpose,legal-requirement,business-practices, andindefinitely.No-retention means information is not retained for more than a brief period of time necessary to make use of it during the course of a single online interaction.Stated-purpose means information is retained to meet the stated purpose.Legal-requirement means information is retained to meet a stated purpose, but the retention period is longer because of a legal requirement or liability.Business-practices indicates information is retained under a service provider’s stated business practices.Indefinitely indicates information is retained for an indeterminate period of time. When theRetention value isstated-purpose,legal-requirement, orbusiness-practices, service providers will give the specific destruction time. If theRetention value isno-retention, we set the retention time to be zero noted as 0. And if theRetention value isindefinitely, we set the retention time to be infinity noted as∞. We choose the longest retention time of aData element in the privacy policies of member services as the retention time of theData element in privacy policy of composite service. Moreover, we use specific time instead ofstated-purpose,legal-requirement, andbusiness-practices to representRetention values in the privacy policies of composite services. And if aData element is not included in privacy policy of a member service, we set theRetentionvalue of theData element in the service’s privacy policy to be null.Definition 8.
A composite service consists ofn member services. The specific time corresponding to theRetention values of aData element in privacy policies of member services is denoted by T, noted as TS1,TS2,…,TSn. TheRetentionvalue of theData element in privacy policy of composite service is denoted by TCS. If 0<max⁡{TS1,TS2,…,TSn}<∞,TCS=max⁡{TS1,TS2,…,TSn}. If max⁡{TS1,TS2,…,TSn}=0, TCS=no-retention. If max⁡{TS1,TS2,…,TSn}=∞, TCS=indefinitely.
TheRetentionvalues of #user.name and #user.home-info in privacy policies of member services are showed in Table 2. According to Definition 8, we can getRetention values ofData elements in privacy policy of Service A as follows:
(2)TA_user.name=max⁡{T1_user.name,T2_user.name,T3_user.name}=∞=indefinitely,TA_user.home-info=max⁡{T1_user.home-info,T2_user.home-info,T3_user.home-info}=∞=indefinitely.Table 2
Retention values of Data elements in member services.
Retention
Policy1
Policy2
Policy3
T
user.name
∞
20 days
Null
T
user.home-info
Null
10 days
∞


