Exploring reactive access control

Abstract

As users store and share more digital content at home, access control becomes increasingly important. One promising approach for helping non-expert users create accurate access policies is reactive policy creation, in which users can update their policy dynamically in response to access requests that would not otherwise succeed. An earlier study suggested reactive policy creation might be a good fit for file access control at home. To test this, we conducted an experience-sampling study in which participants used a simulated reactive access-control system for a week. Our results bolster the case for reactive policy creation as one mode by which home users specify access-control policy. We found both quantitative and qualitative evidence of dynamic, situational policies that are hard to implement using traditional models but that reactive policy creation can facilitate. While we found some clear disadvantages to the reactive model, they do not seem insurmountable.

Privacy Considerations when Designing Social Network Systems to Support Successful Ageing

“…As with previous work our studies highlight that privacy decisions are dynamic, vary with context [39] and over time [37]. This is due to the changing nature of the information and is particularly pronounced with health information, which is subject to change, especially for older adults.…”

Formal definitions for usable access control rule sets from goals to metrics

“…Reactive access control [8] is another example that showed the relationship between our stated goals. It allows changes to be made in the access control list according to the most current access control policy.…”

“…Still, we deliberately designed User Study 1 with few objects (12) and entities (8). Our decision to limit the number of objects and entities was based on two points.…”

“…Dynamic creation of access control rules for computer file access was analyzed by Mazurek et al [8]. Their objective was to evaluate the usability and general interest in a reactive access control mechanism, where users who own data files receive email requests from others wanting to access these files.…”

“…File owners could also make Allow and Deny decisions permanent or temporary for the current request. Reactive access control can be potentially annoying, as pointed out by Mazurek et al [8]. The (albeit limited) monetary incentive ($0.25/answer) and, more importantly, the limited time period (one week) and relative low and constant load of requests used in the evaluation (15 requests/day) may have masked some results regarding the true annoyance of a reactive access control mechanism.…”