CT-ISG: Power to the People: Tools for Explaining Access-Control Consequences

项目摘要：在他们没有意识到的情况下，最终用户已经变成了访问控制策略的作者。从谷歌到Facebook，再到微软HealthVault和其他地方，这些策略通常隐藏在简单的用户界面后面，但最终用户要负责设置这些策略的后果，然后对其后果负责。事实上，界面的表面简单性有时掩盖了结果的重要性。由于应用程序对最终用户来说是一个黑匣子，用户很难预测一个操作的后果。用户只能看到他们对世界的看法，但他们的访问控制决策会影响其他人的看法。终端用户需要工具来确定其决策的效果，并特别强调政策变化的效果。该项目正在开发用户友好的方法，以浏览和调查这些影响和变化的细节。潜在的技术有坚实的理论基础，导致形式上的准确性保证，而不是近似的答案。这些工具本身以考虑到用户的认知预期和偏见的方式总结信息。该项目更广泛的影响来自于对最终用户的关注，而不是程序员和其他技术用户。一些最终用户在没有充分意识到新技术的后果的情况下，过于急于接受新技术，而另一些最终用户则因为担心它们可能造成的(有时是想象中的)问题而过于犹豫。这个项目的工具帮助前者变得更加谨慎，而后者则变得更加自信。最终结果应该是一个更精明、但包容性更强的网络社会。

Project Abstract:Without their realizing it, end-users have been turned into authors of access-control policies. Everywhere from Google to Facebook to Microsoft HealthVault and beyond, these policies are usually hidden behind simple user interfaces, but ultimately the users are responsible for setting and then taking responsibility for the consequences of these policies. Indeed, the apparent simplicity of the interfaces sometimes belie the significance of the outcomes.Because applications are a black-box to end-users, it becomes difficult for users to predict the consequences of an action. Users see only their view of the world, but their access-control decisions affect the views of others. End-users need tools to determine the effect of their decisions, with special emphasis on the effect of policy changes. This project is developing user-friendly means to browse and investigate the details of these effects and changes. The underlying techniques are firmly grounded in theory, resulting in formal accuracy guarantees rather than approximate answers. The tools themselves summarize information in ways that account for the cognitive expectations and biases of users.The broader impact of this project comes from the focus on end-users rather than programmers and other technical users. Some end-users are too eager to embrace new technologies without fully appreciating their consequences, while others are too tentative due to their concern about (sometimes imaginary) problems they might create. The tools from this project help the former become more cautious, and the latter more confident. The net result should be a more savvy, yet vastly more inclusive, Cyber society.