Abstract: Verifying whether Web services composition satisfies with privacy requirement is a hot spot for privacy protection currently. However, little research focuses on behavioral privacy requirement. This paper proposes an approach to describing behavior-oriented privacy requirement that limits temporal relationship betwween private data access and service invocation in order to lay the foundation for formal verification of the requirement. Firstly, this paper introduces the behavior-oriented privacy policy model taking into account features like purpose and obligations, which is expressed with six-tuple. Then, it presents the definition with extensible markup language (XML) schema, corresponding with the model, and achieves the transformation of privacy policies from the natural language to XML document. Finally, the effectiveness of the proposed method is illustrated through a case.

Key words: Web services composition, behavior-oriented privacy policy, extensible markup language (XML)

摘要： 验证Web服务组合是否满足用户隐私需求，是目前Web服务组合中隐私保护的研究热点，但现有研究很少关注带有行为特征的隐私需求。提出了一种限制隐私数据访问与服务调用时序关系的面向行为隐私需求的描述方法，为其形式化验证奠定了基础。给出了带有目标和义务等特性的面向行为的隐私策略模型，并使用六元组进行表示。给出了该模型的XML Schema定义，在此基础上实现了自然语言描述的隐私需求到XML表示的隐私策略的转换。通过案例分析说明了该方法的有效性。

关键词: Web服务组合, 面向行为的隐私策略, 可扩展标记语言（XML）