TWC: Small: Workflows and Relationships for End-to-End Data Security in Collaborative Applications

TWC：小：协作应用程序中端到端数据安全的工作流程和关系

• 批准号: 1320798
• 负责人: Dominic Duggan
• 金额: $ 49.88万
• 依托单位: Stevens Institute of Technology
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2013
• 资助国家: 美国
• 起止时间: 2013-09-01 至 2019-08-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1320798&HistoricalAwards=false
• 关键词: TWC; Small; Workflows; Relationships; End

Access control refers to mechanisms for protecting access to confidential information, such as sensitive medical data. Management of access control policies, in applications that involve several collaborating parties, poses several challenges. One of these is in ensuring that each party in such a collaboration only obtains the minimal set of access permissions that they require for the collaboration. In a domain such as healthcare, it may be critical that access be minimized in this way, rather than allowing all parties equal access to the sensitive information. In practice, it is often difficult to manage access control policies to achieve this goal of minimality. This research will investigate new approaches to describing and reasoning about access control policies, to ensure that information that is shared in collaborative applications is only accessible to those parties in the application that require it. This work will develop both the theoretical foundations of, and prototype tools for, ensuring end-to-end security of data that is shared between organizations, with sharing of medical data as a particular source for use-case scenarios.On one dimension, the project will investigate the extension of workflow languages to describe protocols for sharing information in collaborate applications. On another dimension, relationship-based access control can describe access to information based on parties' roles in a collaboration. The project will investigate the use of spatial and temporal logics for relating these two, and user interfaces for presenting and reasoning about this information. Since ultimately software programs will perform the access and transfer of patient medical data, formal specifications will be extracted from workflow specifications, and used as a basis for checking software programs for their compliance with these access control policies. The broader impact of this research will be facilitated by the P.I.'s involvement with the NIH International Epidemiologic Databases on AIDS for Central Africa project (CA-IeDEA). The fruits of the research will be disseminated through interaction with open source communities involved in healthcare IT for low and middle income countries, as well as through interactions with lead healthcare IT decision-makers in the countries involved in CA-IeDEA.

访问控制是指保护对机密信息（如敏感医疗数据）的访问的机制。在涉及多个协作方的应用程序中，访问控制策略的管理带来了一些挑战。其中之一是确保这种协作中的每一方只获得协作所需的最小访问权限集。在医疗保健等领域中，以这种方式最大限度地减少访问，而不是允许所有各方平等地访问敏感信息，这一点至关重要。在实践中，通常很难通过管理访问控制策略来实现最小化的目标。本研究将探讨描述和推理访问控制策略的新方法，以确保协作应用程序中共享的信息仅供应用程序中需要它的各方访问。这项工作将开发理论基础和原型工具，以确保组织之间共享数据的端到端安全性，并将医疗数据作为用例场景的特定来源共享。在一个维度上，该项目将研究工作流语言的扩展，以描述协作应用程序中共享信息的协议。在另一个维度上，基于关系的访问控制可以根据各方在协作中的角色描述对信息的访问。该项目将研究空间和时间逻辑的使用，将这两者联系起来，并使用用户界面来呈现和推理这些信息。由于最终将由软件程序执行对患者医疗数据的访问和传输，因此将从工作流规范中提取正式规范，并将其用作检查软件程序是否符合这些访问控制策略的基础。这项研究的更广泛的影响将由P.I.促进美国国立卫生研究院国际艾滋病流行病学数据库中非项目（CA-IeDEA）的参与。研究成果将通过与参与中低收入国家医疗保健信息技术的开源社区的互动，以及与参与CA-IeDEA的国家的主要医疗保健信息技术决策者的互动来传播。