SHF: Small: Towards Regulatory Compliance Software Engineering with UCON_LEGAL

SHF：小型：通过 UCON_LEGAL 实现监管合规性软件工程

• 批准号: 1217699
• 负责人: Ana Anton
• 金额: $ 40万
• 依托单位: North Carolina State University
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2012
• 资助国家: 美国
• 起止时间: 2012-08-01 至 2014-05-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1217699&HistoricalAwards=false
• 关键词: SHF; Small; Towards; Regulatory; Compliance

Software engineers need improved tools and methods for translating complex legal regulations into workable information technology systems. Compliance with legal requirements is an essential element in trustworthy systems. The research proposed herein will advance the cutting edge for creating more accurate, efficient, and reliable RCSE (Regulatory Compliance Software Engineering), resulting in compliant software systems. System specifications typically concentrate on system-level entities, whereas legal discussions emphasize fundamental rights and obligations discursively. This work bridges three cultures of scholarship and research: software specification, law, and access control. By empowering software developers and policy makers to better understand regulatory texts and the access controls specified within these texts, current and future software systems will be better aligned with the law.There are three main expected results of this work: (1) Framework, methodology and heuristics to identify UCONLEGAL components in legal texts; (2) extended TLA (Temporal Logic of Actions) rules from UCONABC and mapping of predicates, actions, states, variables and obligations between UCONLEGAL and UCONABC; (3) validated and extended role-based access controls to meet healthcare and financial legal requirements through further development of UCONLEGAL. The impacts of this work are expected to be far reaching; law and regulations govern the collection, use, transfer and removal of information from software systems in many sectors of society, and this research explicitly calls for models and theories for analyzing and reasoning about security and privacy in a regulatory and legal context.

软件工程师需要改进工具和方法，将复杂的法律法规转化为可行的信息技术系统。遵守法律规定是诚信制度的基本要素。本文提出的研究将推动创建更准确、高效和可靠的RCSE（法规遵从性软件工程）的前沿，从而产生兼容的软件系统。系统规范通常集中于系统级实体，而法律讨论则强调基本权利和义务。这项工作连接了三种学术和研究文化：软件规范、法律和访问控制。通过授权软件开发人员和政策制定者更好地理解法规文本和这些文本中指定的访问控制，当前和未来的软件系统将更好地与法律保持一致。这项工作有三个主要的预期结果：(1)识别法律文本中不合法成分的框架、方法和启发式；(2)从UCONABC扩展TLA （Temporal Logic of Actions）规则，并在UCONLEGAL和UCONABC之间映射谓词、动作、状态、变量和义务；(3)通过进一步发展unconlegal，验证和扩展基于角色的访问控制，以满足医疗保健和财务方面的法律要求。预计这项工作的影响将是深远的；法律和法规管理着社会许多部门软件系统中信息的收集、使用、传输和删除，本研究明确要求在监管和法律背景下分析和推理安全和隐私的模型和理论。