Description
Privacy by Design (PbD) aims to make privacy integral to system design, but widespread
adoption has been lacking. There are a few reasons driving this absence of PbD in the
System Development Lifecycle (SDLC). Existing approaches often remain too abstract, lack
clear guidance and support for developers, or fail to integrate privacy throughout the whole
SDLC. Privacy protection is crucial for Software-as-a-Service (SaaS), where the distributed
deployment model broadens the attack surface, and providers commonly collect and process
sensitive user data.
In this thesis, we address these challenges by first evaluating how privacy patterns support
PbD. We establish a taxonomy that links privacy strategies with SDLC stages. This structure
allows us to classify privacy patterns by their role in development and the privacy goal they
aim to achieve. Using this taxonomy, we compile and categorize over 100 privacy architectural
patterns from the current research literature identified through a systematic literature review.
This catalog provides a practical foundation for identifying reusable privacy measures at the
architectural level.
Using these contributions, we develop a method for constructing privacy-enhanced architectures.
Our approach offers a novel approach by uniquely integrating both goal-based
and threat-based strategies for mitigation measure selection within the same framework.
Existing methods typically adopt only one of these perspectives. Furthermore, our method
operationalizes privacy-utility trade-off assessment as a practical step incorporated into architectural
decision-making, going beyond purely theoretical or compliance-driven evaluations
found in previous work. This combination enables more precise, context-aware selection
of privacy patterns. Integrated into the architecture design process, we use LINDDUN for
threat modeling and support pattern selection based on privacy strategies. Overall, this thesis
provides a structured approach to operationalizing PbD in SaaS architecture design that goes
beyond compliance. It addresses several identified gaps in the literature and demonstrates that
privacy-enhanced architecture construction can be made more practical for developers who
need actionable guidance rather than abstract principles alone. While doing so, we consider
practicality, resources, and effort. We evaluate the method in a case study on ICTE-PAN,
a Government-to-Government SaaS system, and demonstrate its feasibility in supporting
concrete privacy-enhancing design decisions.
|
Thesis topic in co-operation with the Fraunhofer Institute for Applied and Integrated Security AISEC, Garching