Contributing Partners

AIT, ATOS, GUF, KAU, LISPA, SIC

Executive Summary

The CREDENTIAL Wallet provides a privacy preserving and user-friendly data sharing service by using novel cryptographic algorithms such as proxy re-encryption and malleable signatures. As such, the development of the core Wallet follows a privacy-by-design approach. To support this approach, privacy and usability requirements were gathered following best practices for user-centred requirements. These requirements serve as inputs to other work packages in the project, namely, the privacy analysis and the technology selection process, the design and implementation of the Wallet architecture, as well as the pilot developments.

This deliverable documents the privacy and usability requirements as well as the processes followed to elicit them. An interim version of the deliverable has served as input to other deliverables such as D3.3 [47] and D5.1 [48] in the CREDENTIAL project. The interim version also prepared the first and second levels of DFD of the CREDENTIAL Wallet architecture. D3.3 then took over to analyse the privacy aspects.

The result of D3.3 [47] is categorised in three-level privacy threats namely high, medium and low impact privacy threats. For simplicity and less-risky nature of the low privacy threats, D3.3 decided to proceed with the high and medium privacy threats. As such, D2.6 then took over and applied the LINDDUN methodology on next steps to convert these threats into privacy requirements. Thus, in this final version, more privacy requirements are included as a result of the LINDDUN process executed in D3.3 [47] and interim version of this deliverable. This is in addition to the literature review, stakeholder workshop and internal expertise utilized to analyse the system and elicit privacy requirements taking user-centric approaches and guidelines into consideration. Furthermore, this deliverable takes the EU General Data Protection Regulation (GDPR) [13] as opportunity to derive privacy and usability requirements. Additionally, usability requirements are elicited following human-centred design approaches, and testing HCI requirements. In particular, we conducted usability tests on user interfaces by lay users as participants, the results of which are documented as usability requirements in Section 4. The results of the stakeholder workshop relevant to the usability requirements are also reported in Section 4.

Broadly, the requirements are classified into usability and privacy. The privacy requirements are further classified into legal and technical requirements. Each requirement has nine fields that describe it and also state criteria to accept this requirement.

In summary, the deliverable first introduces the project objectives and outlines the connection of this deliverable to other deliverables in the project. It then illustrates the methodology (cf. Section 2) followed to derive the requirements. The next sections (Sections 3 and 4) introduce the actual requirements and Section 5 concludes the work.

*This deliverable will be made available after acceptance by the European Commission in late 2018.