Principled Audit Mechanisms for Privacy Protection

Transcription

1 Principled Audit Mechanisms for Privacy Protection Anupam Datta Carnegie Mellon University CyLab Briefing November 11, 2011

2 Healthcare Privacy Hospital Patient medical bills Patient information Insurance Company Drug Company Privacy threats from insiders (humans) Advertising Patient Complex Process within a Hospital Patient Desiderata: Respect privacy expectations in the flow and use of personal information within and across organizational boundaries

3 Personal Information is Everywhere Desiderata: Generality + application to specific domains of importance in society (e.g., healthcare HIPAA Privacy Rule)

4 Example from HIPAA Privacy Rule A covered entity may disclose an individual s protected health information (phi) to law-enforcement officials for the purpose of identifying an individual if the individual made a statement admitting participating in a violent crime that the covered entity believes may have caused serious physical harm to the victim Preventive enforcement (access control or runtime monitoring) does not suffice Concepts in privacy policies Actions: send(p1, p2, m) Roles: inrole(p2, law-enforcement) Data attributes: attr_in(prescription, phi) Temporal constraints: in-the-past(state(q, m)) Purposes: purp_in(u, id-criminal)) Beliefs: believes-crime-caused-serious-harm(p, q, m) Black-andwhite concepts Grey concepts

5 A Research Agenda Design principled audit mechanisms for enforcing privacy policies Simple audit tools already available commercially (FairWarning, Cerner s P2P Sentinel, )

6 The Big Picture Privacy Policy Organizational audit log Complete formalization of HIPAA, GLBA Automated audit for blackand-white policy concepts Detect policy violations Computer-readable privacy policy Audit Oracles to audit for grey policy concepts

7 Key Challenge for Auditing Audit Logs are Incomplete Future: store only past and current events Example: Timely data breach notification refers to future event Subjective: no grey information Example: May not record evidence for purposes and beliefs Spatial: remote logs may be inaccessible Example: Logs distributed across different departments of a hospital

8 Abstract Model of Incomplete Logs Model all incomplete logs uniformly as 3-valued structures Define semantics (meanings of formulas) over 3-valued structures

9 reduce: The Iterative Algorithm reduce (L, φ) = φ' Logs Policy r e d u c e φ 0 φ e 1 φ 2 r e d u c Time

10 Example from HIPAA Privacy Rule A covered entity may disclose an individual s protected health information (phi) to law-enforcement officials for the purpose of identifying an individual if the individual made a statement admitting participating in a violent crime that the covered entity believes may have caused serious physical harm to the victim 10 p1, p2, m, u, q, t. (send(p1, p2, m) inrole(p2, law-enforcement) tagged(m, q, t, u) attr_in(t, phi)) (purp_in(u, id-criminal)) m. state(q,m ) is-admission-of-crime(m ) believes-crime-caused-serious-harm(p1, q, m )

11 Example φ = p1, p2, m, u, q, t. (send(p1, p2, m) tagged(m, q, t, u) attr_in(t, phi)) inrole(p2, law-enforcement) purp_in(u, id-criminal) m. ( state(q, m ) is-admission-of-crime(m ) believes-crime-caused-serious-harm(p1, m )) Finite Substitutions { p1 UPMC, p2 allegeny-police, m M2, q Bob, u id-bank-robber, t date-of-treatment m M1 } Incomplete Log Jan 1, 2011 state(bob, M1) Jan 5, 2011 send(upmc, allegeny-police, M2) tagged(m2, Bob, date-of-treatment, id-bank-robber) φ' = T purp_in(id-bank-robber, id-criminal) is-admission-of-crime(m1) believes-crime-caused-serious-harm(upmc, M1)

12 Implementation and Case Study Implementation and evaluation over simulated audit logs for compliance with all 84 disclosure-related clauses of HIPAA Privacy Rule Performance: Average time for checking compliance of each disclosure of protected health information is 0.12s for a 15MB log Mechanical enforcement: reduce can automatically check 80% of all the atomic predicates

13 Other Applications of reduce Disclosure Accounting What disclosures have been made of Alice s information? Online Advisory Tool Does HIPAA permit this disclosure? Under what conditions?

