ITR: Encoding Rights, Permissions and Obligations: Privacy Policy Specification and Compliance

目标：拟议工作的目标是(A)开发一个框架和软件工具，以支持政策和要求规范、运行时隐私强制执行和最终用户隐私管理，以及(B)对使用IT系统进行信息交易的公众进行调查，以调查他们对权利、权限和义务的看法。结果：这项工作有三个主要预期结果。首先，将制作工具，帮助政策制定者确定政策变化的后果，以确保随着政策的演变，可以防止冲突和不一致。第二，将生产工具来帮助组织执行和验证政策合规性。第三，将生产工具来使最终用户能够管理他们自己的隐私。Knowledge Merit声称：这项工作旨在架起学术和研究的两种文化的桥梁：技术规范和隐私政策。系统的规范通常集中在系统级实体(例如Cookie)上，而政策讨论则漫无边际地强调基本权利。该提案将以严格的义务和行动模式为基础制定一个关于权利、许可和义务(RPO)的框架本体论，类似于联合PI以前在研究需求规范时所使用的模式，但也借鉴了正式判例的最佳当前模式。拟议的RPO用户意见调查涉及医疗保健领域的个人信息，其依据是PI以前在电子商务和其他IT应用中的目标细化方法方面的工作，以及她在现有NSF ITR拨款下进行的调查研究，并将直接影响支持政策驱动型IT系统的规范和合规性检查的工具的构建。这些工具反过来将框架和调查结果与行业标准隐私偏好平台P3P集成在一起，P3P超越了P3P，允许在用户和IT专业人员共享的语义级别上指定和监控隐私RPO。项目团队在连接两种文化的需求和策略分析方面拥有成功的研究协作的经过证明的跟踪记录。拟议的活动在其基本思维方面具有创造性，并有望产生目前无法获得的技术和调查结果。项目活动分布在五年期间，由国际和平研究所进行积极主动的管理，并计划举办讲习班，以帮助跟踪进展情况，并邀请外部评价项目成果。北卡罗来纳州立大学和佐治亚理工学院都有很好的设备和支持来开展这项工作。

ABSTRACT0325269Ana AntonNorth Carolina StateObjectives: The objectives of the proposed work are to (a) develop a framework and software tools that support policy and requirements specification, run-time privacy enforcement and end-user privacy management, and (b) conduct surveys of members of the public who use IT systems for information transactions to investigate their perceptions of rights, permissions and obligations.Results: There are three main expected results of this work. First, tools will be produced to aid policy makers in determining the ramifications of policy changes to ensure that, as policy evolves, conflicts and inconsistencies may be prevented. Second, tools will be produced to aid organizations as they enforce and verify policy compliance.Third, tools will be produced to empower end-users to manage their own privacy. Intellectual Merit Claims: This work aims to bridge two cultures of scholarship and research: technical specification and privacy policy. Specifications of systems typically concentrate on system-level entities (e.g. cookies), whereas policy discussions emphasize fundamental rights discursively. This proposal will formulate a framework ontology of rights, permissions and obligations (RPO) based on rigorous models of obligation and actionsimilar to those previously used by the Co-PI in research into requirements specification, but informed also by the best current models from formal jurisprudence. The proposed surveys of user views about RPOs concerning personal information in the healthcare domain are informed by the PI's previous work in methodologies of goal refinement in e-commerce and other applications of IT and her survey research conducted under an existing NSF ITR grant and will directly influence the construction of tools that support the specification and compliance checking of policydriven IT systems. These tools in turn will integrate the framework and survey results with an industry standard privacy preferences platform, P3P, going beyond P3P to allow specification and monitoring of privacy RPOs at a semantic level that users and IT professionals share. The project team has a proven track record of successful research collaboration on requirements and policy analysis that bridges the two cultures identified. The proposed activity is creative in its foundational thinking and promises to produce currently unavailable technology and survey results. The project activities are distributed over the course of five years with proactive management by the PI with workshops scheduled to help track progress and invite external evaluation of project results. North Carolina State University and Georgia Tech are well equipped and supported to conduct this work.