Collaborative Research: EAGER: Understanding User Needs for Access Control Systems in Smart Settings

智能设备越来越受欢迎。智能锁、灯泡、开关、监控系统、传感器、恒温器、语音扬声器系统、公用事业系统和联网办公室/住宅/工厂电器的使用在短时间内呈指数级增长。根据最近的数据，到2025年，将有近400亿台设备连接到互联网，未来五年将投资超过11.1万亿美元用于制造此类智能设备。在智能环境(例如，智能家居、智能办公室、智能工厂等)中，设备通常连接到中央集线器，例如三星的SmartThings或苹果的HomeKit。多个用户可以访问这种过多的设备，通常具有冲突的、复杂的、动态变化的需求，而当前的智能环境平台不允许明确地表达用户的冲突需求。事实上，目前智能平台中的访问控制机制提供了粗粒度的访问控制，这些访问控制可能会导致安全问题，并且无法自动解决冲突。最重要的是，我们对新兴智能技术在不同环境中的使用情况的了解非常有限。为了应对这些挑战，在这个迫切的项目中，我们旨在全面调查不同智能环境下用户对多用户和多设备感知访问控制机制的实际需求。显然，提高智能环境和平台的安全性对数百万用户有着直接而深刻的影响。由于智能设备已经成为最脆弱和最容易被利用的系统之一，通过该项目了解不同的设计挑战和用户希望/需求以提高智能设备的安全性的能力为行业和社会影响提供了丰富的机会。智能设备世界缺乏细粒度的访问控制机制，限制了用户、从业者和工具防止恶意行为和意外访问的能力。当前的智能设备和平台以及传统方法无法解决具有众多设备的多用户智能环境中复杂、冲突的需求。此外，这些环境通常使用不同的技术部署来自多个供应商的大量设备。智能技术在没有充分了解限制、用户需求以及安全和隐私方面的情况下迅速推向市场，这一事实加剧了这种情况。因此，详细了解在智能环境中设计更好的访问控制系统所需的实用技术、想法和必要工具是重要的第一步。具体地说，这个项目将研究用户对必要的访问控制能力的需求，以便以安全和了解隐私的方式有效地执行任务。由于智能设备已经在我们的生活、工作场所和工业环境中变得无处不在，有时还会受到威胁，因此该项目的成果将有助于设计更安全、更安全的系统。拟议的工作将调查用户的需求和愿望，(1)他们相互冲突和复杂的需求，(2)灵活和可配置的设计，(3)通过专门的用户研究，适当的安全和隐私设置。该项目还将调查智能环境中多用户和多设备感知访问控制机制成功过渡到实践方面的可行性。该奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

Smart devices are increasingly popular. The use of smart locks, bulbs, switches, surveillance systems, sensors, thermostats, voice-enabled speaker systems, utility systems, and Internet-connected office/house/factory appliances has grown exponentially in a short period of time. According to recent figures, there will be close to 40 billion devices connected to the Internet by 2025, and more than 11.1 trillion dollars will be invested in manufacturing such smart devices in the next five years. In a smart environment (e.g., smart home, smart office, smart factory, etc.), devices are usually connected to a central hub such as Samsung's SmartThings, or Apple's HomeKit. Multiple users can access this plethora of devices typically with conflicting, complex, dynamically changing demands and current smart environment platforms do not allow conflicting demands of the users to be expressed explicitly. Indeed, the current access control mechanisms in smart platforms offer coarse-grained access controls that may cause safety and security issues and cannot resolve the conflicts automatically. Most importantly, our understanding of the usage of the emerging smart technologies across different settings is significantly limited. To address these challenges, in this EAGER project, we aim to investigate the actual needs of the users for a multi-user and multi-device aware access control mechanism in different smart environments in a comprehensive manner. Clearly, improving the security of smart environments and platforms has a direct and profound impact on millions of users. As smart devices have become one of the most vulnerable and most exploited systems, the ability to understand different design challenges and user desires/demands to increase the security of smart devices via this project presents rich opportunities for industrial and societal impact.The lack of fine-grained access control mechanisms in the world of smart devices limits the abilities of users, practitioners, and tools to prevent malicious behavior and unintended access. Current smart devices and platforms and traditional approaches cannot address complex, conflicting demands in a multi-user smart environment with numerous devices. Moreover, these environments often deploy numerous devices from multiple vendors with different technologies. This situation is exacerbated by the fact that the smart technologies are fast introduced to the market without fully understanding the constraints, the user needs, and the security and privacy aspects. Hence, the detailed understanding of the practical techniques, ideas, and the necessary tools that will be needed for the design of better access control systems in smart settings is an important first step. Specifically, this project will study the needs of users for the necessary access control capabilities to perform the tasks effectively, and in a secure and privacy-aware manner. Because smart devices are already becoming pervasive in our lives, workplaces, industrial settings, and are sometimes being compromised, the outcomes of this project will facilitate the design of safer and more secure systems. The proposed work will investigate the needs and desires of users for (1) their conflicting and complex demands, (2) flexible and configurable designs, (3) proper security and privacy settings via dedicated user studies. The project will also investigate the feasibility of successful transition-to-practice aspects of multi-user and multi-device aware access control mechanisms for smart environments.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.