Artificial Intelligence and Law

, Volume 17, Issue 1, pp 1–30 | Cite as

How to integrate legal requirements into a requirements engineering methodology for the development of security and privacy patterns

  • Luca Compagna
  • Paul El Khoury
  • Alžběta Krausová
  • Fabio Massacci
  • Nicola ZannoneEmail author


Laws set requirements that force organizations to assess the security and privacy of their IT systems and impose them to implement minimal precautionary security measures. Several IT solutions (e.g., Privacy Enhancing Technologies, Access Control Infrastructure, etc.) have been proposed to address security and privacy issues. However, understanding why, and when such solutions have to be adopted is often unanswered because the answer comes only from a broader perspective, accounting for legal and organizational issues. Security engineers and legal experts should analyze the business goals of a company and its organizational structure and derive from there the points where security and privacy problems may arise and which solutions best fit such (legal) problems. The paper investigates the methodological support for capturing security and privacy requirements of a concrete health care provider.


Security and privacy patterns Legal requirements Organization Pattern validation Healthcare 



This work was partially funded by the projects IST-FP6-IP-SERENITY, IST-FP7-IP-MASTER, and FIRB-TOCAI. We want to express our gratitude to all members of the SERENITY project for their feedback and useful scientific discussions. We would also like to thank the anonymous reviewers for their constructive comments that helped to improve the quality of the paper.


