Collaborative Research: A Comprehensive Policy-Driven Framework for Online Privacy Protection: Integrating IT, Human, Legal and Economic Perspectives

隐私日益成为一个主要问题，阻碍了互联网的全部潜力的开发。消费者担心他们委托其敏感信息的网站的可信度。尽管业界正在努力寻求更好地保护在线敏感信息，但现有的解决方案仍然是分散的，远远不能令人满意。具体而言，现有的语言，用于指定隐私政策缺乏正式和明确的语义，表达能力有限，缺乏执法以及审计支持。此外，现有的隐私管理工具旨在加强最终用户对其隐私的控制，但这些工具的功能有限或难以使用。该项目旨在提供一个保护在线隐私的综合框架，涵盖整个隐私政策生命周期。此周期包括企业策略创建、执行、分析和审计，以及最终用户代理呈现和隐私策略处理。该项目将与隐私有关的人、法律的和经济观点纳入拟议的框架。该项目将开发一种用于指定隐私策略的表达性的、基于语义的形式化语言，一种用于在应用程序中执行隐私策略的访问控制和审计语言，以及用于验证隐私策略的理论和工具。 此外，将进行实验和调查，以更好地了解用户隐私问题和保护目标的轴心。 这项实证工作的结果将被用来制定一个有效的范式，指定隐私偏好和方法，以准确和可访问的方式向最终用户提供隐私政策。

Privacy is increasingly a major concern that prevents the exploitation of the Internet's full potential. Consumers are concerned about the trustworthiness of the websites to which they entrust their sensitive information. Although significant industry efforts are seeking to better protect sensitive information online, existing solutions are still fragmented and far from satisfactory. Specifically, existing languages for specifying privacy policies lack a formal and unambiguous semantics, are limited in expressive power and lack enforcement as well as auditing support. Moreover, existing privacy management tools aimed at increasing end-users' control over their privacy are limited in capability or difficult to use.This project seeks to provide a comprehensive framework for protecting online privacy, covering the entire privacy policy life cycle. This cycle includes enterprise policy creation, enforcement, analysis and auditing, as well as end user agent presentation and privacy policy processing. The project integrates privacy-relevant human, legal and economic perspectives in the proposed framework. This project will develop an expressive, semantics-based formal language for specifying privacy policies, an access control and auditing language for enforcing privacy policies in applications, as well as theory and tools for verifying privacy policies. Additionally, experiments and surveys will be conducted to better understand the axes of users' privacy concerns and protection objectives. Results from this empirical work will be used to develop an effective paradigm for specifying privacy preferences and methods to present privacy policies to end users in an accurate and accessible way.