TWC: Small: A Choice Architecture for Mobile Privacy and Security

TWC：小型：移动隐私和安全的选择架构

• 批准号: 1318680
• 负责人: David Wagner
• 金额: $ 50万
• 依托单位: University of California-Berkeley
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2013
• 资助国家: 美国
• 起止时间: 2013-08-15 至 2017-07-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1318680&HistoricalAwards=false
• 关键词: TWC; Small; Choice; Architecture; Mobile

Mobile devices (e.g., smartphones and tablets) allow users to execute rich third-party applications that are capable of making extensive use of device hardware and personal data. This poses security risks, as applications may perform undesirable operations such as deleting data, damaging hardware, or even directly incurring charges on the user's phone bill. Mobile devices also pose privacy risks, as they store sensitive personal information that may be accessed and shared inappropriately.Empowering users to decide how resources on their mobile devices are accessed (i.e., "granting permission") is an important challenge for the future of mobile computing. Our research has shown that existing mechanisms are ineffective: users frequently grant permissions because they either do not understand them, are habituated to them, or feel that they have no other choice. This research project aims to identify and study potential solutions to these problems.This project develops a user-centered approach to mobile device permission requests. The project is conducting human-subjects experiments to design and validate more effective mechanisms for regulating privacy- or security-sensitive actions. The research agenda involves minimizing habituation to security warnings by substituting them with protected widgets (i.e., "trusted UI") or audit mechanisms, when possible; improving the design of security warnings, because alternative permission-granting mechanisms are sometimes inappropriate; and integrating these mechanisms into a platform that improves system security by taking a user-centered approach to granting permissions. If successful, this project could help develop a secure foundation for future generations of mobile devices.

移动的设备（例如，智能手机和平板电脑）允许用户执行能够广泛使用设备硬件和个人数据的丰富的第三方应用。 这会带来安全风险，因为应用程序可能会执行不受欢迎的操作，例如删除数据，损坏硬件，甚至直接在用户的电话账单上产生费用。 移动的设备还带来隐私风险，因为它们存储可能被不适当地访问和共享的敏感个人信息。“授予许可”）是移动的计算的未来的重要挑战。 我们的研究表明，现有的机制是无效的：用户经常授予权限，因为他们要么不理解权限，要么习惯了权限，要么觉得自己别无选择。 本研究计画的目的是找出并研究解决这些问题的可能性，并发展一套以使用者为中心的移动终端权限请求处理方法。 该项目正在进行人体实验，以设计和验证更有效的机制来规范对隐私或安全敏感的行为。 研究议程涉及通过用受保护的小部件（即，“受信任的UI”）或审计机制;改进安全警告的设计，因为替代的权限授予机制有时是不合适的;以及将这些机制集成到一个平台中，通过采取以用户为中心的方法来授予权限，从而提高系统安全性。 如果成功，该项目将有助于为未来几代移动的设备奠定安全的基础。