  1. Anderson RJ (1994) Why cryptosystems fail. CACM 37(11):32–40Google Scholar
  2. Asnar Y, Bonato R, Giorgini P, Massacci F, Meduri V, Riccucci C, Saidane A (2007) Secure and dependable patterns in organizations: an empirical approach. In: Proceedings of RE’07. IEEE Press, Los Alamitos, pp 287–292Google Scholar
  3. Asnar Y, Moretti R, Sebastianis M, Zannone N (2008) Risk as dependability metrics for the evaluation of business solutions: a model-driven approach. In: Proceedings of ARES’08. IEEE Press, Los Alamitos, pp 1240–1247Google Scholar
  4. Basin D, Doser J, Lodderstedt T (2006) Model driven security: from UML models to access control infrastructures. TOSEM 15(1):39–91CrossRefGoogle Scholar
  5. Bench-Capon TJM, Sartor G (2003) A model of legal reasoning with cases incorporating theories and values. Artif Intell 150(1–2):97–143zbMATHCrossRefGoogle Scholar
  6. Bench-Capon TJM, Robinson GO, Routen TW, Sergot MJ (1987) Logic programming for large scale applications in law: a formalisation of supplementary benefit legislation. In: Proceedings of ICAIL’87. ACM Press, New York, pp 190–198Google Scholar
  7. Breaux TD, Antón AI (2008) Analyzing regulatory rules for privacy and security requirements. TSE 34(1):5–20Google Scholar
  8. Breu R, Popp G, Alam M (2007) Model based development of access policies. STTT 9:457–470CrossRefGoogle Scholar
  9. Compagna L, El Khoury P, Massacci F, Thomas R, Zannone N (2007) How to capture, communicate, model, and verify the knowledge of legal, security, and privacy experts: a pattern-based approach. In: Proceedings of ICAIL’07. ACM Press, New York, pp 149–154Google Scholar
  10. Cuevas A, El Khoury P, Gomez L, Laube A (2008) Security patterns for capturing encryption-based access control to sensor data. In: Proceedings of SECURWARE’08. IEEE Press, Los Alamitos, pp 62–67Google Scholar
  11. Dibbern J, Goles T, Hirschheim R, Jayatilaka B (2004) Information systems outsourcing: a survey and analysis of the literature. DATA BASE Adv Inf Syst 35(4):6–102Google Scholar
  12. Dijkstra P, Prakken H, de Vey Mestdagh K (2007) An implementation of norm-based agent negotiation. In: Proceedings of the 11th international conference on artificial intelligence and law. ACM Press, New York, pp 167–175Google Scholar
  13. European Commission (1995) Directive 95/46/ec on the protection of individuals with regard to the processing of personal data and on the free movement of such data. Off J Eur Communities 281:31Google Scholar
  14. European Commission (2007) Communication on the follow-up of the work programme for a better implementation of the data protection directive. f_en.pdf
  15. Fernández EB, Pan R (2001) A pattern language for security models. In: Proceedings of PLoP’01Google Scholar
  16. Fernández EB, Yuan X (2000) Semantic analysis patterns. In: Proceedings of ER’00, LNCS 1920. Springer-Verlag, Berlin, pp 183–195Google Scholar
  17. Fernández EB, Yuan X (2007) Securing analysis patterns. In: Proceedings of ACM southeast regional conference. ACM Press, New York, pp 288–293Google Scholar
  18. Fernández EB, Ballesteros J, Desouza-Doucet AC, Larrondo-Petrie MM (2007) Security patterns for physical access control systems. In: Proceedings of DBSec’07, LNCS 4602. Springer-Verlag, Berlin, pp 259–274Google Scholar
  19. Gamma E, Helm R, Johnson R, Vlissides J (1994) Design patterns: elements of reusable object-oriented software. Addison-Wesley, MAGoogle Scholar
  20. Giorgini P, Massacci F, Zannone N (2005) Security and trust requirements engineering. In: FOSAD 2004/2005, LNCS 3655. Springer-Verlag, Berlin, pp 237–272Google Scholar
  21. Guarda P, Zannone N (2008) Towards the development of privacy-aware systems. Inf Softw Technol (to appear)Google Scholar
  22. Hofeld WN (1913) Fundamental legal conceptions as applied to judicial reasoning. Yale Law J 23:16–59CrossRefGoogle Scholar
  23. IBM (2003) Introduction to business security patterns. IBM White PaperGoogle Scholar
  24. ISO (2000) Quality management systems: requirements. ISO 9001:2000Google Scholar
  25. ISO/IEC (2005a) Code of practice for information security management. ISO/IEC 17799:2005Google Scholar
  26. ISO/IEC (2005b) Information technology—security techniques—evaluation criteria for IT. ISO/IEC 15408:2005Google Scholar
  27. Kanger S (1972) Law and logic. Theoria 38(3):105–132zbMATHMathSciNetCrossRefGoogle Scholar
  28. Kienzle DM, Elder MC (2002) Security patterns for web application development. Final technical report, University of Virginia.∼celer/securitypatterns/final%20report.pdf
  29. Kowalski RA, Sergot MJ (1985) Computer representation of the law. In: Proceedings of IJCAI’05. Morgan Kaufmann, San Fransisco, pp 1269–1270Google Scholar
  30. Lamport L (1994) How to write a long formula. Formal Asp Comput 6(5):580–584CrossRefGoogle Scholar
  31. Leone N, Pfeifer G, Faber W, Eiter T, Gottlob G, Perri S, Scarcello F (2006) The DLV system for knowledge representation and reasoning. TOCL 7(3):499–562CrossRefMathSciNetGoogle Scholar
  32. Mally E (1926) Grundgesetze des Sollens: Elemente der Logik des Willens. Leuschner & Lubensky, GrazGoogle Scholar
  33. Massacci F, Zannone N (2008) A model-driven approach for the specification and analysis of access control policies. In: Proceedings of IS’08, LNCS 5332, On the move to meaningful internet systems: OTM 2008 [book]. Springer, Berlin, pp 1087–1103Google Scholar
  34. Massacci F, Prest M, Zannone N (2005) Using a security requirements engineering methodology in practice: the compliance with the Italian data protection legislation. CSI 27(5):445–455Google Scholar
  35. Massacci F, Mylopoulos J, Zannone N (2007) An ontology for secure socio-technical systems. In: Handbook of ontologies for business interaction. The IDEA Group, Hershey, pp 188–207Google Scholar
  36. Meyer JJC, Wieringa RJ (eds) (1994) Deontic logic in computer science: normative system specification. Wiley, NYGoogle Scholar
  37. Mouratidis H, Weiss M, Giorgini P (2005) Security patterns meet agent oriented software engineering: a complementary solution for developing secure information systems. In: Proceedings of ER’05, LNCS 3716. Springer-Verlag, Berlin, pp 225–240Google Scholar
  38. Room S (2007) Data protection & compliance in context. BCSGoogle Scholar
  39. Saltzer JH, Schroeder MD (1975) The protection of information in computer systems. Proc IEEE 63(9):1278–1308CrossRefGoogle Scholar
  40. Samarati P, di Vimercati SDC (2001) Access control: policies, models, and mechanisms. In: FOSAD 2001/2002, LNCS 2946. Springer-Verlag, Berlin, pp 137–196Google Scholar
  41. Sanchez-Cid F, Muñoz A, El Khoury P, Compagna L (2007) XACML as a security and dependability (S&D) pattern for access control in AmI environments. In: Proceedings of AmI.d07. Springer, Berlin, pp 143–155Google Scholar
  42. Schumacher M (2003) Security engineering with patterns: origins, theoretical models, and new applications. Springer-Verlag, BerlinGoogle Scholar
  43. von Wright GH (1951) Deontic logic. Mind 60:1–15CrossRefGoogle Scholar
  44. Wahlgren P (1992) Automation of legal reasoning: a study on artificial intelligence. Kluwer Law and Taxation Publishers, The NetherlandsGoogle Scholar
  45. World Health Organization (1994) A declaration on the promotion of patients’ rights in Europe.
  46. Yoder J, Barcalow J (1997) Architectural patterns for enabling application security. In: Proceedings of PLoP’97Google Scholar
  47. Yoshioka N, Honiden S, Finkelstein A (2004) Security patterns: a method for constructing secure and efficient inter-company coordination systems. In: Proceedings of EDOC’04. IEEE Press, Los Alamitos, pp 84–97Google Scholar
  48. Zeni N, Kiyavitskaya N, Cordy JR, Mich L, Mylopoulos J (2008) Annotating regulations using cerno: an application to italian documents—extended abstract. In: Proceedings of ARES’08. IEEE Press, Los Alamitos, pp 1437–1442Google Scholar

Copyright information

© Springer Science+Business Media B.V. 2008

Authors and Affiliations

  • Luca Compagna
    • 1
  • Paul El Khoury
    • 1
    • 2
  • Alžběta Krausová
    • 3
  • Fabio Massacci
    • 4
  • Nicola Zannone
    • 5
    Email author
  1. 1.SAP ResearchNiceFrance
  2. 2.University of Lyon I, LIRIS CNRS UMR 5205LyonFrance
  3. 3.ICRI – K.U. Leuven – IBBTLeuvenBelgium
  4. 4.University of TrentoTrentoItaly
  5. 5.University of TorontoTorontoCanada

Personalised recommendations