### 3.4. Attributes Definition

In a P3P privacy policy,Data,Purpose, andRecipientelements can take an optional attribute calledOptional for the former andRequired for the latter two. TheOptional value is eitherno when the data is needed oryes when the data is optional. And if theOptional value of data is not explicitly specified, theOptional value of the data will take the default value (no). TheRequiredvalue forPurpose elements can bealways, opt-in, oropt-out. Always means the purpose is always required.Opt-in means data may be used for the purpose only when the user affirmatively requests this use.Opt-out means data may be used for the purpose unless the user requests that it not be used in this way. And if theRequired value of a purpose is not explicitly specified, theRequired value of the purpose will take the default value (Always). TheRequiredvalue forRecipient elements with the exception ofours can bealways, opt-in, oropt-out. Always means the recipient is always required.Opt-in means data may be distributed to the recipient only when the user affirmatively requests this use.Opt-out means data may be distributed to the recipient unless the user requests that it not be used in this way. And if theRequired value of a recipient is not explicitly specified, theRequired value of the recipient will take the default value (Always). We define the values ofOptional andRequired attributes in privacy policies of composite services as follows.Definition 9.
A composite service consists ofn member services. TheOptional values of aDataelement in privacy policies of member services are denoted by O, noted as OS1,OS2,…,OSn. TheOptionalvalue of theData element in privacy policy of composite service is denoted by OCS. If one of OS1,OS2,…,OSn isno, then OCS isno; otherwise OCS isyes.
If aData element is not included in privacy policy of a member service, theOptional value of theData element in the service’s privacy policy is set to be null.Definition 10.
A composite service consists ofn member services. TheRequired values of aPurpose value in privacy policies of member services are denoted by Req, noted as ReqS1,ReqS2,…,ReqSn. TheRequiredvalue of thePurpose value in privacy policy of composite service is denoted by ReqCS. If one of ReqS1,ReqS2,…,ReqSn isalways, then ReqCS isalways. If all of ReqS1,ReqS2,…,ReqSn areopt-in, then ReqCS isopt-in. Otherwise ReqCS isopt-out.
If aPurpose value is not included in the privacy policy of a member service, theOptional value of thePurpose value in the service’s privacy policy is set to be null.Definition 11.
A composite service consists ofn member services. If aRecipient value is notours orpublic, theRequired value of theRecipientvalue in privacy policy of composite service is the same as the value in privacy policies of member services.
If aRecipientvalue is not included in privacy policies of member services, theRequiredvalue of theRecipient value in privacy policy of composite service is set to be null.Definition 12.
A composite service consists ofn member services. TheRequired value ofpublic in privacy policies of member services is denoted by Red, noted as RedS1,RedS2,…,RedSn. TheRequiredvalue ofpublic in privacy policy of composite service is denoted by RedCS. If one of RedS1,RedS2,…,RedSn isalways, then RedCS isalways. If all of RedS1,RedS2,…,RedSn areopt-in, then RedCS isopt-in. Otherwise RedCS isopt-out.
Ifpublic is not included in privacy policy of a member service, theRequired value ofpublic in the service’s privacy policy is set to be null.
According to Definition9, we can getOptional values ofData elements in privacy policy of Service A as shown in Table 3. TheOptional value of #user.name in privacy policy of Service A is no. TheOptional value of #user.home-info in privacy policy of Service A is no.
According to Definition10, we can getRequired values ofPurpose values in privacy policy of Service A as shown in Table 4. TheRequired values ofPurpose values in privacy policy of Service A are all always.
According to Definitions11~12, we can getRequired values ofRecipient values in privacy policy of Service A as shown in Table 5. TheRequiredvalue of same3_user.home-info in privacy policy of Service A is always. TheRequiredvalue of unrelated2_user.home-info in privacy policy of Service A is opt-out.
By Definitions1~12, we have got thePurpose values,Recipient values,Retention values, andOptional values ofData elements in Service A as well as theRequired values ofPurpose andRecipient elements. On the basis of the semantic associations ofPurpose,Recipient,Retention, andDataelements, we can obtain the P3P privacy policy for Service A as shown in Algorithm 6.Table 3
Optional values of Data elements in Service A.
Data
Policy1
Policy2
Policy3
PolicyA
User.name
No
Yes
Null
No
User.home-info
Null
No
No
NoTable 4
Required values of Purpose values in Service A.
Purpose
Policy1
Policy2
Policy3
PolicyA
Current
Always
Always
Null
Always
Telemarketing
Null
Always
Always
AlwaysTable 5
Required values of Recipient values in Service A.
Recipient
Policy1
Policy2
Policy3
PolicyA
Sam
e
3
_
user.home-info
Null
Null
Always
Always
U
nrelated
2
_
user.home-info
Null
Opt-out
Null
Opt-outAlgorithm 6:P3P privacy policy for Service A.
Policy{Entity (#business.name):,…,
S1{Purpose: (current, telemarketing),
Recipient: (ours),
Retention: (indefinitely),
Data: (#user.name, #user.home-info)}
S2{Purpose: (telemarketing),
Recipient: (same3_user.home-info, unrelated2_user.home-info [opt-out]),
Retention: (indefinitely),
Data: (#user.home-info)}}


## 3.1.Purpose Definition

InStatement,Purpose indicates the intended use of privacy information. It has twelve predefined values such ascurrent,admin, anddevelop. When several services are combined into a composite service, their functions have not changed. These services are just reused to form a more powerful service. So when a web service is turned from an independent service to a member service, thePurpose values in its privacy policy do not change. We definePurpose values of aData element in privacy policy of composite service by the union ofPurpose values of theData element in privacy policies of member services. And if aData element is not included in the privacy policy of a member service, we set thePurposevalues of theData element in the service’s privacy policy to be an empty set.Definition 1.
A composite service consists ofn member services. The sets ofPurpose values of aData element in privacy policies of member services are denoted by P, noted as PS1,PS2,…,PSn. The set ofPurpose values of theData element in privacy policy of composite service is denoted by PCS, PCS=PS1∪PS2∪⋯∪PSn.
According to Definition1, we can get the sets ofPurpose values ofData elements in privacy policy of Service A:
(1)PA_user.name=P1_user.name∪P2_user.name∪P3_user.name={current}∪{current,telemarketing}∪∅={current,telemarketing},PA_user.home-info=P1_user.home-info∪P2_user.home-info∪P3_user.home-info=∅∪{current,telemarketing}∪{telemarketing}={current,telemarketing}.


