Collaborative Research: SaTC: CORE: Medium: Compliance as a Service (CaSe): A Reflective Approach to Enforcing User Privacy Regulations

协作研究：SaTC：核心：媒介：合规即服务 (CaSe)：执行用户隐私法规的反思性方法

• 批准号: 2245374
• 负责人: Shantanu Sharma
• 金额: $ 6.09万
• 依托单位: New Jersey Institute of Technology
• 依托单位国家: 美国
• 项目类别: Continuing Grant
• 财政年份: 2023
• 资助国家: 美国
• 起止时间: 2023-07-15 至 2026-06-30
• 项目状态: 未结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=2245374&HistoricalAwards=false
• 关键词: Collaborative; Research; SaTC; CORE; Medium

This project seeks to enable transforming existing data infrastructures to comply with user data protection legislation and regulations. The project's novelties are its formal model of data protection policy compliance that helps system designers to reason about regulations and demonstrate systems’ compliance with them. The project's broader significance is its potential to address consumer privacy and data security concerns associated with emerging technologies, such as the Internet of Things and cloud computing. As recent events involving corporate use of consumer data have demonstrated, privacy and data security issues are increasingly connected in the modern information age to concerns about democracy, equality, national security, and freedom, all of which carrying implications for both individuals and society. The benefits of this work include managing cyber threats and addressing data privacy and policy concerns in applications that utilize personal and sensitive data. The work also includes educational outreach efforts targeting community college and high school students, as well as students from underrepresented groups in computing with the goal to expose them to research with community benefits.The project consists of four research thrusts. The first provides a grounding of data protection legislation and regulation to provide a system design-centric formal model of policy compliance. This involves studying the implications of developing a formal model in terms of validating and proving compliance with regulations. The second thrust tackles the challenges in managing policies of transformed data sent across different system components, which involves designing data abstractions that express the data and policy transformation. The third thrust includes methods that allow efficient and fast adaptation of existing and legacy data systems to policy changes. This includes designing data structures that are sharded based on policies, enabling isolation of the data shards impacted by policy changes. The fourth thrust provides a scalable distributed logging system to cater to the auditing requirements of data protection regulations.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.

该项目旨在使现有的数据基础架构能够遵守用户数据保护立法和法规。该项目的新颖性是其正式的数据保护策略合规模型，可帮助系统设计人员对法规进行推理，并证明系统对它们的遵守。该项目的更广泛的意义是它的潜力是解决与新兴技术（例如物联网和云计算）相关的消费者隐私和数据安全问题。由于最近涉及公司对消费者数据的事件已经证明，隐私和数据安全问题越来越多地在现代信息时代与对民主，平等，国家安全和自由的关注有关，所有这些都对个人和社会产生了影响。这项工作的好处包括管理网络威胁，解决利用个人和敏感数据的应用程序中的数据隐私和政策问题。这项工作还包括针对社区学院和高中生的教育外展工作，以及计算中代表性不足小组的学生，目的是使他们以社区福利为基础进行研究。该项目由四个研究推力组成。首先提供了数据保护立法和法规的基础，以提供以系统设计为中心的政策合规模型。这涉及研究在验证和提供遵守法规方面开发正式模型的含义。第二个推力解决了管理跨不同系统组件发送的转换数据的策略的挑战，这涉及设计表达数据和策略转换的数据摘要。第三个推力包括可以使现有数据系统和旧数据系统对策略更改进行有效且快速适应的方法。这包括设计基于策略的碎片的数据结构，从而隔离受政策变化影响的数据碎片。第四个推力提供了可扩展的分布日志系统，以满足数据保护法规的审计要求。该奖项反映了NSF的法定任务，并使用基金会的知识分子优点和更广泛的影响审查标准，被视为通过评估来获得珍贵的支持。