![](bg9.png)
ity of our framework to represent accountability obli-
gations was validated through a realistic health care
use case.
Our future research work will focus on the map-
ping from AAL to A-PPL. As part of our implemen-
tation perspectives, we are currently working on two
prototypes. An AAL editor that assists end-users in
writing their preferences/obligations and implements
the required artifacts to map them to concrete policies
in A-PPL. We also started the development of an A-
PPL policy execution engine that will be in charge of
interpreting and matching A-PPL policies and prefer-
ences
ACKNOWLEDGEMENTS
This work was funded by the EU’s 7th framework
A4Cloud project.
REFERENCES
Aktug, I. and Naliuka, K. (2008). ConSpec – a formal lan-
guage for policy specification. In Electronic Notes
in Theoretical Computer Science, volume 197, pages
45–58.
Allam, D., Douence, R., Grall, H., Royer, J.-C., and
S
¨
udholt, M. (2012). Well-Typed Services Cannot Go
Wrong. Rapport de recherche RR-7899, INRIA.
Ardagna, C. A., Bussard, L., De Capitani Di Vimer-
cati, S., Neven, G., Paraboschi, S., Pedrini,
E., Preiss, S., Raggett, D., Samarati, P., Tra-
belsi, S., and Verdicchio, M. (2009). Primelife
policy language. http://www.w3.org/2009/policy-
ws/papers/Trabelisi.pdf.
Becker, M. Y., Malkis, A., and Bussard, L. (2010). S4P:
A generic language for specifying privacy preferences
and policies. Microsoft Research.
Bernsmed, K., Felici, M., Oliveira, A. S. D., Sendor, J.,
Moe, N. B., R
¨
ubsamen, T., Tountopoulos, V., and Has-
nain, B. (2013). Use case descriptions. Deliverable,
Cloud Accountability (A4Cloud) Project.
Bradner, S. (1997). IETF RFC 2119: Key words for use
in RFCs to Indicate Requirement Levels. Technical
report.
Breaux, T. D. and Anton, A. I. (2005). Deriving semantic
models from privacy policies. In Sixth IEEE Interna-
tional Workshop on Policies for Distributed Systems
and Networks (POLICY ’05), pages 67–76.
Cranen, S., Groote, J. F., Keiren, J. J. A., Stappers, F. P. M.,
de Vink, E. P., Wesselink, W., and Willemse, T. A. C.
(2013). An overview of the mCRL2 toolset and its
recent advances. TACAS’13, pages 199–213, Berlin,
Heidelberg. Springer-Verlag.
DeYoung, H., Garg, D., Jia, L., Kaynar, D., and Datta, A.
(2010). Experiences in the logical specification of the
HIPAA and GLBA privacy laws. In 9th Annual ACM
Workshop on Privacy in the Electronic Society (WPES
’10), pages 73–82.
Directive, E. U. (1995). Directive 95/46/EC of
the European Parliament and of the Council of
24 October 1995 on the protection of individ-
uals with regard to the processing of personal
data and on the free movement of such data
. http://ec.europa.eu/justice/policies/privacy/docs/95-
46-ce/dir1995-46 part1 en.pdf.
Feigenbaum, J., Jaggard, A. D., Wright, R. N., and Xiao,
H. (2012). Systematizing ”accountability” in com-
puter science. Technical Report YALEU/DCS/TR-
1452, University of Yale.
Garaga, A., de Oliveira, A. S., Sendor, J., Azraoui, M.,
Elkhiyaoui, K., Molva, R.,
¨
Onen, M., Cherrueau, R.-
A., Douence, R., Grall, H., Royer, J.-C., Sellami, M.,
S
¨
udholt, M., and Bernsmed, K. (2013). Policy Repre-
sentation Framework. Technical Report D:C-4.1, Ac-
countability for Cloud and Future Internet Services -
A4Cloud Project.
Haeberlen, A., Aditya, P., Rodrigues, R., and Druschel,
P. (2010). Accountable virtual machines. In OSDI,
pages 119–134.
Jagadeesan, R., Jeffrey, A., Pitcher, C., and Riely, J.
(2009). Towards a theory of accountability and audit.
In Proceedings of the 14th European conference on
Research in computer security, ESORICS’09, pages
152–167, Berlin, Heidelberg. Springer-Verlag.
Kerrigan, S. and Law, K. H. (2003). Logic-based regulation
compliance-assistance. In International Conference
on Artificial Intelligence and Law, pages 126–135.
Knuth, D. E. (1964). backus normal form vs. backus naur
form. Commun. ACM, 7(12):735–736.
Lamanna, D. D., Skene, J., and Emmerich, W. (2003).
SLAng: A Language for Defining Service Level
Agreements. In Proceedings of the The Ninth IEEE
Workshop on Future Trends of Distributed Computing
Systems, pages 100–, Washington, DC, USA. IEEE
Computer Society.
Legislative Assembly of Ontario (1988). Freedom of in-
formation and protection of privacy act (r.s.o. 1990, c.
f.31).
Marchiori, M. (2002). The platform for privacy prefer-
ences 1.0 (P3P1.0) specification. W3C recommen-
dation, W3C. http://www.w3.org/TR/2002/REC-P3P-
20020416/.
M
´
etayer, D. L. (2009). A formal privacy management
framework. Formal Aspects in Security and Trust,
pages 1–15.
OASIS Standard (2013). eXtensible Access Control
Markup Language (XACML) Version 3.0. 22 January
2013. http://docs.oasis-open.org/xacml/3.0/xacml-
3.0-core-spec-os-en.html.
Pearson, S., Tountopoulos, V., Catteddu, D., S
¨
udholt, M.,
Molva, R., Reich, C., Fischer-H
¨
ubner, S., Millard, C.,
Lotz, V., Jaatun, M. G., Leenes, R., Rong, C., and
Lopez, J. (2012). Accountability for cloud and other
future internet services. In CloudCom, pages 629–
632. IEEE.
ACloudAccountabilityPolicyRepresentationFramework
497