## 3.2.Recipient Definition

In a P3P privacy policy,Recipient element has six predefined values which areours,delivery,same,other-recipient,unrelated, andpublic.Ours refers to the service provider and/or a third party that processes data only on behalf of the service provider for the completion of the stated purposes.Delivery refers to legal entities performing delivery services that may use data for purposes other than completion of the stated purpose.Same represents legal entities that use the data on their own behalf under equable practices.Other-recipient represents legal entities that are constrained by and accountable to the original service provider but may use the data in a way not specified in the service provider’s practices.Unrelated represents legal entities whose data usage practices are not known by the original service provider.Public refers to public fora. In addition toours andpublic, the other four predefined values represent a set of recipients, respectively. These recipients have been known explicitly by service providers. Therefore,delivery,same,other-recipient, andunrelated denote, respectively, the set of delivery services possibly following different practices, the set of legal entities following equable practices, the set of legal entities following different practices, and the set of legal entities whose data usage practices are not known. We define the six predefined values ofRecipient element in privacy policies of composite services as follows.Definition 2.
A composite service consists ofn member services. IfRecipient values of aData element in privacy policies of member services includeours, theRecipient values of theData element in privacy policy of composite service includeours as well.Definition 3.
A composite service consists ofn member services. The sets ofdelivery values of aData element in privacy policies of member services are noted as deliveryS1 , deliveryS2,…,deliverySn. The set ofdelivery values of theData element in privacy policy of composite service is denoted as deliveryCS, deliveryCS=deliveryS1 ∪ deliveryS2∪⋯∪deliverySn.
If aData element is not included in privacy policy of a member service orRecipient values of theData element in privacy policy of a member service do not includedelivery, the set ofdelivery values in the service’s privacy policy is set to be an empty set.Definition 4.
A composite service consists ofn member services. The sets ofsame values of aData element in privacy policies of member services are noted as sameS1,sameS2,…,sameSn. The set ofsame values of theData element in privacy policy of composite service is denoted as sameCS, sameCS=sameS1∪sameS2∪⋯∪sameSn.
If aData element is not included in privacy policy of a member service orRecipient values of theData element in privacy policy of a member service do not includesame, the set ofsame values in the service’s privacy policy is set to be an empty set.Definition 5.
A composite service consists ofn member services. The sets ofother-recipient values of aData element in privacy policies of member services are noted as other-recipientS1,other-recipientS2,…,other-recipientSn. The set ofother-recipient values of theData element in privacy policy of composite service is denoted as other-recipientCS, other-recipientCS=other-recipientS1∪other-recipientS2∪⋯∪other-recipientSn.
If aData element is not included in privacy policy of a member service orRecipient values of theData element in privacy policy of a member service do not includeother-recipient, the set ofother-recipient values in the service’s privacy policy is set to be an empty set.Definition 6.
A composite service consists ofn member services. The sets ofunrelated values of aData element in privacy policies of member services are noted as unrelatedS1,unrelatedS2,…,unrelatedSn. The set ofunrelated values of theData element in privacy policy of composite service is denoted as unrelatedCS, unrelatedCS=unrelatedS1∪unrelatedS2∪⋯∪unrelatedSn.
If aData element is not included in privacy policy of a member service orRecipient values of theData element in privacy policy of a member service do not includeunrelated, the set ofunrelated values in the service’s privacy policy is set to be an empty set.Definition 7.
A composite service consists ofn member services. IfRecipient values of aData element in privacy policies of member services includepublic, theRecipient value of theData element in privacy policy for composite service ispublic. And sameCS=other-recipientCS=unrelatedCS=deliveryCS=∅ will be set.
According to Definitions2~7, we can getRecipient values ofData elements in privacy policy of Service A as shown in Table 1. TheRecipient value of #user.name in privacy policy of Service A is ours. TheRecipientvalues of #user.home-info in privacy policy of Service A are ours, same3_user.home-info, and unrelated2_user.home-info.Table 1
Recipient values of Data elements in Service A.
Recipient
Policy1
Policy2
Policy3
PolicyA
Oursuser.name
Including
Including
Not including
Including
Deliveryuser.name
∅
∅
∅
∅
Sameuser.name
∅
∅
∅
∅
Other-recipientuser.name
∅
∅
∅
∅
Unrelateduser.name
∅
∅
∅
∅
Publicuser.name
Not including
Not including
Not including
Not
Oursuser.home-info
Not including
Including
Including
Including
Deliveryuser.home-info
∅
∅
∅
∅
Sameuser.home-info
∅
∅
Sam
e
3_user.home-info
Sam
e
3_user.home-info
Other-recipientuser.home-info
∅
∅
∅
∅
Unrelateduser.home-info
∅
Unrelate
d
2_user.home-info
∅
Unrelate
d
2_user.home-info
Publicuser.home-info
Not including
Not including
Not including
Not


