CAREER: Privacy-Compliant Web Services By Construction

今天的web服务存储和处理敏感的个人数据，但对数据隐私没有足够的重视。欧盟的《通用数据保护条例》（GDPR）、《加州消费者隐私法案》（CCPA）以及拟议中的《美国消费者数据隐私法案》（CDPA）和《消费者在线隐私权法案》（CORPA）等隐私法律赋予用户控制其数据的新权利（例如，根据请求访问和删除、反对处理的权利）。在今天的系统中，遵守这些法律需要繁重的体力劳动，特别是来自中小型组织。这个项目调查了新的系统——通过构建——符合这些隐私法。关键的想法是为每个用户提供一个“微数据库”，存储他们所有的数据，他们可以选择退出或重新订阅。这种设计实现了新的、从根本上以隐私为中心的模型，例如自动删除闲置用户的数据，同时使用户更容易返回。实现逐建合规需要创新存储系统和数据处理技术。为了取得成功，遵从性构建系统必须与当今系统的便利性和性能相匹配，并且该项目将通过推进可扩展计算技术（例如，数据流系统）的最先进技术，提供有效处理数百万每个用户微型数据库的系统。拟议的研究将导致新的，符合当前流行的web服务软件的构造等同。这些隐私优先的系统将提供现成的工具，为中小型组织提供自动化和“民主化”的良好隐私实践。这有可能节省大量费用，防止代价高昂的错误，并改善互联网上的数据隐私。这项工作将通过论文影响学术前沿，通过技术转让和开源软件影响行业实践，通过新工具和提高对隐私问题的认识影响公众。在这个项目中开发的所有软件都将作为开源代码在项目网站（https://cs.brown.edu/people/malte/research/privacy-by-construction.html）上提供。通过课程整合研究，本科生和研究生将在隐私意识系统设计和实施以及新隐私法对系统设计的影响方面进行培训。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

Today's web services store and process sensitive personal data without sufficient attention to data privacy. Privacy laws like the European Union's General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and the proposed United States Consumer Data Privacy Act (CDPA) and Consumer Online Privacy Rights Act (CORPA) give users new rights to control their data (e.g., access and erasure on request, rights to object to processing). With today's systems, compliance with these laws requires onerous manual labor, particularly from small and medium-sized organizations. This project investigates new systems that – by construction – comply with these privacy laws. The key idea is to provide a "micro-database" for each user, which stores all their data and which they can choose to withdraw or resubscribe. This design enables new, fundamentally privacy-centric models, such as automatically removing idle users' data while making it easy for the users to return. Realizing compliance-by-construction requires innovation in storage systems and data processing techniques. To succeed, compliant-by-construction systems must match the convenience and performance of today's systems, and the project will contribute systems that efficiently handle millions of per-user micro-databases by advancing the state-of-the-art in scalable computing techniques (e.g., dataflow systems).The proposed research will lead to new, compliant-by-construction equivalents of today's popular web service software. These privacy-first systems will provide off-the-shelf tools that automate and "democratize" good privacy practices for small and medium-size organizations. This has the potential to save considerable expense, prevent costly mistakes, and improve data privacy on the internet. The work will affect academic state-of-the-art through papers, industry practice through technology transfer and open-source software, and the general public through new tools and raised awareness of privacy issues. All software developed in this project will be available as open-source code on the project website (https://cs.brown.edu/people/malte/research/privacy-by-construction.html). Undergraduate and graduate students will be trained in privacy-conscious system design and implementation, and in the implications of new privacy laws for system design, through curriculum integration of the research.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.