Collaborative Research: DASS: A Socio-Technical Framework for Handling Digital Evidence with Security and Privacy Assurances

合作研究：DASS：处理具有安全和隐私保证的数字证据的社会技术框架

• 批准号: 2131509
• 负责人: Gokila Dorai
• 金额: $ 56.95万
• 依托单位: AUGUSTA UNIVERSITY RESEARCH INSTITUTE, INC.
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2021
• 资助国家: 美国
• 起止时间: 2021-10-01 至 2025-03-31
• 项目状态: 未结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=2131509&HistoricalAwards=false
• 关键词: Collaborative; Research; DASS; Socio; Technical

The ever-increasing use of digital devices in society is creating mounting privacy risks. Above all, complementary desires from technology companies and law enforcement to harness the vast troves of data stored on our devices are complicating privacy interests in seclusion, autonomy, and anonymity. Though data privacy has received significant attention from both technological and legal angles, the two scholarly perspectives rarely combine to expose the interdisciplinary dependencies and synergies inherent in this topic of growing significance to our society. Using the context of digital evidence collection, this project studies legal and technical angles to privacy and security concerns. From the technical side, the investigators study how the data can be searched in a more targeted fashion and how data can be kept from unauthorized alteration. From the legal side, new technical capabilities will motivate new scholarship on related topics. The rise of digital evidence in criminal proceedings triggers two principal issues guiding this project. First, under the Fourth Amendment to the Constitution, judges often limit device searches to specific data relevant to the investigation, despite the complication that various types of data may be intermixed. Second, once law enforcement has collected digital evidence, they must guard against tampering and prevent privacy invasions by both “inside” and “outside” hackers. This project addresses these two sets of challenges through the following contributions: 1) Developing software that responds to legal directives (including warrant-based and consent-based restrictions governing the scope of digital searches) and retrieves only relevant evidence from a device containing intermingled data, using a combination of metadata-based analysis and natural language processing (NLP) techniques; 2) Addressing the ambiguity in natural language directives and the accuracy limitations of automatic classification, while considering legal and social consequences of violating privacy and conducting unauthorized searches; 3) Providing security mechanisms that preserve data confidentiality and detect data tampering; 4) Using blockchain technology to create immutable logs of all accesses to, and modification of, data stored by law enforcement; and 5) Further developing and applying formal verification techniques that reason about the security of the protocols implemented. In addition to enhancing digital forensics, the work is applicable to data practices in both government and industry, particularly in dealing with heterogeneous data and separating and securing data in contexts far beyond criminal proceedings. The project impacts several existing and new classes in terms of curriculum development, cutting across digital forensics, security, and data sciences.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.

数字设备在社会中的使用越来越多，这带来了越来越大的隐私风险。最重要的是，科技公司和执法部门对利用存储在我们设备上的大量数据的互补愿望，正在使隐私利益在隔离、自主和匿名方面变得复杂。虽然数据隐私从技术和法律的角度都受到了极大的关注，但这两种学术观点很少联合收割机来揭示这个对我们社会日益重要的主题所固有的跨学科依赖性和协同作用。利用数字证据收集的背景下，这个项目研究的法律的和技术角度的隐私和安全问题。从技术方面来看，调查人员研究如何以更有针对性的方式搜索数据，以及如何防止未经授权的更改。从法律的方面来看，新的技术能力将激发相关主题的新学术。刑事诉讼中数字证据的兴起引发了指导该项目的两个主要问题。首先，根据宪法第四修正案，法官通常将设备搜索限制在与调查相关的特定数据上，尽管各种类型的数据可能会混合在一起。其次，一旦执法部门收集到数字证据，他们必须防止篡改，防止“内部”和“外部”黑客入侵隐私。本项目通过以下贡献来解决这两组挑战：1）开发响应法律的指令的软件（包括基于许可和基于同意的数字搜索范围限制），并使用基于元数据的分析和自然语言处理（NLP）技术的组合，仅从包含混合数据的设备中检索相关证据; 2）解决自然语言指令中的模糊性和自动分类的准确性限制，同时考虑侵犯隐私和进行未经授权的搜索的法律的和社会后果; 3）提供保护数据机密性和检测数据篡改的安全机制; 4）使用区块链技术创建对执法部门存储的数据的所有访问和修改的不可变日志; 5）进一步开发和应用形式化验证技术，以推断所实施协议的安全性。除了加强数字取证外，这项工作还适用于政府和行业的数据实践，特别是在处理异构数据以及在远远超出刑事诉讼范围的情况下分离和保护数据方面。该项目在课程开发方面影响了几个现有的和新的课程，涉及数字取证，安全和数据科学。该奖项反映了NSF的法定使命，并通过使用基金会的智力价值和更广泛的影响力审查标准进行评估，被认为值得支持。

项目成果

Privacy-Preserving Framework to Facilitate Shared Data Access for Wearable Devices

• DOI: 10.1109/bigdata52589.2021.9671690
• 发表时间: 2021-12
• 期刊: 2021 IEEE International Conference on Big Data (Big Data)
• 作者: Dane Troyer;Justine Henry;Hoda Maleki;Gokila Dorai;Bethany Sumner;G. Agrawal;Jon Ingram

Preliminary Analysis of Privacy Implications Observed in Social-Media Posts Across Shopping Platforms

对跨购物平台社交媒体帖子中观察到的隐私影响的初步分析

• DOI: 10.1145/3538969.3544457
• 发表时间: 2022
• 期刊: Preliminary Analysis of Privacy Implications Observed in Social-Media Posts Across Shopping Platforms
• 作者: Sumner, Bethany;Dorai, Gokila;Heslen, John
• 通讯作者: Heslen, John

Mobile Commerce - Analysis and Investigation of the Online Safety, Privacy, and Data Forensics of Amazon and Etsy Apps

移动商务 - Amazon 和 Etsy 应用程序的在线安全、隐私和数据取证的分析和调查

• 发表时间: 2023
• 期刊: Proceedings of the 56th Hawaii International Conference on System Sciences
• 作者: Gokila Dorai, Shinelle Hutchinson