SaTC: CORE: Medium: Collaborative: Contextual Integrity: From Theory to Practice

SaTC：核心：媒介：协作：上下文完整性：从理论到实践

基本信息

批准号：
1801307
负责人：
Helen Nissenbaum
金额：
$ 40万
依托单位：
Cornell University
依托单位国家：
美国
项目类别：
Continuing Grant
财政年份：
2018
资助国家：
美国
起止时间：
2018-09-01 至 2024-08-31
项目状态：
已结题

来源：
https://www.nsf.gov/awardsearch/showAward?AWD_ID=1801307&HistoricalAwards=false
关键词：
SaTC CORE Medium Collaborative Contextual

项目摘要

Current user-facing computer systems apply a "notice and consent" approach to managing user privacy: the user is presented with a privacy notice and then must consent to its terms. Decades of prior research show that this approach is unmanageable: policies are vague, ambiguous, and often include legal terms that make them very difficult to understand, if they are even read at all. These problems are magnified across Internet of Things (IoT) devices, which may not include displays to present privacy information, and may become so ubiquitous in the environment that users cannot possibly determine when their data is actually being captured. This project aims to solve these problems by designing new privacy management systems that automatically infer users' context-specific privacy expectations and then use them to manage the data-capture and data-sharing behaviors of mobile and IoT devices in users' environments. The goals of this research are to better understand privacy expectations, design privacy controls that require minimal user intervention, and demonstrate how emergent technologies can be designed to empower users to best manage their privacy.The theory of "Privacy as Contextual Integrity" (CI) postulates that privacy expectations are based on contextual norms, and that privacy violations occur when data flows in ways that defy these norms. The framework can be applied by modeling data flows in terms of the data type, sender, recipient, as well as the specific context (i.e., the purpose for which data is being shared). While this model makes intuitive sense, there are several open research questions that have prevented it from being applied in computer systems. Specifically, the project investigates how privacy expectations change across varying contexts through the use of surveys, interviews, and behavioral studies, and designs systems to automatically infer contextual information so that the process of determining whether or not a data flow is likely to defy user expectations can be automated. The investigators develop a prototype of the novel privacy controls and validate their usability and privacy-preserving properties through iterative laboratory and field experiments.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.

当前面向用户的计算机系统应用“通知和同意”方法来管理用户隐私：向用户提供隐私通知，然后必须同意其条款。几十年来的先前研究表明，这种方法是不可控制的：政策模糊，模棱两可，并且通常包含法律术语，即使他们甚至没有阅读，这些术语也很难理解。这些问题在物联网（IoT）设备之间放大，可能不包括显示隐私信息的显示，并且可能在环境中无处不在，以至于用户无法确定何时实际捕获其数据。该项目旨在通过设计新的隐私管理系统来解决这些问题，从而自动推断用户的特定于上下文的隐私期望，然后使用它们来管理用户环境中移动设备和物联网设备的数据捕获和数据共享行为。这项研究的目标是更好地了解需要最少用户干预的设计隐私期望，设计隐私控制，并证明如何设计出来的技术，以授权用户能够最好地管理其隐私。“隐私作为上下文完整性”（CI）假设，隐私期望是基于上下文违规的情况，以及在这些规范中发生这种规范的情况，这些隐私期望是基于上下文违规的。可以通过根据数据类型，发送者，收件人以及特定上下文（即共享数据的目的）对数据流进行建模来应用框架。尽管该模型具有直观的意义，但有几个开放的研究问题阻止了它将其应用于计算机系统。具体而言，该项目调查了通过使用调查，访谈和行为研究以及设计系统自动推断上下文信息，从而确定数据流是否有可能自动化的用户期望的过程。研究人员通过迭代实验室和现场实验开发了新型隐私控制的原型，并通过迭代实验室和现场实验来验证其可用性和隐私性的特性。该奖项反映了NSF的法定任务，并被认为值得通过基金会的知识分子优点和更广泛的影响来评估通过评估。

项目成果

期刊论文数量（5）

专著数量（0）

科研奖励数量（0）

会议论文数量（0）

专利数量（0）

Disaster privacy/privacy disaster

DOI：
10.1002/asi.24353
发表时间：
2020-03
期刊：
J. Assoc. Inf. Sci. Technol.
影响因子：
0
作者：
M. Sanfilippo;Yan Shvartzshnaider;Irwin Reyes;H. Nissenbaum;Serge Egelman
通讯作者：
M. Sanfilippo;Yan Shvartzshnaider;Irwin Reyes;H. Nissenbaum;Serge Egelman

Individual acceptance of using health data for private and public benefit: Changes during the COVID-19 pandemic

DOI：
10.1162/99608f92.edf2fc97
发表时间：
2021-01-01
期刊：
Harvard Data Science Review
影响因子：
0
作者：
Gerdon, F.;Nissenbaum, H.;Zins, S.
通讯作者：
Zins, S.

Stop the Spread: A Contextual Integrity Perspective on the Appropriateness of COVID-19 Vaccination Certificates

阻止传播：从上下文完整性角度看待 COVID-19 疫苗接种证书的适当性

DOI：
10.1145/3531146.3533222
发表时间：
2022
期刊：
2022
影响因子：
0
作者：
Zhang, Shikun;Shvartzshnaider, Yan;Feng, Yuanyuan;Nissenbaum, Helen;Sadeh, Norman
通讯作者：
Sadeh, Norman

Contextual Integrity Up and Down the Data Food Chain

数据食物链上下游的上下文完整性