SHF: Small: Towards Regulatory Compliance Software Engineering with UCON_LEGAL

软件工程师需要改进的工具和方法来将复杂的法律的规定转化为可行的信息技术系统。遵守法律的要求是可信系统的基本要素。本文提出的研究将推进前沿创建更准确，高效和可靠的RCSE（法规遵从性软件工程），从而产生兼容的软件系统。系统规范通常集中在系统级实体上，而法律的讨论则以话语方式强调基本权利和义务。这项工作弥合了学术和研究的三种文化：软件规范，法律和访问控制。通过授权软件开发者和政策制定者更好地理解法规文本和这些文本中规定的访问控制，当前和未来的软件系统将更好地与法律保持一致。这项工作的主要预期成果有三个：（1）识别法律的文本中UCONLEGAL组件的框架、方法和技巧;（2）延长TLA（动作的时间逻辑）UCONABC规则和UCONLEGAL和UCONABC之间的谓词、动作、状态、变量和义务的映射;（3）通过进一步开发UCONLEGAL，验证和扩展基于角色的访问控制，以满足医疗保健和财务法律的要求。这项工作的影响预计将是深远的;法律和法规管理的收集，使用，转移和删除的信息从软件系统在社会的许多部门，这项研究明确呼吁模型和理论分析和推理的安全和隐私的监管和法律的背景下。

Software engineers need improved tools and methods for translating complex legal regulations into workable information technology systems. Compliance with legal requirements is an essential element in trustworthy systems. The research proposed herein will advance the cutting edge for creating more accurate, efficient, and reliable RCSE (Regulatory Compliance Software Engineering), resulting in compliant software systems. System specifications typically concentrate on system-level entities, whereas legal discussions emphasize fundamental rights and obligations discursively. This work bridges three cultures of scholarship and research: software specification, law, and access control. By empowering software developers and policy makers to better understand regulatory texts and the access controls specified within these texts, current and future software systems will be better aligned with the law.There are three main expected results of this work: (1) Framework, methodology and heuristics to identify UCONLEGAL components in legal texts; (2) extended TLA (Temporal Logic of Actions) rules from UCONABC and mapping of predicates, actions, states, variables and obligations between UCONLEGAL and UCONABC; (3) validated and extended role-based access controls to meet healthcare and financial legal requirements through further development of UCONLEGAL. The impacts of this work are expected to be far reaching; law and regulations govern the collection, use, transfer and removal of information from software systems in many sectors of society, and this research explicitly calls for models and theories for analyzing and reasoning about security and privacy in a regulatory and legal context.