## 3.3.Retention Definition

In P3P privacy policies,Retention element has five predefined values which areno-retention,stated-purpose,legal-requirement,business-practices, andindefinitely.No-retention means information is not retained for more than a brief period of time necessary to make use of it during the course of a single online interaction.Stated-purpose means information is retained to meet the stated purpose.Legal-requirement means information is retained to meet a stated purpose, but the retention period is longer because of a legal requirement or liability.Business-practices indicates information is retained under a service provider’s stated business practices.Indefinitely indicates information is retained for an indeterminate period of time. When theRetention value isstated-purpose,legal-requirement, orbusiness-practices, service providers will give the specific destruction time. If theRetention value isno-retention, we set the retention time to be zero noted as 0. And if theRetention value isindefinitely, we set the retention time to be infinity noted as∞. We choose the longest retention time of aData element in the privacy policies of member services as the retention time of theData element in privacy policy of composite service. Moreover, we use specific time instead ofstated-purpose,legal-requirement, andbusiness-practices to representRetention values in the privacy policies of composite services. And if aData element is not included in privacy policy of a member service, we set theRetentionvalue of theData element in the service’s privacy policy to be null.Definition 8.
A composite service consists ofn member services. The specific time corresponding to theRetention values of aData element in privacy policies of member services is denoted by T, noted as TS1,TS2,…,TSn. TheRetentionvalue of theData element in privacy policy of composite service is denoted by TCS. If 0<max⁡{TS1,TS2,…,TSn}<∞,TCS=max⁡{TS1,TS2,…,TSn}. If max⁡{TS1,TS2,…,TSn}=0, TCS=no-retention. If max⁡{TS1,TS2,…,TSn}=∞, TCS=indefinitely.
TheRetentionvalues of #user.name and #user.home-info in privacy policies of member services are showed in Table 2. According to Definition 8, we can getRetention values ofData elements in privacy policy of Service A as follows:
(2)TA_user.name=max⁡{T1_user.name,T2_user.name,T3_user.name}=∞=indefinitely,TA_user.home-info=max⁡{T1_user.home-info,T2_user.home-info,T3_user.home-info}=∞=indefinitely.Table 2
Retention values of Data elements in member services.
Retention
Policy1
Policy2
Policy3
T
user.name
∞
20 days
Null
T
user.home-info
Null
10 days
∞


