Privacy Objectives Research Articles

Interest-disclosing Mechanisms for Advertising are Privacy-Exposing (not Preserving)

Today, targeted online advertising relies on unique identifiers assigned to users through third-party cookies--a practice at odds with user privacy. While the web and advertising communities have proposed solutions that we refer to as interest-disclosing mechanisms, including Google's Topics API, an independent analysis of these proposals in realistic scenarios has yet to be performed. In this paper, we attempt to validate the privacy (i.e., preventing unique identification) and utility (i.e., enabling ad targeting) claims of Google's Topics proposal in the context of realistic user behavior. Through new statistical models of the distribution of user behaviors and resulting targeting topics, we analyze the capabilities of malicious advertisers observing users over time and colluding with other third parties. Our analysis shows that even in the best case, individual users' identification across sites is possible, as 0.4% of the 250k users we simulate are re-identified. These guarantees weaken further over time and when advertisers collude: 57% of users with stable interests are uniquely re-identified when their browsing activity has been observed for 15 epochs, increasing to 75% after 30 epochs. While measuring that the Topics API provides moderate utility, we also find that advertisers and publishers can abuse the Topics API to potentially assign unique identifiers to users, defeating the desired privacy guarantees. As a result, the inherent diversity of users' interests on the web is directly at odds with the privacy objectives of interest-disclosing mechanisms; we discuss how any replacement of third-party cookies may have to seek other avenues to achieve privacy for the web.

Lightweight Multi-Class Support Vector Machine-Based Medical Diagnosis System with Privacy Preservation.

Machine learning, powered by cloud servers, has found application in medical diagnosis, enhancing the capabilities of smart healthcare services. Research literature demonstrates that the support vector machine (SVM) consistently demonstrates remarkable accuracy in medical diagnosis. Nonetheless, safeguarding patients' health data privacy and preserving the intellectual property of diagnosis models is of paramount importance. This concern arises from the common practice of outsourcing these models to third-party cloud servers that may not be entirely trustworthy. Few studies in the literature have delved into addressing these issues within SVM-based diagnosis systems. These studies, however, typically demand substantial communication and computational resources and may fail to conceal classification results and protect model intellectual property. This paper aims to tackle these limitations within a multi-class SVM medical diagnosis system. To achieve this, we have introduced modifications to an inner product encryption cryptosystem and incorporated it into our medical diagnosis framework. Notably, our cryptosystem proves to be more efficient than the Paillier and multi-party computation cryptography methods employed in previous research. Although we focus on a medical application in this paper, our approach can also be used for other applications that need the evaluation of machine learning models in a privacy-preserving way such as electricity theft detection in the smart grid, electric vehicle charging coordination, and vehicular social networks. To assess the performance and security of our approach, we conducted comprehensive analyses and experiments. Our findings demonstrate that our proposed method successfully fulfills our security and privacy objectives while maintaining high classification accuracy and minimizing communication and computational overhead.

Privacy protection control for mobile apps users

Predominant in today society, mobile apps are rising as promising application systems for automatic control. An app can be viewed as a plant, processing input signals (queries, phone data, etc.) and generating outputs (such as a service or an answer). Guaranteeing that the app complies with a desired behavior is a major safety challenge. This work focuses on privacy issues for geolocated mobile apps. Many applications use the location data to provide a service (e.g., navigation, fitness) or to improve it (e.g., weather forecast, social media). This gain in service utility comes at the cost of personal data sharing. Such threat to user privacy can be leveraged by protection mechanisms, e.g., addition of noise to the location data. However, state-of-the-art techniques still lack means of ensuring both data utility and privacy in a dynamics utilization context. This paper presents the first non-linear analytical modeling followed by a control formulation for regulating the privacy level in a mobile app. The privacy is sensed using the well established notion of Point of Interest. Through modeling, we highlight the control challenges, namely the non-linearity and time-variance of the plant, its high sensibility to noise and the impact of the user’s mobility pattern—seen a disturbance. A controller is designed, combining feedback with anticipation action. Evaluation is performed using mobility records from two real-world multi-users datasets. Our approach enables, with a unique and universal tuning, to robustly meet privacy objectives with preserved utility and negligible computational overhead. Control algorithm, experimental evaluation and analysis scripts are available online for reproducibility.