14 The Big Picture Privacy Policy Organizational audit log Complete formalization of HIPAA, GLBA Automated audit for blackand-white policy concepts Detect policy violations Computer-readable privacy policy Audit Oracles to audit for grey policy concepts

15 Auditing Grey Concepts φ' = purpose(u, treatment) Was patient record accessed for treatment? Challenge: Auditing is imperfect Human auditor can only check a subset of grey concepts due to budgetary constraints Question: How should auditor allocate the audit budget?

16 Learning to Audit Auditor Auditing budget: $3000/ cycle Cost for one inspection: $100 Only 30 inspections per cycle Access divided into 2 types Loss from 1 violation (internal, external) $500, $ accesses 100 accesses $250, $ accesses

17 Audit Mechanism Choices Only 30 inspections Consider 4 possible allocations of the available 30 inspections Weights Choose allocation probabilistically based on weights 17

18 Audit Mechanism Run No. of Access 30 Actual Violation Int. Caught Ext. Caught 1 1 Observed Loss Estimated Loss $2000 $1500 $1000 $ $750 $1250 $1250 $1500 Updated weights Learning from experience: weights updated using observed and estimated loss 18

19 Regret Minimizing Audits Learns from experience to recommend budget allocation for audit in each audit cycle Budget allocation is provably close to optimal fixed strategy in hindsight (e.g., budget allocation)

20 Audit Mechanisms for Privacy Protection Privacy Policy Organizational audit log Complete formalization of HIPAA, GLBA Automated audit for blackand-white policy concepts Detect policy violations Computer-readable privacy policy Audit Learning to audit for grey policy concepts

21 Thanks! Questions?

22 Additional Slides 22

23 Syntax of Policy Logic First-order logic with restricted quantification over infinite domains (challenge for reduce) Can express timed temporal properties, grey predicates

24 reduce: Formal Definition General Theorem: If initial policy passes a syntactic mode check, then finite substitutions can be computed c is a formula for which finite satisfying substitutions of x can be computed Applications:The entire HIPAA and GLBA Privacy Rules pass this check

25 Mode Analysis: Formally 25

26 Mode Analysis: Theorem 26

27 27 Computing Finite Substitutions

28 Experimental Evaluation

29 Experimental Evaluation

30 Other Applications of Reduce Runtime monitoring For policies that do not mention unbounded future obligations or grey concepts (Special case usually addressed in the runtime verification literature)

31 Related Work Specification Languages & Logics for Privacy Policies P3P[Cranor et al.], XACML[OASIS], EPAL[Backes et al.], Logic of Privacy and Utility [Barth et al.], PrivacyAPIs [Gunter et al.],

32 Related Work Logical Specification of Privacy Laws Logic of Privacy and Utility [Barth et al.]: Example clauses from HIPAA and GLBA PrivacyAPIs [Gunter et al.]: HIPAA Datalog HIPAA [Lam et al.]: HIPAA , ,

33 Related Work Runtime monitoring in MFOTL [Basin et al 10] Pre-emptive enforcement Efficient implementation Assumes past-completeness of logs Less expressive mode checking ( safe-range check ) Cannot express HIPAA or GLBA

34 Related Work Iterative Model Checking [Thati, Rosu 05] Propositional logic Cannot express privacy legislation

35 Formal Properties of Reduce Correctness

36 Formal Properties of Reduce Minimality of Output

37 Formal Properties of Reduce Complexity

38 Summary of Results 1. Privacy laws represented in logic Informed by theory of contextual integrity [Nissenbaum] First complete formalization of HIPAA and GLBA [WPES 2010] 2. Automatic audit of incomplete logs [CCS 2011] Applies to significant part of HIPAA, GLBA Outputs residual policy involving grey predicates Efficient, practical implementation 3. Learning algorithm guides human audit of grey concepts in a manner that minimizes risk [CSF 2011]