## 3.4. Attributes Definition

In a P3P privacy policy,Data,Purpose, andRecipientelements can take an optional attribute calledOptional for the former andRequired for the latter two. TheOptional value is eitherno when the data is needed oryes when the data is optional. And if theOptional value of data is not explicitly specified, theOptional value of the data will take the default value (no). TheRequiredvalue forPurpose elements can bealways, opt-in, oropt-out. Always means the purpose is always required.Opt-in means data may be used for the purpose only when the user affirmatively requests this use.Opt-out means data may be used for the purpose unless the user requests that it not be used in this way. And if theRequired value of a purpose is not explicitly specified, theRequired value of the purpose will take the default value (Always). TheRequiredvalue forRecipient elements with the exception ofours can bealways, opt-in, oropt-out. Always means the recipient is always required.Opt-in means data may be distributed to the recipient only when the user affirmatively requests this use.Opt-out means data may be distributed to the recipient unless the user requests that it not be used in this way. And if theRequired value of a recipient is not explicitly specified, theRequired value of the recipient will take the default value (Always). We define the values ofOptional andRequired attributes in privacy policies of composite services as follows.Definition 9.
A composite service consists ofn member services. TheOptional values of aDataelement in privacy policies of member services are denoted by O, noted as OS1,OS2,…,OSn. TheOptionalvalue of theData element in privacy policy of composite service is denoted by OCS. If one of OS1,OS2,…,OSn isno, then OCS isno; otherwise OCS isyes.
If aData element is not included in privacy policy of a member service, theOptional value of theData element in the service’s privacy policy is set to be null.Definition 10.
A composite service consists ofn member services. TheRequired values of aPurpose value in privacy policies of member services are denoted by Req, noted as ReqS1,ReqS2,…,ReqSn. TheRequiredvalue of thePurpose value in privacy policy of composite service is denoted by ReqCS. If one of ReqS1,ReqS2,…,ReqSn isalways, then ReqCS isalways. If all of ReqS1,ReqS2,…,ReqSn areopt-in, then ReqCS isopt-in. Otherwise ReqCS isopt-out.
If aPurpose value is not included in the privacy policy of a member service, theOptional value of thePurpose value in the service’s privacy policy is set to be null.Definition 11.
A composite service consists ofn member services. If aRecipient value is notours orpublic, theRequired value of theRecipientvalue in privacy policy of composite service is the same as the value in privacy policies of member services.
If aRecipientvalue is not included in privacy policies of member services, theRequiredvalue of theRecipient value in privacy policy of composite service is set to be null.Definition 12.
A composite service consists ofn member services. TheRequired value ofpublic in privacy policies of member services is denoted by Red, noted as RedS1,RedS2,…,RedSn. TheRequiredvalue ofpublic in privacy policy of composite service is denoted by RedCS. If one of RedS1,RedS2,…,RedSn isalways, then RedCS isalways. If all of RedS1,RedS2,…,RedSn areopt-in, then RedCS isopt-in. Otherwise RedCS isopt-out.
Ifpublic is not included in privacy policy of a member service, theRequired value ofpublic in the service’s privacy policy is set to be null.
According to Definition9, we can getOptional values ofData elements in privacy policy of Service A as shown in Table 3. TheOptional value of #user.name in privacy policy of Service A is no. TheOptional value of #user.home-info in privacy policy of Service A is no.
According to Definition10, we can getRequired values ofPurpose values in privacy policy of Service A as shown in Table 4. TheRequired values ofPurpose values in privacy policy of Service A are all always.
According to Definitions11~12, we can getRequired values ofRecipient values in privacy policy of Service A as shown in Table 5. TheRequiredvalue of same3_user.home-info in privacy policy of Service A is always. TheRequiredvalue of unrelated2_user.home-info in privacy policy of Service A is opt-out.
By Definitions1~12, we have got thePurpose values,Recipient values,Retention values, andOptional values ofData elements in Service A as well as theRequired values ofPurpose andRecipient elements. On the basis of the semantic associations ofPurpose,Recipient,Retention, andDataelements, we can obtain the P3P privacy policy for Service A as shown in Algorithm 6.Table 3
Optional values of Data elements in Service A.
Data
Policy1
Policy2
Policy3
PolicyA
User.name
No
Yes
Null
No
User.home-info
Null
No
No
NoTable 4
Required values of Purpose values in Service A.
Purpose
Policy1
Policy2
Policy3
PolicyA
Current
Always
Always
Null
Always
Telemarketing
Null
Always
Always
AlwaysTable 5
Required values of Recipient values in Service A.
Recipient
Policy1
Policy2
Policy3
PolicyA
Sam
e
3
_
user.home-info
Null
Null
Always
Always
U
nrelated
2
_
user.home-info
Null
Opt-out
Null
Opt-outAlgorithm 6:P3P privacy policy for Service A.
Policy{Entity (#business.name):,…,
S1{Purpose: (current, telemarketing),
Recipient: (ours),
Retention: (indefinitely),
Data: (#user.name, #user.home-info)}
S2{Purpose: (telemarketing),
Recipient: (same3_user.home-info, unrelated2_user.home-info [opt-out]),
Retention: (indefinitely),
Data: (#user.home-info)}}