Tech Optimization in Cybersecurity Defenses by Advanced ML Methods: The Use Case of Volleyball Industry.

Individual and team performance can be improved by utilizing “smart” devices and applications that are connected through networks. In sports, the Internet of Things (IoT) refers to all of the “smart” devices and applications linked through networks to reduce injuries to the bare minimum, develop advanced training techniques, and apply analytical advanced sports improvement methodologies to improve sports performance in general. The Internet of Things (IoT) in sports is closely related to the objective of both security and privacy in sports, which has become a topic of crucial concern for the sports business in recent years, as evidenced by the adoption of IoT in sports years. For this reason, security flaws can have catastrophic consequences, including the disclosure of personal data, the manipulation of statistical findings, the harming of organizations' reputations, and enormous financial losses for the sporting organization. One or more of the consequences, as previously mentioned, is related to sports organizations and the athletes who are members of those organizations, and they have a direct impact on the corresponding set of sports-related, medical-related, and paramedical enterprises, specifically those that provide specialized sports equipment and associated services. A critical need to detect and quantify threats has long been recognized to better support decision-making when adopting or constructing a safe and reliable sports Internet-of-Things infrastructure, which is becoming increasingly common. Using advanced machine learning algorithms, this research provides a methodology for technology optimization in cybersecurity defenses that is then used in a unique case study utilizing volleyball players to demonstrate its effectiveness. In conjunction with a Monte Carlo optimization technique, an upgraded variant of fuzzy cognitive maps (FCM) is presented in greater detail. This model is utilized for a specific scenario of risk identification of volleyball industry, assessment, and optimization for IoT sports networks.

State of the Art in Adoption of Contact Tracing Apps and Recommendations Regarding Privacy Protection and Public Health: Systematic Review.

BackgroundDuring the COVID-19 pandemic, contact tracing apps have received a lot of public attention. The ongoing debate highlights the challenges of the adoption of data-driven innovation. We reflect on how to ensure an appropriate level of protection of individual data and how to maximize public health benefits that can be derived from the collected data.ObjectiveThe aim of the study was to analyze available COVID-19 contact tracing apps and verify to what extent public health interests and data privacy standards can be fulfilled simultaneously in the process of the adoption of digital health technologies.MethodsA systematic review of PubMed and MEDLINE databases, as well as grey literature, was performed to identify available contact tracing apps. Two checklists were developed to evaluate (1) the apps’ compliance with data privacy standards and (2) their fulfillment of public health interests. Based on both checklists, a scorecard with a selected set of minimum requirements was created with the goal of estimating whether the balance between the objective of data privacy and public health interests can be achieved in order to ensure the broad adoption of digital technologies.ResultsOverall, 21 contact tracing apps were reviewed. In total, 11 criteria were defined to assess the usefulness of each digital technology for public health interests. The most frequently installed features related to contact alerting and governmental accountability. The least frequently installed feature was the availability of a system of medical or organizational support. Only 1 app out of 21 (5%) provided a threshold for the population coverage needed for the digital solution to be effective. In total, 12 criteria were used to assess the compliance of contact tracing apps with data privacy regulations. Explicit user consent, voluntary use, and anonymization techniques were among the most frequently fulfilled criteria. The least often implemented criteria were provisions of information about personal data breaches and data gathered from children. The balance between standards of data protection and public health benefits was achieved best by the COVIDSafe app and worst by the Alipay Health Code app.ConclusionsContact tracing apps with high levels of compliance with standards of data privacy tend to fulfill public health interests to a limited extent. Simultaneously, digital technologies with a lower level of data privacy protection allow for the collection of more data. Overall, this review shows that a consistent number of apps appear to comply with standards of data privacy, while their usefulness from a public health perspective can still be maximized.

Google as a de facto privacy regulator: analysing the Privacy Sandbox from an antitrust perspective

ABSTRACT Now a multi-billion-dollar industry, online advertising is what funds free online content. At the core of this industry lies the ability to track users through various technical means, such as cookies, which has sparked privacy concerns, and is thus subject to a growing body of regulation. But the most important rules around tracking seem to come from a handful of large platforms who have assumed the role of a de facto privacy regulator. In this paper we explore in detail Google’s decision to phase out support for third-party cookies on Chrome, accompanied by a set of proposals known as the Privacy Sandbox proposals. We query whether this decision raises any antitrust concerns – and if so, how they can be reconciled with the objective of privacy. At a conceptual level, we use this opportunity to reflect on the relationship between competition law and privacy and the trade-offs regulators may have to make.

