Collaborative Research: A Comprehensive Policy-Driven Framework for Online Privacy Protection: Integrating IT, Human, Legal and Economic Perspectives

隐私日益成为人们关注的主要问题，它阻碍了对互联网全部潜力的开发。消费者关心他们所委托的敏感信息的网站的可信度。尽管业界正在努力寻求更好地保护在线敏感信息，但现有的解决方案仍然支离破碎，远不能令人满意。具体来说，用于指定隐私策略的现有语言缺乏正式和明确的语义，表达能力有限，缺乏强制执行和审计支持。此外，现有旨在增强最终用户对其隐私控制的隐私管理工具在功能上有限或难以使用。本项目旨在为保护在线隐私提供一个全面的框架，涵盖整个隐私政策生命周期。此周期包括企业策略创建、实施、分析和审计，以及最终用户代理表示和隐私策略处理。该项目将与隐私相关的人力、法律和经济观点纳入拟议框架。该项目将开发一种富有表现力的、基于语义的形式语言，用于指定隐私策略，一种访问控制和审计语言，用于在应用程序中执行隐私策略，以及用于验证隐私策略的理论和工具。此外，将进行实验和调查，以更好地了解用户隐私问题和保护目标的轴线。这项实证工作的结果将用于开发一个有效的范例，用于指定隐私偏好和方法，以准确和可访问的方式向最终用户呈现隐私政策。

Privacy is increasingly a major concern that prevents the exploitation of the Internet's full potential. Consumers are concerned about the trustworthiness of the websites to which they entrust their sensitive information. Although significant industry efforts are seeking to better protect sensitive information online, existing solutions are still fragmented and far from satisfactory. Specifically, existing languages for specifying privacy policies lack a formal and unambiguous semantics, are limited in expressive power and lack enforcement as well as auditing support. Moreover, existing privacy management tools aimed at increasing end-users' control over their privacy are limited in capability or difficult to use.This project seeks to provide a comprehensive framework for protecting online privacy, covering the entire privacy policy life cycle. This cycle includes enterprise policy creation, enforcement, analysis and auditing, as well as end user agent presentation and privacy policy processing. The project integrates privacy-relevant human, legal and economic perspectives in the proposed framework. This project will develop an expressive, semantics-based formal language for specifying privacy policies, an access control and auditing language for enforcing privacy policies in applications, as well as theory and tools for verifying privacy policies. Additionally, experiments and surveys will be conducted to better understand the axes of users' privacy concerns and protection objectives. Results from this empirical work will be used to develop an effective paradigm for specifying privacy preferences and methods to present privacy policies to end users in an accurate and accessible way.