Framework for Privacy-Aware Web Service Logging

Web service logging is required within an organization to record inbound and outbound messages that are passed through a web service for the purpose of checking of data security violation, checking of data integrity, and supporting computer-related legal investigation. The inbound and outbound messages of a web service usually contain personal information or are sensitive records of service use which need privacy control. This paper proposes a framework to facilitate privacy-aware web service logging. The framework supports the ICT standard team of an organization to standardize the names and types of data which are to be used to define the input and output data elements of a web service. Based on the standardized data elements, the ICT standard team and a system analyst use a privacy policy language of the framework to define a privacy policy for logging web service input and output data elements. Also, the framework provides a logging web service that can be invoked by other web service to automatically log its inbound and outbound messages according to the privacy policy. In an experiment with web services of a mobile phone operator in Thailand, the use of this framework can facilitate web service development and can significantly decrease the percentage of web service audit rejects that are caused by lack of privacy protection in web service log files.