Incentivizing Crowdsensing-Based Noise Monitoring with Differentially-Private Locations

Mobile crowd sensing is a technique where a crowd sensing server outsources sensing tasks to the crowd for mobile data collection. In mobile crowd sensing, some tasks require location information to achieve their objectives, such as road monitoring, indoor floor plan reconstruction, and smart transportation. This required information incurs severe concerns on location privacy leakage and threatens workers' properties as well as public safety. In some cases, even sensing data itself can be used as auxiliary information resulting in location privacy breaches. Many existing works apply differential privacy mechanisms for location privacy preservation to tackle this problem, but they cannot efficiently fulfill privacy goals because each worker only considers his own privacy. As a consequence, the accumulated privacy budget will lower down the composed privacy level of all the workers' locations. In addition, deploying differential privacy is costly for workers and it will degrade the quality of data required in crowd sensing tasks. How to balance the cost and provide accurate aggregated data while fulfilling privacy objectives becomes a challenging issue. In this paper, we propose a group-differentially-private game-theoretical solution, which addresses these limitations in a privacy-preserving and efficient way. Our scheme enables the indistinguishability of workers' locations and sensing data without the help of a trusted entity while meeting the accuracy demands of crowd sensing tasks. The effectiveness and efficiency of our scheme are thoroughly evaluated based on real-world datasets.

Privacy for 5G-Supported Vehicular Networks

Vehicular networks allow billions of vehicular users to be connected to report and exchange real-time data for offering various services, such as navigation, ride-hailing, smart parking, traffic monitoring, and vehicular digital forensics. Fifth generation (5G) is a new radio access technology with greater coverage, accessibility, and higher network density. 5G-supported Vehicular Networks (5GVNs) have attracted plenty of attention from both academia and industry. Geared with new features, they are expected to revolutionize the mobility ecosystem to empower a portfolio of new services. Meanwhile, the development of such communication capabilities, along with the development of sensory devices and the enhancement of local computing powers, have lead to an inevitable reality of massive data (e.g., identity, location, and trajectory) collection from vehicular users. Unfortunately, 5GVN are still confronted with a variety of privacy threats. Such threats are targeted at users’ data, identity, location, and trajectory. If not properly handled, such threats will cause unimaginable consequences to users. In this survey, we first review the state-of-the-art of survey papers. Next, we introduce the architecture, features, and services of 5GVN, followed by the privacy objectives of 5GVN and privacy threats to 5GVN. Further, we present existing privacy-preserving solutions and analyze them in-depth. Finally, we define some future research directions to draw more attention and down-to-earth efforts into this new architecture and its privacy issues.

An efficient authentication and key agreement protocol for a group of vehicles devices in 5G cellular networks

In recent years, the world of wireless telecommunications is in full progress. Indeed, although the evolution of 4G mobile networks continues, the standardization work of the 5G networks is in full progress. The connected vehicle is part of the services expected from 5G. Indeed, the interconnection between vehicles promises a safer and more enjoyable driving experience. However, as the huge number of vehicle devices are increasing day by day and each vehicle must perform a full authentication procedure to reach to the network, network congestion may occur when a group of vehicles requires simultaneous access, moreover this can have a decisive effect on the promised high rate of 5G. The EPS-AKA authentication mechanism used in 4G networks is too insufficient to handle a large number of mobile devices. In this context, our article aims to define a reliable solution for the authentication of a group of vehicles simultaneous in 5G cellular networks. A reauthentication procedure is also proposed. Analysis results obtained using the SPAN tool has proven that authentication and privacy objectives are met. In addition, elaborate performance evaluations in terms of communication signalling and computational overhead demonstrate that our protocol is more efficient than those existing protocols.

A Framework for Auditing and Strategizing to Ensure Cloud Privacy

ABSTRACTIn this study we present a framework for auditing and strategizing to ensure cloud privacy. Management of cloud privacy is a problem since it continues to remain an elusive concept due to the evolving relationship between the pervasiveness of technology and its use by individuals. The Cloud Privacy Framework presented in this paper can be utilized to develop privacy audits, establish privacy practices, and help in defining privacy strategies that are in alignment with individual value systems. The paper extends the privacy objectives presented in Coss and Dhillon (2019) to define a design science-based Cloud Privacy Framework. The framework is externally evaluated, validated, and assessed by a group of information system auditors.

