Formal consistency verification between BPEL process and privacy policy

Despite the increased privacy concerns in the Internet, not much attention has been paid into enforcing privacy policies of organisations who collect and consume personal data using automatic means (e.g., Web services). In this paper, we propose a graph-transformation based framework to check whether an internal business process (implemented using a standard Web service composition language such as BPEL) adheres to the organisation's privacy policies. The graph-based specification formalism combines the advantages of an intuitive visual framework with rigorous semantical foundation that allows consistency checking between a business process and privacy policy. The privacy consistency verification framework is defined by a set of rules to build the system state and sets of constraints (positive and negative) to specify the wanted and unwanted substates.