CT-ISG: Power to the People: Tools for Explaining Access-Control Consequences

项目摘要：在没有意识到这一点的情况下，最终用户已经变成了访问控制策略的作者。 从Google到Facebook，再到Microsoft HealthVault等，这些政策通常隐藏在简单的用户界面后面，但最终用户负责设置这些政策，然后对这些政策的后果负责。 实际上，界面的简单性有时掩盖了结果的重要性，因为应用程序对最终用户来说是一个黑盒子，用户很难预测操作的结果。 用户只看到自己的世界观，但他们的访问控制决定会影响其他人的看法。 最终用户需要工具来确定其决定的影响，特别是政策变化的影响。 该项目正在开发方便用户的方法，以浏览和调查这些影响和变化的细节。 基础技术在理论上有着坚实的基础，导致形式上的准确性保证，而不是近似的答案。 这些工具本身总结信息的方式说明了用户的认知期望和偏见。该项目更广泛的影响来自于对最终用户的关注，而不是程序员和其他技术用户。 一些最终用户太急于接受新技术，而没有充分认识到它们的后果，而另一些用户则太试探性，因为他们担心（有时是想象的）它们可能会产生的问题。 这个项目的工具帮助前者变得更加谨慎，后者变得更加自信。 最终的结果应该是一个更精明，但更具包容性的网络社会。

Project Abstract:Without their realizing it, end-users have been turned into authors of access-control policies. Everywhere from Google to Facebook to Microsoft HealthVault and beyond, these policies are usually hidden behind simple user interfaces, but ultimately the users are responsible for setting and then taking responsibility for the consequences of these policies. Indeed, the apparent simplicity of the interfaces sometimes belie the significance of the outcomes.Because applications are a black-box to end-users, it becomes difficult for users to predict the consequences of an action. Users see only their view of the world, but their access-control decisions affect the views of others. End-users need tools to determine the effect of their decisions, with special emphasis on the effect of policy changes. This project is developing user-friendly means to browse and investigate the details of these effects and changes. The underlying techniques are firmly grounded in theory, resulting in formal accuracy guarantees rather than approximate answers. The tools themselves summarize information in ways that account for the cognitive expectations and biases of users.The broader impact of this project comes from the focus on end-users rather than programmers and other technical users. Some end-users are too eager to embrace new technologies without fully appreciating their consequences, while others are too tentative due to their concern about (sometimes imaginary) problems they might create. The tools from this project help the former become more cautious, and the latter more confident. The net result should be a more savvy, yet vastly more inclusive, Cyber society.