A Privacy Awareness System for Software Design

There have been concerting policy and legal initiatives to mitigate the privacy harm resulting from badly designed software technology. But one main challenge to realizing these initiatives is the difficulty in translating proposed principles and regulations into concrete and verifiable evidence in technology. This is partly due to the lack of systematic techniques and tools to address privacy in the software design, hence making it difficult for the designer to measure disclosure risk in a more intuitive way, taking into account the privacy objective that matters to each end user. To bridge this gap, we propose a framework for verifying the satisfaction of user privacy objectives in software design. Our approach is based on the (un)awareness that users acquire when information is disclosed, as it relates to the communication properties of objects in a design. This property is used to determine the expected privacy utility that users will derive from the design for a specified privacy objective. We demonstrate through case studies how this approach can help designers determine which design decision undermines users’ privacy expectations and better design alternatives.

Practical Privacy-Preserving ECG-Based Authentication for IoT-Based Healthcare

In current healthcare systems, patients use various types of medical Internet of Things devices for monitoring their health conditions. The collected information (personal health records) will be sent back to hospitals for diagnosis and quick responses. However, severe security and privacy leakages with regard to data privacy and identity authentication are incurred because the monitored health data contains sensitive information. Therefore, the data should be well protected from unauthorized entities. Unfortunately, traditional cryptographic approaches or password-based mechanisms cannot fulfill the privacy and security demands in health monitoring due to their low efficiency and knowledge-based property. Biometric authentication overcomes these deficiencies and successfully verifies the inherent characteristics of humans. Among all biometrics, the electrocardiogram (ECG) signal is the most suitable one due to its medical properties. However, the security and privacy objectives of ECG-based authentication usually fail in practice due to the noise interferences in the collected ECG data and the privacy breach of the ECG database. In this paper, we propose a practical scheme that can reliably authenticate patients with noisy ECG signals and provide differentially private protection simultaneously. The effectiveness and efficiency of our scheme are thoroughly analyzed and evaluated over online datasets. We also conduct a pilot study on human subjects experiencing different exercise levels to validate our scheme.

Cloud privacy objectives a value based approach

PurposeTo effectively develop privacy policies and practices for cloud computing, organizations need to define a set of guiding privacy objectives that can be applied across their organization. It is argued that it is important to understand individuals’ privacy values with respect to cloud computing to define cloud privacy objectives.Design/methodology/approachFor the purpose of this study, the authors adopted Keeney’s (1994) value-focused thinking approach to identify privacy objectives with respect to cloud computing.FindingsThe results of this study identified the following six fundamental cloud privacy objectives: to increase trust with cloud provider, to maximize identity management controls, to maximize responsibility of information stewardship, to maximize individual’s understanding of cloud service functionality, to maximize protection of rights to privacy, and to maintain the integrity of data.Research limitations/implicationsOne limitation is generalizability of the cloud privacy objectives, and the second is research bias. As this study focused on cloud privacy, the authors felt that the research participants’ increased knowledge of technology usage, including that of cloud technology, was a benefit that outweighed risks associated with not having a random selection of the general population. The newness and unique qualities of privacy issues in cloud computing are better fitted to a qualitative study where issues can emerge naturally through a holistic approach opposed to trying to force fit an existing set of variables or constructs into the context of privacy and cloud computing.Practical implicationsThe findings of this research study can be used to assist management in the process of formulating a cloud privacy policy, develop cloud privacy evaluation criteria as well as assist auditors in developing their privacy audit work plans.Originality/valueCurrently, there is little to no guidance in the literature or in practice as to what organizations need to do to ensure they protect their stakeholders privacy in a cloud computing environment. This study works at closing this knowledge gap by identifying cloud privacy objectives.

