CT-T User-Controllable Security and Privacy for Pervasive Computing

普适计算的用户可控安全和隐私移动设备及其支持的服务在个人和商业生活中日益成为中心，使各种普适计算应用成为可能。由于这些设备中的绝大多数都是不受管理的，因此外行用户需要负责处理它们带来的安全和隐私问题。该项目旨在设计、实现和评估可用的接口和底层技术，最终用户可以(a)无缝地指定和管理他们的安全和隐私策略，(b)了解与他们交互的系统和个人执行的策略的影响。众所周知，管理安全和隐私策略是一个难题，因为用户通常不知道自己的策略，或者无法表达自己的策略。在移动和普适性计算环境中，访问设备的限制和用户往往同时从事的众多任务往往加剧了这种情况。该项目将安全性、隐私性和可用性问题编织在一起，系统地评估表现力、错误容忍度、用户负担和整体用户接受度之间的关键权衡，并开发新的机制和技术，帮助减轻这些权衡，最大限度地提高准确性和可信度，同时最大限度地减少最终用户所需的时间和精力。本研究结合了三个方面：(1)开发新的用户界面和支持技术，以提高可用性；(2)编织学习、对话和解释技术，以最大限度地减少最终用户的负担；(3)短期和长期的实地研究，旨在评估上述技术在实际普及计算环境中的组合。

Norman Sadeh-KoniecpolCarnegie Mellon University0627513Panel P060975CT-T User-Controllable Security and Privacy for Pervasive ComputingMobile devices and the services they support are increasingly becoming central in both personal and business life, enabling a variety of pervasive computing applications. Because the vast majority of these devices are unmanaged, lay users are responsible for handling the security and privacy implications they bring. This projects aims to design, implement and evaluate usable interfaces and underlying technologies with which end-users can (a) seamlessly specify and manage their security and privacy policies and (b) understand the effects of policies enforced by systems and individuals with which they interact.Managing security and privacy policies is well known to be a difficult problem as users often do not know their own policies or are unable to express them. In mobile and pervasive computing settings, this situation is often exacerbated by the limitations of access devices and the numerous tasks users tend to concurrently engage in. This project weaves together issues of security, privacy and usability to systematically evaluate key tradeoffs between expressiveness, tolerance for errors, burden on users and overall user acceptance, and develop novel mechanisms and technologies that help mitigate these tradeoffs maximizing accuracy and trustworthiness while minimizing the time and effort required by end users.This research combines three strands: (1) Developing novel user interfaces and supporting technologies to enhance usability, (2) Weaving learning, dialog, and explanation technologies to minimize end-user burden, and (3) Short- and long-term field studies aimed at evaluating combinations of the above techniques in practical pervasive computing settings.