## 4. Case Study

Consider an online travel broker service named TravelBroker. The TravelBroker service consists of FlightBooking, HotelReservation, and Payment services. People can book plane tickets, reserve hotel rooms, and pay online through TravelBroker. The P3P privacy policies of FlightBooking service, HotelReservation service, and Payment service are called Policy1, Policy2, and Policy3, respectively, as shown in Algorithms 7, 8, and 9. Next we will show how to obtain P3P privacy policy for TravelBroker.Algorithm 7:P3P policies of FlightBooking service, HotelReservation service, and Payment service (P3P policy of FlightBooking service).
Policy1{Entity (#business.name): FlightBooking,…,
S1{Purpose: (current),
Recipient: (ours),
Retention: (legal-requirement),
Data: (#user.IDCardNo)}
S2{Purpose: (current, contact [opt-out]),
Recipient: (ours, same),
Retention: (legal-requirement),
Data: (#user.Name, #user.Mobile)}}Algorithm 8:P3P policies of FlightBooking service, HotelReservation service, and Payment service (P3P policy of HotelReservation service).
Policy2{Entity (#business.name): HotelReservation,…,
S1{Purpose: (current),
Recipient: (ours),
Retention: (legal-requirement),
Data: (#user.IDCardNo)}
S2{Purpose: (current, contact [opt-in]),
Recipient: (ours, unrelated [opt-out]),
Retention: (indefinitely),
Data: (#user.Name, #user.Mobile)}}Algorithm 9:P3P policies of FlightBooking service, HotelReservation service, and Payment service (P3P policy of Payment service).
Policy3{Entity (#business.name): Payment,…,
S{Purpose: (current),
Recipient: (ours),
Retention: (legal-requirement),
Data: (#user.Name [yes], #user.Mobile, #user.BankCardNo)}}According to Definition1, we can get the sets ofPurpose values ofData elements in privacy policy of TravelBroker:
(3)PCS_user.IDCardNo=P1_user.IDCardNo∪P2_user.IDCardNo∪P3_user.IDCardNo={current}∪{current}∪∅={current},PCS_user.Name=P1_user.Name∪P2_user.Name∪P3_user.Name={current,contact}∪{current,contact}∪{current}={current,contact},PCS_user.Mobile=P1_user.Mobile∪P2_user.Mobile∪P3_user.Mobile={current,contact}∪{current,contact}∪{current}={current,contact},PCS_user.BankCardNo=P1_user.BankCardNo∪P2_user.BankCardNo∪P3_user.BankCardNo=∅∪∅∪{current}={current}.According to Definitions2~7, we can getRecipient values ofData elements in privacy policy of TravelBroker as shown in Table 6. TheRecipient value of #user.IDCardNo in privacy policy of TravelBroker is ours. TheRecipient values of #user. Name in privacy policy of TravelBroker are ours, same1_user.Name, and unrelated2_user.Name. TheRecipient values of #user.Mobile in privacy policy of TravelBroker are ours, same1_user.Mobile, and unrelated2_user.Mobile. TheRecipient value of #user.BankCardNo in privacy policy of TravelBroker is ours.Table 6
Recipient values of Data elements in TravelBroker.
Recipient
Policy1
Policy2
Policy3
PolicyCS
Our
s
user.IDCardNo
Including
Including
Not including
Including
Deliver
y
user.IDCardNo
∅
∅
∅
∅
Sam
e
user.IDCardNo
∅
∅
∅
∅
Other-recipien
t
user.IDCardNo
∅
∅
∅
∅
Unrelate
d
user.IDCardNo
∅
∅
∅
∅
Publi
c
user.IDCardNo
Not including
Not including
Not including
Not
Our
s
user.Name
Including
Including
Including
Including
Deliver
y
user.Name
∅
∅
∅
∅
Sam
e
user.Name
Sam
e
1_user.Name
∅
∅
Sam
e
1_user.Name
Other-recipien
t
user.Name
∅
∅
∅
∅
Unrelate
d
user.Name
∅
Unrelate
d
2_user.Name
∅
Unrelate
d
2_user.Name
Publi
c
user.Name
Not including
Not including
Not including
Not
Our
s
user.Mobile
Including
Including
Including
Including
Deliver
y
user.Mobile
∅
∅
∅
∅
Sam
e
user.Mobile
Sam
e
1_user.Mobile
∅
∅
Sam
e
1_user.Mobile
Other-recipien
t
user.Mobile
∅
∅
∅
∅
Unrelate
d
user.Mobile
∅
Unrelate
d
2_user.Mobile
∅
Unrelate
d
2_user.Mobile
Publi
c
user.Mobile
Not including
Not including
Not including
Not
Our
s
user.BankCardNo
Not including