Value-based information privacy objectives for Internet Commerce

The purpose of this paper is to define information privacy objectives based on values of individuals. The study is informed by the value-focused thinking approach that helps generate objectives for strategic decision makers. We employ a sequential mixed method approach in four phases. Phase 1 uses Value Theory to define individual values for information privacy. Using value-focused thinking the values are then converted into objectives. The objectives are classified into means and fundamentals based on their relative importance. In Phases 2 and 3, drawing on 207 and 458 respondents, respectively; we quantitatively define a more parsimonious set of objectives. In Phase 4, using a new sample of 221 respondents, we apply a confirmatory factorial analysis to test the models hypothesized in previous phases. In the final synthesis, a five-factor model of means and fundamental objectives is presented. Collectively the means and fundamental objectives for information privacy present a measurement scale, which is useful for researchers and marketers who wish to research how customer attitudes about how privacy influences Internet behavior. The objectives can also be useful for companies to design privacy for Internet Commerce.

A Watermark-Based Scheme for Authenticating JPEG Image Integrity

JPEG is the most common image format in smartphones, computers, or digital cameras. Because numerous JPEG images are easily shared and distributed, there are privacy and security concerns for these images. Hence, the JPEG committee has started a standardization called JPEG privacy and security to resolve these issues. The forgery detection of a JPEG image is the key objective of JPEG privacy and security. In this paper, we propose a novel forgery detection method that is watermark-based, for authenticating JPEG image integrity in the discrete cosine transform (DCT) domain. The proposed method aims at 100% detection accuracy for typical forgeries on JPEG image DCT blocks and to counter a well-known forgery attack called collage attack. For this purpose, the method splits the host image into a group of blocks (GOB). A watermark is generated by collaborating with the neighboring GOBs and is embedded into the GOBs. The experimental results using various sample images show the superiority of the proposed method, exhibiting a negligible visual difference between the original and watermarked JPEG images.

Increasing the Influence of Permission Safety on App Selections by Changes in Visual Representation

Previous studies have shown that inclusion of a permission safety score/cue in the early stage of selecting an app assists users in making safer choices (Chen, Gates, Li, & Proctor, 2015; Gates, Chen, Li, & Proctor, 2014; Rajivan & Camp, 2016). Yet, user ratings were typically weighted more in app-selection decisions than a summary permission safety score, suggesting that app-associated risks are not fully understood or known by users. In daily interactions, people make privacy decisions not just based on rational considerations but also on heuristics (e.g., take the first, Dogruel, Joeckel, & Bowman, 2015). Interfaces of popular online services and systems sometimes exploit these heuristics and biases to nudge people to act in ways that are not always aligned with their own intentions (Stutzma, Gross, & Acquisti, 2013). On the contrary, the goal of present study was to evaluate various formats for presenting the permission safety scores to nudge users to make decisions that are in better agreement with their security and privacy objectives. With 2 studies, we found that a 3-color representation of permission safety promotes safe behavior and communicates privacy of apps well. In Experiment 1, the permission safety score was placed above or below the user rating, and it was conveyed by a number from 1 to 5 paired with a shield or lock icon. The user rating was presented as a number from 1 to 5, paired with a gray star. Participants completed six app-selection tasks, in which, for each, two apps out of six were chosen. The percentage of app selection was higher with increased safety as well as increased user ratings. Permission safety interacted with user rating: For apps with lower user ratings the permission safety did not influence app selection, but for apps with higher user ratings an increased permission safety score led to more app selection. However, neither location (above or below) nor the icon type showed a main effect, nor did they interact. In Experiment 2, the 3-level permission safety score was conveyed by color (red, yellow, green), emoticons (frown, neutral, smile), color with emoticons, or a number from 1 to 3 paired with a lock icon. Participants performed the same tasks as Experiment 1. The results were similar as Experiment 1 except that presentation format interacted with permission safety score. Further analysis showed that that the permission safety score had more influence on app selection when it was represented by conditions with color coding, indicating that permission safety was weighted more in the app-selection decisions when permission safety was presented with 3-color-coding. The role of color in enhancing risk perception is consistent with the role of color in enhancing hazard perception in warning literature (Wogalter, 2006). Given the relative quickness of the decision and the limited cues that users consider during app selection, their attention should be directed to more important app-specific privacy characteristics. Our results provided evidence that 3-color coding can shift users’ attention and influence users to make safer app selections. In designing a visual privacy rating to nudge people away from risky apps, leveraging visual attributes that are prevalent for conveying valence is recommended.

