Collaborative Research: A Comprehensive Policy-Driven Framework for Online Privacy Protection: Integrating IT, Human, Legal and Economic Perspectives

隐私日益成为阻碍互联网充分发挥潜力的一个主要问题。消费者担心他们将敏感信息委托给的网站的可信度。尽管业界正在寻求更好地保护在线敏感信息，但现有的解决方案仍然支离破碎，远远不能令人满意。具体地说，现有的用于指定隐私策略的语言缺乏正式和明确的语义，表达能力有限，缺乏强制执行和审计支持。此外，现有的隐私管理工具旨在加强最终用户对其隐私的控制，功能有限或难以使用。该项目旨在提供一个全面的框架来保护在线隐私，涵盖整个隐私政策生命周期。此周期包括企业策略创建、实施、分析和审计，以及终端用户代理提交和隐私策略处理。该项目在拟议的框架中整合了与隐私相关的人、法律和经济角度。该项目将开发一种用于指定隐私策略的具有表现力的、基于语义的形式语言，一种用于在应用程序中执行隐私策略的访问控制和审计语言，以及用于验证隐私策略的理论和工具。此外，还将进行实验和调查，以更好地了解用户隐私关切和保护目标的轴心。这项经验性工作的结果将被用来开发一个有效的范例，用于指定隐私偏好和方法，以准确和可访问的方式向最终用户展示隐私政策。

Privacy is increasingly a major concern that prevents the exploitation of the Internet's full potential. Consumers are concerned about the trustworthiness of the websites to which they entrust their sensitive information. Although significant industry efforts are seeking to better protect sensitive information online, existing solutions are still fragmented and far from satisfactory. Specifically, existing languages for specifying privacy policies lack a formal and unambiguous semantics, are limited in expressive power and lack enforcement as well as auditing support. Moreover, existing privacy management tools aimed at increasing end-users' control over their privacy are limited in capability or difficult to use.This project seeks to provide a comprehensive framework for protecting online privacy, covering the entire privacy policy life cycle. This cycle includes enterprise policy creation, enforcement, analysis and auditing, as well as end user agent presentation and privacy policy processing. The project integrates privacy-relevant human, legal and economic perspectives in the proposed framework. This project will develop an expressive, semantics-based formal language for specifying privacy policies, an access control and auditing language for enforcing privacy policies in applications, as well as theory and tools for verifying privacy policies. Additionally, experiments and surveys will be conducted to better understand the axes of users' privacy concerns and protection objectives. Results from this empirical work will be used to develop an effective paradigm for specifying privacy preferences and methods to present privacy policies to end users in an accurate and accessible way.