Effectively Enforcing Authorization Constraints for Emerging Space-Sensitive Technologies
Effectively Enforcing Authorization Constraints for Emerging Space-Sensitive Technologies
复制标题
有效执行新兴空间敏感技术的授权约束
DOI：
10.1145/3322431.3325109
复制
发表时间：
2019
期刊：
影响因子：
--
通讯作者：
Gail
中科院分区：
文献类型：
--
作者：
Carlos E. Rubio;Shaishavkumar Jogani;Maria Leitner;Ziming Zhao;Gail
最近，根据用户当前的物理位置、使用模式、个人数据等信息，向最终用户提供定制内容的应用程序（例如，视频流上的数字对象）变得非常流行。尽管这些应用程序前途光明，但在独立经营的物理空间（如学校、博物馆、医院、纪念馆等）内正确使用这些空间敏感型应用程序方面仍然存在一些关切。基于创新技术应该与新颖（有效）的安全措施相结合的想法，本文提出了空间敏感访问控制（SSAC），这是一种在这种独立运行的物理空间中限制空间敏感功能的方法，允许规范、评估和实施丰富而灵活的授权策略，除了满足S-Apps的特定需求外，还旨在避免对其正常使用的中断以及重复的策略更新，从而为政策制定者和最终用户提供方便的解决方案。我们提出了一个理论模型、一个概念验证S-App和一个支持API框架，它们促进了策略制定、存储、检索和评估过程，以及授权决策的实施。此外，我们提出了一个性能案例研究，描述了我们在一组现实场景中的概念验证S-App，以及一项用户研究，该研究导致90%的参与者能够使用我们的方法理解和编写授权策略，其中93%的人也认识到在新兴空间敏感技术背景下限制功能的必要性，从而提供了鼓励在实践中采用SSAC的证据。
Recently, applications that deliver customized content to end-users, e.g., digital objects on top of a video stream, depending on information such as their current physical location, usage patterns, personal data, etc., have become extremely popular. Despite their promising future, some concerns still exist with respect to the proper use of such space-sensitive applications (S-Apps) inside independently-run physical spaces, e.g., schools, museums, hospitals, memorials, etc. Based on the idea that innovative technologies should be paired with novel (and effective) security measures, this paper proposes space-sensitive access control (SSAC), an approach for restricting space-sensitive functionality in such independently-run physical spaces, allowing for the specification, evaluation and enforcement of rich and flexible authorization policies, which, besides meeting the specific needs for S-Apps, are also intended to avoid the need for interruptions in their normal use as well as repetitive policy updates, thus providing a convenient solution for both policy makers and end-users. We present a theoretical model, a proof-of-concept S-App, and a supporting API framework, which facilitate the policy crafting, storage, retrieval and evaluation processes, as well as the enforcement of authorization decisions. In addition, we present a performance case study depicting our proof-of-concept S-App in a set of realistic scenarios, as well as a user study which resulted in 90% of participants being able to understand and write authorization policies using our approach, and 93% of them also recognizing the need for restricting functionality in the context of emerging space-sensitive technologies, thus providing evidence that encourages the adoption of SSAC in practice.