Not including
Including
Including
Deliver
y
user.BankCardNo
∅
∅
∅
∅
Sam
e
user.BankCardNo
∅
∅
∅
∅
Other-recipien
t
user.BankCardNo
∅
∅
∅
∅
Unrelate
d
user.BankCardNo
∅
∅
∅
∅
Publi
c
user.BankCardNo
Not including
Not including
Not including
NotTable7 shows theRetention values of #user.IDCardNo, #user.Name, #user.Mobile, and #user.BankCardNo in privacy policies of member services. According to Definition 8, we can getRetention values ofDate elements in privacy policy of TravelBroker as follows:
(4)TCS_user.IDCardNo=max⁡{T1_user.IDCardNo,T2_user.IDCardNo,T3_user.IDCardNo}=1month,TCS_user.Name=max⁡{T1_user.Name,T2_user.Name,T3_user.Name}=∞=indefinitely,TCS_user.Mobile=max⁡{T1_user.Mobile,T2_user.Mobile,T3_user.Mobile}=∞=indefinitely,TCS_user.BankCardNo=max⁡{T1_user.BankCardNo,T2_user.BankCardNo,T3_user.BankCardNo}=1month.Table 7
Retention values of Data elements in FlightBooking, HotelReservation, and Payment services.
Retention
Policy1
Policy2
Policy3
T
user.IDCardNo
1 month
20 days
Null
T
user.Name
1 month
∞
2 months
T
user.Mobile
1 month
∞
2 months
T
user.BankCardNo
Null
Null
1 monthAccording to Definition9, we can getOptional values ofData elements in privacy policy of TravelBroker as shown in Table 8. TheOptional value of #user.IDCardNo in privacy policy of TravelBroker is no. TheOptional value of #user.Name in privacy policy of TravelBroker is no. TheOptional value of #user.Mobile in privacy policy of TravelBroker is no. TheOptional value of #user.BankCardNo in privacy policy of TravelBroker is no.Table 8
Optional values of Data elements in TravelBroker.
Data
Policy1
Policy2
Policy3
PolicyCS
User.IDCardNo
No
No
Null
No
User.Name
No
No
Yes
No
User.Mobile
No
No
No
No
User.BankCardNo
Null
Null
No
NoAccording to Definition10, we can getRequired values ofPurpose values in privacy policy of TravelBroker as shown in Table 9. TheRequired value of current in privacy policy of TravelBroker is always. TheRequired value of contact in privacy policy of TravelBroker is opt-out.Table 9
Required values of Purpose values in TravelBroker.
Purpose
Policy1
Policy2
Policy3
PolicyCS
Current
Always
Always
Always
Always
Contact
Opt-out
Opt-in
Null
Opt-outAccording to Definitions11~12, we can getRequired values ofRecipient values in privacy policy of TravelBroker as shown in Table 10. TheRequiredvalue of same1_user.Name in privacy policy of TravelBroker is always. TheRequiredvalue of unrelated2_user.Name in privacy policy of TravelBroker is opt-out. TheRequiredvalue of same1_user.Mobile in privacy policy of TravelBroker is always. TheRequiredvalue of unrelated2_user.Mobile in privacy policy of TravelBroker is opt-out.Table 10
Required values of Recipient values in TravelBroker.
Recipient
Policy1
Policy2
Policy3
PolicyCS
Sam
e
1_user.Name
Always
Null
Null
Always
Unrelate
d
2_user.Name
Null
Opt-out
Null
Opt-out
Sam
e
1_user.Mobile
Always
Null
Null
Always
Unrelate
d
2_user.Mobile
Null
Opt-out
Null
Opt-outBy Definitions1~12, we have got thePurpose values,Recipient values,Retention values, andOptional values ofData elements in TravelBroker as well as theRequired values ofPurpose andRecipient element. On the basis of the semantic associations ofPurpose,Recipient,Retention, andDataelements, we can obtain the P3P privacy policy for TravelBroker as shown in Algorithm 10.Algorithm 10:P3P privacy policy for TravelBroker.
Policy{Entity (#business.name): TravelBroker,…,
S1{Purpose: (current),
Recipient: (ours),
Retention: (1 month),
Data: (#user.IDCardNo, #user.BankCardNo)}
S2{Purpose: (current, contact [opt-out]),
Recipient: (ours,same1_user.Name, unrelated2_user.Name [opt-out]),
Retention: (indefinitely),
Data: (#user.Name)}
S3{Purpose: (current, contact [opt-out]),
Recipient: (ours,same1_user.Mobile, unrelated2_user.Mobile [opt-out]),
Retention: (indefinitely),
Data: (#user.Mobile)}}