Privacy Games Along Location Traces

The mainstream approach to protecting the privacy of mobile users in location-based services (LBSs) is to alter (e.g., perturb, hide, and so on) the users’ actual locations in order to reduce exposed sensitive information. In order to be effective, a location-privacy preserving mechanism must consider both the privacy and utility requirements of each user, as well as the user’s overall exposed locations (which contribute to the adversary’s background knowledge). In this article, we propose a methodology that enables the design of optimal user-centric location obfuscation mechanisms respecting each individual user’s service quality requirements, while maximizing the expected error that the optimal adversary incurs in reconstructing the user’s actual trace. A key advantage of a user-centric mechanism is that it does not depend on third-party proxies or anonymizers; thus, it can be directly integrated in the mobile devices that users employ to access LBSs. Our methodology is based on the mutual optimization of user/adversary objectives (maximizing location privacy versus minimizing localization error) formalized as a Stackelberg Bayesian game. This formalization makes our solution robust against any location inference attack, that is, the adversary cannot decrease the user’s privacy by designing a better inference algorithm as long as the obfuscation mechanism is designed according to our privacy games. We develop two linear programs that solve the location privacy game and output the optimal obfuscation strategy and its corresponding optimal inference attack. These linear programs are used to design location privacy--preserving mechanisms that consider the correlation between past, current, and future locations of the user, thus can be tuned to protect different privacy objectives along the user’s location trace. We illustrate the efficacy of the optimal location privacy--preserving mechanisms obtained with our approach against real location traces, showing their performance in protecting users’ different location privacy objectives.

Subtle Flaws in the Secure RFID Tag Searching Protocol: SRTS

Secure RFID searching emerged as a new application field in RFID systems finds out whether a specific RFID tag is nearby within a group of tags in a secure manner. Although numerous RFID authentication protocols have been proposed in different studies, RFID searching has not drawn much attention from the RFID community. Also, most of the existing RFID searching protocols do not comply with the EPC Class-1 Gen2 standard, because their designs employ hardware complex cryptographic primitives such as hash functions or complicated encryption schemes. Recently, Sundaresan et al. has introduced an ultra-lightweight secure RFID searching protocol which only requires a Pseudo Random Number Generator and XOR encryption, i.e. it can be implemented on low-cost EPC Class-1 Gen2 compliant RFID tags. The authors present a detailed security analysis of their protocol to prove its security correctness and they claim that the protocol fulfills the security and privacy requirements. In this study, however, we describe tracking, replay and tag impersonation attacks that show the protocol fails to bear out some of its privacy and security objectives.

Versatile Query Scrambling for Private Web Search

We consider the problem of privacy leaks suffered by Internet users when they perform web searches, and propose a framework to mitigate them. In brief, given a `sensitive' search query, the objective of our work is to retrieve the target documents from a search engine without disclosing the actual query. Our approach, which builds upon and improves recent work on search privacy, approximates the target search results by replacing the private user query with a set of blurred or scrambled queries. The results of the scrambled queries are then used to cover the private user interest. We model the problem theoretically, define a set of privacy objectives with respect to web search and investigate the effectiveness of the proposed solution with a set of queries with privacy issues on a large web collection. Experiments show great improvements in retrieval effectiveness over a previously reported baseline in the literature. Furthermore, the methods are more versatile, predictably-behaved, applicable to a wider range of information needs, and the privacy they provide is more comprehensible to the end-user. Additionally, we investigate the perceived privacy via a user study, as well as, measure the system's usefulness taking into account the trade off between retrieval effectiveness and privacy. The practical feasibility of the methods is demonstrated in a field experiment, scrambling queries against a popular web search engine. The findings may have implications for other IR research areas, such as query expansion, query decomposition, and distributed retrieval.

Deploying Privacy Improved RBAC in Web Information Systems

Access control technology holds a central role in achieving trustworthy management of personally identifiable information in modern information systems. In this article, a privacy-sensitive model that extends Role-Based Access Control (RBAC) to provide privacy protection through fine-grained and just-in-time access control in Web information systems is proposed. Moreover, easy and effective mapping of corresponding components is recognized as an important factor for succeeding in matching security and privacy objectives. Such a process is proposed to be accomplished by capturing and modeling privacy requirements in the early stages of information system development. Therefore, a methodology for deploying the mechanisms of an access control system conforming to the proposed Privacy Improved Role-Based Access Control (PIRBAC) model is presented. To illustrate the application of the proposed methodology, an application example in the healthcare domain is described.