CICI: RDP: Enforcing Security and Privacy Policies to Protect Research Data

在过去的十年中，计算机系统的进步为惊人规模的数据收集奠定了坚实的基础。终端用户设备产生的数据对研究界具有巨大的价值。例如，移动和物联网设备可以参与大规模的基于互联网的患者健康状况测量或监测。虽然可能会有突破性的发现，但恶意攻击或无意的数据泄露会威胁到研究数据。这种威胁很难预测，一旦发生也很难恢复。在产生数据的地方应该采取预防和防御措施，以保护私人的、有价值的数据不受攻击者的攻击。目前，有一些努力试图规范数据管理，例如，一个研究应用程序可能有一个隐私政策，描述如何收集和保护用户数据。然而，在这些文档化的政策和研究项目的实现之间存在脱节。在这个项目中，研究者建议解释文件政策并在研究项目中强制执行，以保护研究数据的隐私。这项工作可以显著减少研究人员在实现符合策略的代码时的开销，并降低保护研究数据集的复杂性。在这个项目中，研究人员提供了一个解决方案，利用不同监管实体（如应用程序商店和机构审查委员会（IRB））规定的政策来保护研究数据。该系统利用自然语言处理（NLP）技术从非结构化的监管文件中提取安全和隐私要求，并将这些要求转换为可以修补不符合政策的程序的代码。该解决方案涵盖了研究数据保护的整个生命周期，从数据收集到数据存储和数据处理。这项研究有两个重点。首先，研究人员将建立新的NLP技术，从非结构化、稀疏标记的文档（如IRB协议）和研究应用程序的隐私披露中提取安全和隐私策略。其次，研究人员将在代码中执行这些提取的策略，通过上下文感知程序分析来发现研究人员的实现与提取的策略之间的不一致之处，以及工具研究人员？S代码来强制遵守程序行为。这项工作的结果将对下一代研究数据保护技术的发展以及更具防御性的安全和隐私实践产生变革性影响。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

Advances in computer systems over the past decade have laid a solid foundation for data collection at a staggering scale. Data generated from end-user devices has tremendous value to the research community. For example, mobile and Internet-of-Things devices can participate in large-scale Internet-based measurement or monitoring of patient's health conditions. While ground-breaking discovered may occur, malicious attacks or unintentional data leaks threaten the research data. Such a threat is hard to predict and difficult to recover from once it happens. Preventative and defensive measures should be taken where data is generated in order to protect private, valuable data from the attackers. Currently, there are efforts that try to regulate data management, for example, a research application might have a privacy policy that describes how the user data is being collected and protected. However, there is a disconnect between these documented policies and the implementations of a research project. In this project, the investigators propose to interpret the documented policies and enforce them in research projects, in order to protect the privacy of research data. This work can significantly reduce researchers' overhead in implementing policy-compliant code and reduce the complexity of protecting research datasets.In this project, the investigators provide a solution that protects research data using policies mandated by different regulatory entities, such as an application store and an Institutional Review Board (IRB). The system utilizes Natural Language Processing (NLP) techniques to extract security and privacy requirements from unstructured regulatory documents and translates these requirements to code that can patch a program that does not comply with the policies. The solution covers the lifetime of research data protection, from data collection to data storage, and data processing. This research has two thrusts. First, the investigators will build novel NLP techniques to extract security and privacy policies from unstructured, sparsely-labeled documents such as IRB protocols, and privacy disclosure of research applications. Second, the investigators will enforce these extracted policies in code, through context-aware program analysis to discover inconsistencies between a researcher's implementation and the extracted policies, and instrument researcher?s code to enforce compliant program behavior. The results of this work will have a transformative impact on the development of the next generation research data protection techniques, and more defensive security and privacy practices.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.