## 5. Related Work

When people enjoy the convenient, efficient, and flexible services on the Internet, their privacy information is inevitably collected by service providers. References [12, 13] assessed the risks of privacy abuse by game theory. The conclusion was that service providers tended to seek for undue interests by misusing and exposing users’ privacy information. In order to prevent users’ privacy information from being abused, service providers are asked to publish their privacy policies on their websites. P3P privacy policy has been used by more and more websites. By July 2003, 30% of the top 100 websites had used P3P. And 23% of the top 500 websites had used P3P [14].Some scholars have researched on the semantics for P3P privacy policy and the relationships among several P3P privacy policies. The work from Hogben expressed P3P privacy policy formally by an OWL ontology [15]. This work had been written to the W3C Working Group Note. Yu et al. proposed data-centric formal semantics for P3P policies, which precisely and intuitively modeled the relationships between different components of P3P statements [16]. Agrawal et al. enunciated key privacy principles for privacy-aware database systems and proposed a strawman design for the database systems using purpose-centric base [17]. Boontawee Suntisrivaraporn and Khurat proposed semantics for P3P employing a data-purpose centric relational table [18]. They used an OWL ontology to systematically and precisely describe P3P privacy policy. In our previous work, we put forward data-recipient centric formal semantics for P3P policies, which supported the semantic conflict detection of P3P [19]. May et al. proposed two flexible policy relations derived from bisimulation in process calculi [20]. They illustrated the relations using examples from P3P. Nikolaos Papanikolaou et al. presented an approach to check for refinement between policies [21]. They automatically generated CSP models from P3P policies and then performed various tests using the FDR model checker.With the wide application of web service composition, the protection of users’ privacy information in composite services attracts more and more attention. However, there are only a few scholars studying the application of P3P privacy policies in web service composition. Khurat et al. enhanced P3P to be able to support composite services, proposed a formal semantic for P3P employing a data-purpose centric relational table, and defined combining methods to obtain privacy policies of composite services [22]. However, due to the syntax of P3P being extended, P3P privacy policies of composite services generated by such methods could not be directly used to match with users’ privacy preferences. Our proposed method does not change the syntax of P3P. P3P privacy policies of composite services obtained by our method can match with users’ privacy preferences directly. Michele Chinosi and Trombetta checked whether a BPeX-represented business process was compliant with a P3P privacy policy by introducing a data model for BPMN and a corresponding XML-based representation called BPeX [23]. Li et al. proposed a graph-transformation based framework to check whether an internal business process adhered to the organizations’ P3P privacy policies [24]. Both [23, 24] applied P3P privacy policies in web service composition by business processes. However, they did not propose methods to obtain P3P privacy policies for composite services, yet assuming that P3P privacy policies of composite services had already existed. Our work proposes a method to obtain P3P privacy policies for composite services, which is the foundation of their work. Dong et al. presented an approach to implement privacy policy aggregation with P3P [10]. But they did not consider the internal relationship betweenData elements andPurpose,Recipient, andRetention elements. In our work, we generate thePurpose,Recipient, andRetention values for eachData element, respectively, which avoids potential conflicts betweenDataelements and other elements.


## 6. Conclusions and Future Work

Privacy protection in composite services has become an important issue. P3P is an existing technology employed to protect privacy. In order to apply P3P directly to composite services, we propose a method to obtain P3P privacy policies for composite services in the paper. We present the definitions ofPurpose,Recipient, andRetention elements as well asOptional andRequired attributes for P3P policies of composite services in the method and provide an instantiation to demonstrate the feasibility of the method.The base data schema of P3P is defined in a hierarchy. It will cause conflicts of data hierarchy constraints if the upper level data has more strict constraints than its lower level data. For example, #user.bdate is the higher level data relative to #user.bdate.ymd.year. If theOptional value of #user.bdate isyes, theOptional value of #user.bdate.ymd.year can beno oryes. But if theOptional value of #user.bdate isno, theOptional value of #user.bdate.ymd.year must beno. In this paper, there is no conflict of data hierarchy constraints in P3P privacy policies. So we do not consider the conflicts of data hierarchy constraints when obtaining P3P privacy policies for composite services. As future work, we plan to consider the conflicts of data hierarchy constraints and enhance our method to resolve it.



---

*Source: 961659-2014-07-13.xml*