ITR: Encoding Rights, Permissions and Obligations: Privacy Policy Specification and Compliance

ITR：编码权利、许可和义务：隐私政策规范和合规性

• 批准号: 0325269
• 负责人: Ana Anton
• 金额: --
• 依托单位: North Carolina State University
• 依托单位国家: 美国
• 项目类别: Continuing Grant
• 财政年份: 2003
• 资助国家: 美国
• 起止时间: 2003-09-15 至 2010-02-28
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=0325269&HistoricalAwards=false
• 关键词: ITR; Encoding; Rights; Permissions; Obligations

ABSTRACT0325269Ana AntonNorth Carolina StateObjectives: The objectives of the proposed work are to (a) develop a framework and software tools that support policy and requirements specification, run-time privacy enforcement and end-user privacy management, and (b) conduct surveys of members of the public who use IT systems for information transactions to investigate their perceptions of rights, permissions and obligations.Results: There are three main expected results of this work. First, tools will be produced to aid policy makers in determining the ramifications of policy changes to ensure that, as policy evolves, conflicts and inconsistencies may be prevented. Second, tools will be produced to aid organizations as they enforce and verify policy compliance.Third, tools will be produced to empower end-users to manage their own privacy. Intellectual Merit Claims: This work aims to bridge two cultures of scholarship and research: technical specification and privacy policy. Specifications of systems typically concentrate on system-level entities (e.g. cookies), whereas policy discussions emphasize fundamental rights discursively. This proposal will formulate a framework ontology of rights, permissions and obligations (RPO) based on rigorous models of obligation and actionsimilar to those previously used by the Co-PI in research into requirements specification, but informed also by the best current models from formal jurisprudence. The proposed surveys of user views about RPOs concerning personal information in the healthcare domain are informed by the PI's previous work in methodologies of goal refinement in e-commerce and other applications of IT and her survey research conducted under an existing NSF ITR grant and will directly influence the construction of tools that support the specification and compliance checking of policydriven IT systems. These tools in turn will integrate the framework and survey results with an industry standard privacy preferences platform, P3P, going beyond P3P to allow specification and monitoring of privacy RPOs at a semantic level that users and IT professionals share. The project team has a proven track record of successful research collaboration on requirements and policy analysis that bridges the two cultures identified. The proposed activity is creative in its foundational thinking and promises to produce currently unavailable technology and survey results. The project activities are distributed over the course of five years with proactive management by the PI with workshops scheduled to help track progress and invite external evaluation of project results. North Carolina State University and Georgia Tech are well equipped and supported to conduct this work.

摘要0325269 Ana AntonNorth卡罗莱纳州目标：拟议工作的目标是：（a）开发一个框架和软件工具，以支持政策和需求规范、运行时隐私执行和最终用户隐私管理，以及（B）对使用IT系统进行信息交易的公众成员进行调查，以调查他们对权利、许可和义务的看法。这项工作有三个主要预期成果。第一，将制定工具，帮助决策者确定政策变化的后果，以确保随着政策的演变，可以防止冲突和不一致。第二，将开发工具来帮助组织执行和验证政策合规性;第三，将开发工具来授权最终用户管理自己的隐私。知识价值声明：这项工作旨在弥合学术和研究的两种文化：技术规范和隐私政策。系统规范通常集中在系统级实体（例如cookie）上，而政策讨论则强调基本权利。该建议将制定一个框架本体的权利，许可和义务（RPO）的基础上严格的模型的义务和actionsimilar以前使用的Co-PI在研究需求规范，但也通知了最好的当前模型从正式的法理学。建议的用户意见调查的RPO有关的个人信息在医疗保健领域的通知由PI的以前的工作在电子商务和其他应用程序的目标细化的方法和她的调查研究下进行现有的NSF ITR赠款，并将直接影响建设的工具，支持规范和政策驱动的IT系统的合规性检查。这些工具反过来将把框架和调查结果与行业标准隐私偏好平台P3 P集成在一起，超越P3 P，允许在用户和IT专业人员共享的语义级别上规范和监控隐私RPO。该项目小组在需求和政策分析方面的成功研究合作方面有着良好的记录，这是两种文化的桥梁。拟议的活动在其基本思想方面具有创造性，并有望产生目前无法获得的技术和调查结果。项目活动分布在五年期间，由主要参与者进行积极管理，安排讲习班帮助跟踪进展情况，并邀请外部对项目成果进行评估。北卡罗来纳州州立大学和格鲁吉亚理工学院有很好的设备和支持来进行这项工作。