CT-ISG: Power to the People: Tools for Explaining Access-Control Consequences

摘要：终端用户在没有意识到的情况下，已经变成了访问控制策略的作者。从b谷歌到Facebook再到微软HealthVault等等，这些政策通常隐藏在简单的用户界面后面，但最终用户负责设置这些政策，然后对这些政策的后果负责。事实上，界面表面上的简单有时掩盖了结果的重要性。由于应用程序对于最终用户来说是一个黑盒，因此用户很难预测操作的结果。用户只能看到他们对世界的看法，但他们的访问控制决定会影响其他人的看法。最终用户需要工具来确定其决策的效果，特别强调政策变化的效果。这个项目正在开发用户友好的方法来浏览和调查这些影响和变化的细节。底层技术牢固地建立在理论基础上，从而保证了正式的准确性，而不是近似的答案。这些工具本身以考虑用户认知期望和偏见的方式总结信息。这个项目更广泛的影响来自于对最终用户的关注，而不是程序员和其他技术用户。一些终端用户过于渴望接受新技术，而没有充分认识到其后果，而另一些则过于试探性，因为他们担心（有时是想象的）新技术可能产生的问题。这个项目的工具帮助前者变得更加谨慎，后者变得更加自信。最终的结果应该是一个更精明、更包容的网络社会。

Project Abstract:Without their realizing it, end-users have been turned into authors of access-control policies. Everywhere from Google to Facebook to Microsoft HealthVault and beyond, these policies are usually hidden behind simple user interfaces, but ultimately the users are responsible for setting and then taking responsibility for the consequences of these policies. Indeed, the apparent simplicity of the interfaces sometimes belie the significance of the outcomes.Because applications are a black-box to end-users, it becomes difficult for users to predict the consequences of an action. Users see only their view of the world, but their access-control decisions affect the views of others. End-users need tools to determine the effect of their decisions, with special emphasis on the effect of policy changes. This project is developing user-friendly means to browse and investigate the details of these effects and changes. The underlying techniques are firmly grounded in theory, resulting in formal accuracy guarantees rather than approximate answers. The tools themselves summarize information in ways that account for the cognitive expectations and biases of users.The broader impact of this project comes from the focus on end-users rather than programmers and other technical users. Some end-users are too eager to embrace new technologies without fully appreciating their consequences, while others are too tentative due to their concern about (sometimes imaginary) problems they might create. The tools from this project help the former become more cautious, and the latter more confident. The net result should be a more savvy, yet vastly more inclusive, Cyber society.