A framework to enforce privacy in business processes
Service-oriented architectures (SOA), and in particular Web services, have quickly become a popular paradigm to develop distributed applications. Nowadays, more and more organizations shift their core business to the Web services platform within which various interactions between the autonomous services occur. One of the widely accepted standards in the Web services platform is Business Process Execution Language for Web Services (BPEL4WS, or BPEL for short). BPEL defines a language to integrate Web services by creating composite Web services in the form of business processes following the service orchestration paradigm, and it enables organizations to focus on core competence and mission-critical operations while outsource every-thing else to reduce costs and time to market. However BPEL is deficient in privacy issues. The facts are: (1) service requestors' personal information is fundamental to enable business processes (e.g., the mortgage approval business process); (2) privacy concerns have become one of the most important issues in Information Technology and has received increasing attention from organizations, consumers and legislators; (3) most organizations have recognized that dealing correctly and honestly with customers' privacy concerns can have beneficial returns for their businesses, not only in terms of being compliant with laws and regulations but also in terms of reputation and potential business opportunities. If not addressed properly, privacy concerns may become an impediment to the widespread adoption of BPEL. Privacy issues have many aspects, the privacy concerns of potential service requestor (i.e., client) and the privacy concerns of service provider (i.e., organization) are two of them. Service requestor specifies his/her privacy concerns as privacy preference, while service provider defines and publishes its privacy policy to specify its privacy promises. Before requestor accesses certain service, he/she likes to know whether the service provider will respect his/her privacy preference. ...