Collaborative Research: SaTC: CORE: Medium: Compliance as a Service (CaSe): A Reflective Approach to Enforcing User Privacy Regulations

该项目旨在改造现有的数据基础设施，使之符合用户数据保护立法和法规。该项目的创新之处在于其数据保护政策合规性的正式模型，该模型帮助系统设计人员对法规进行推理，并证明系统符合法规。该项目的更广泛意义在于，它有可能解决与物联网和云计算等新兴技术相关的消费者隐私和数据安全问题。正如最近涉及企业使用消费者数据的事件所表明的那样，在现代信息时代，隐私和数据安全问题与对民主、平等、国家安全和自由的担忧日益联系在一起，所有这些问题都对个人和社会都有影响。这项工作的好处包括管理网络威胁，以及解决利用个人和敏感数据的应用程序中的数据隐私和政策问题。这项工作还包括针对社区大学和高中生以及计算机领域代表性不足群体的学生的教育推广工作，目的是让他们接触到具有社区利益的研究。该项目由四个研究推动力组成。第一个提供数据保护立法和法规的基础，以提供以系统设计为中心的政策遵从性正式模式。这涉及到研究开发正式模式在确认和证明遵守条例方面的影响。第二个重点是解决在管理跨不同系统组件发送的转换数据的策略方面的挑战，这涉及设计表示数据和策略转换的数据抽象。第三个重点包括使现有和遗留数据系统能够有效和快速适应政策变化的方法。这包括设计基于策略进行分片的数据结构，从而隔离受策略更改影响的数据碎片。第四项奖励提供了一个可扩展的分布式日志记录系统，以满足数据保护法规的审计要求。该奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

This project seeks to enable transforming existing data infrastructures to comply with user data protection legislation and regulations. The project's novelties are its formal model of data protection policy compliance that helps system designers to reason about regulations and demonstrate systems’ compliance with them. The project's broader significance is its potential to address consumer privacy and data security concerns associated with emerging technologies, such as the Internet of Things and cloud computing. As recent events involving corporate use of consumer data have demonstrated, privacy and data security issues are increasingly connected in the modern information age to concerns about democracy, equality, national security, and freedom, all of which carrying implications for both individuals and society. The benefits of this work include managing cyber threats and addressing data privacy and policy concerns in applications that utilize personal and sensitive data. The work also includes educational outreach efforts targeting community college and high school students, as well as students from underrepresented groups in computing with the goal to expose them to research with community benefits.The project consists of four research thrusts. The first provides a grounding of data protection legislation and regulation to provide a system design-centric formal model of policy compliance. This involves studying the implications of developing a formal model in terms of validating and proving compliance with regulations. The second thrust tackles the challenges in managing policies of transformed data sent across different system components, which involves designing data abstractions that express the data and policy transformation. The third thrust includes methods that allow efficient and fast adaptation of existing and legacy data systems to policy changes. This includes designing data structures that are sharded based on policies, enabling isolation of the data shards impacted by policy changes. The fourth thrust provides a scalable distributed logging system to cater to the auditing requirements of data protection regulations.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.