Collaborative Research: SaTC: CORE: Medium: Compliance as a Service (CaSe): A Reflective Approach to Enforcing User Privacy Regulations

协作研究：SaTC：核心：媒介：合规即服务 (CaSe)：执行用户隐私法规的反思性方法

• 批准号: 2245373
• 负责人: Mohammad Sadoghi Hamedani
• 金额: $ 39.6万
• 依托单位: University of California-Davis
• 依托单位国家: 美国
• 项目类别: Continuing Grant
• 财政年份: 2023
• 资助国家: 美国
• 起止时间: 2023-07-15 至 2026-06-30
• 项目状态: 未结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=2245373&HistoricalAwards=false
• 关键词: Collaborative; Research; SaTC; CORE; Medium

This project seeks to enable transforming existing data infrastructures to comply with user data protection legislation and regulations. The project's novelties are its formal model of data protection policy compliance that helps system designers to reason about regulations and demonstrate systems’ compliance with them. The project's broader significance is its potential to address consumer privacy and data security concerns associated with emerging technologies, such as the Internet of Things and cloud computing. As recent events involving corporate use of consumer data have demonstrated, privacy and data security issues are increasingly connected in the modern information age to concerns about democracy, equality, national security, and freedom, all of which carrying implications for both individuals and society. The benefits of this work include managing cyber threats and addressing data privacy and policy concerns in applications that utilize personal and sensitive data. The work also includes educational outreach efforts targeting community college and high school students, as well as students from underrepresented groups in computing with the goal to expose them to research with community benefits.The project consists of four research thrusts. The first provides a grounding of data protection legislation and regulation to provide a system design-centric formal model of policy compliance. This involves studying the implications of developing a formal model in terms of validating and proving compliance with regulations. The second thrust tackles the challenges in managing policies of transformed data sent across different system components, which involves designing data abstractions that express the data and policy transformation. The third thrust includes methods that allow efficient and fast adaptation of existing and legacy data systems to policy changes. This includes designing data structures that are sharded based on policies, enabling isolation of the data shards impacted by policy changes. The fourth thrust provides a scalable distributed logging system to cater to the auditing requirements of data protection regulations.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.

该项目旨在改造现有的数据基础设施，以符合用户数据保护立法和法规。该项目的新颖之处在于其数据保护政策合规性的正式模型，可以帮助系统设计者推理法规并证明系统遵守法规的重要性。解决与物联网和云计算等新兴技术相关的消费者隐私和数据安全问题的潜力正如最近企业使用消费者数据的事件所表明的那样，在现代信息时代，隐私和数据安全问题与日俱增。对民主、平等、民族的关注这项工作的好处包括网络威胁和解决数据隐私以及管理利用个人和敏感数据的应用程序的政策问题。这项工作还包括针对社区的教育推广工作。大学生和高中生，以及来自计算机领域代表性不足群体的学生，目的是让他们接触到对社区有益的研究。该项目包括四个研究重点：第一个提供数据保护立法和监管的基础，以提供一个系统。以设计为中心的政策合规正式模型这涉及到研究开发正式模型在验证和证明合规性方面的影响第二个重点解决了管理跨不同系统组件发送的转换数据的策略的挑战，其中涉及设计表达数据和策略转换的数据抽象。允许现有和遗留数据系统高效、快速地适应策略变化，这包括设计基于策略的分片数据结构，从而隔离受策略变化影响的数据分片。审计该奖项反映了 NSF 的法定使命，并通过使用基金会的智力价值和更广泛的影响审查标准进行评估，被认为值得支持。