Collaborative Research: SaTC: CORE: Medium: Compliance as a Service (CaSe): A Reflective Approach to Enforcing User Privacy Regulations

协作研究：SaTC：核心：媒介：合规即服务 (CaSe)：执行用户隐私法规的反思性方法

• 批准号: 2245372
• 负责人: Faisal Nawab
• 金额: $ 74.31万
• 依托单位: University of California-Irvine
• 依托单位国家: 美国
• 项目类别: Continuing Grant
• 财政年份: 2023
• 资助国家: 美国
• 起止时间: 2023-07-15 至 2026-06-30
• 项目状态: 未结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=2245372&HistoricalAwards=false
• 关键词: Collaborative; Research; SaTC; CORE; Medium

This project seeks to enable transforming existing data infrastructures to comply with user data protection legislation and regulations. The project's novelties are its formal model of data protection policy compliance that helps system designers to reason about regulations and demonstrate systems’ compliance with them. The project's broader significance is its potential to address consumer privacy and data security concerns associated with emerging technologies, such as the Internet of Things and cloud computing. As recent events involving corporate use of consumer data have demonstrated, privacy and data security issues are increasingly connected in the modern information age to concerns about democracy, equality, national security, and freedom, all of which carrying implications for both individuals and society. The benefits of this work include managing cyber threats and addressing data privacy and policy concerns in applications that utilize personal and sensitive data. The work also includes educational outreach efforts targeting community college and high school students, as well as students from underrepresented groups in computing with the goal to expose them to research with community benefits.The project consists of four research thrusts. The first provides a grounding of data protection legislation and regulation to provide a system design-centric formal model of policy compliance. This involves studying the implications of developing a formal model in terms of validating and proving compliance with regulations. The second thrust tackles the challenges in managing policies of transformed data sent across different system components, which involves designing data abstractions that express the data and policy transformation. The third thrust includes methods that allow efficient and fast adaptation of existing and legacy data systems to policy changes. This includes designing data structures that are sharded based on policies, enabling isolation of the data shards impacted by policy changes. The fourth thrust provides a scalable distributed logging system to cater to the auditing requirements of data protection regulations.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.

该项目旨在改造现有的数据基础设施，以符合用户数据保护立法和法规。该项目的新颖之处在于它的数据保护策略合规性的正式模型，该模型可以帮助系统设计人员推理法规并证明系统符合法规。该项目更广泛的意义在于，它有可能解决与物联网和云计算等新兴技术相关的消费者隐私和数据安全问题。正如最近涉及企业使用消费者数据的事件所表明的那样，在现代信息时代，隐私和数据安全问题越来越多地与对民主、平等、国家安全和自由的担忧联系在一起，所有这些都对个人和社会产生影响。这项工作的好处包括管理网络威胁，解决使用个人和敏感数据的应用程序中的数据隐私和政策问题。这项工作还包括针对社区大学和高中学生的教育推广工作，以及来自计算代表性不足群体的学生，目的是让他们接触到对社区有益的研究。第一个提供了数据保护立法和法规的基础，以提供以系统设计为中心的政策合规性正式模型。这涉及研究开发正式模型在验证和证明法规遵从性方面的影响。第二个推力解决了管理跨不同系统组件发送的转换数据的策略的挑战，这涉及到设计表达数据和策略转换的数据抽象。第三个重点包括允许现有和遗留数据系统有效和快速适应政策变化的方法。这包括设计基于策略分片的数据结构，从而隔离受策略更改影响的数据分片。第四个重点是提供一个可扩展的分布式日志记录系统，以满足数据保护法规的审计要求。该奖项反映了NSF的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。