Toward strong, usable access control for shared distributed data

Proceedings of the 12th USENIX Conference on File and Storage Technologies, FAST 2014

Volumn , Issue , 2014, Pages 89-103

  Mazurek, Michelle L ^a   Liang, Yuan ^a   Melicher, William ^a   Sleeper, Manya ^a   Bauer, Lujo ^a   Ganger, Gregory R ^a   Gupta, Nitin ^a   Reiter, Michael K ^b  

^a CARNEGIE MELLON UNIVERSITY   (United States)

^b UNIVERSITY OF NORTH CAROLINA   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

COMPUTER CIRCUITS; DIGITAL STORAGE; FILE ORGANIZATION; SEMANTICS; SPECIFICATIONS;

AUDIT RECORDS; DECENTRALIZED POLICIES; DIGITAL DATAS; DISTRIBUTED DATA; DISTRIBUTED FILE SYSTEMS; HIGH ASSURANCE; MICRO-BENCHMARKS; POLICY SPECIFICATION;

ACCESS CONTROL;

EID: 84943228243     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (62)

1. FUSE: Filesystem in userspace. http://fuse.sourceforge.net.
2. Average number of uploaded and linked photos of Facebook users as of January 2011, by gender. Statista, 2013.
3. M. S. Ackerman. The intellectual challenge of CSCW: The gap between social requirements and technical feasibility. Human-Computer Interaction, 15(2):179–203, 2000.
4. S. Ahern, D. Eckles, N. S. Good, S. King, M. Naaman, and R. Nair. Over-exposed? Privacy patterns and considerations in online and mobile photo sharing. In Proc. ACM CHI, 2007.
5. A. W. Appel and E. W. Felten. Proof-carrying authentication. In Proc. ACM CCS, 1999.
6. Apple. Apple iCloud. https://www.icloud.com/, 2013.
7. C.-M. Au Yeung, L. Kagal, N. Gibbins, and N. Shadbolt. Providing access control to online photo albums based on tags and linked data. In Proc. AAAI-SSS:Social Semantic Web, 2009.
8. O. Ayalon and E. Toch. Retrospective privacy: Managing longitudinal privacy in online social networks. In Proc. SOUPS, 2013.
9. L. Bauer, S. Garriss, and M. K. Reiter. Distributed proving in access-control systems. In Proc. IEEE SP, 2005.
10. L. Bauer, S. Garriss, and M. K. Reiter. Efficient proving for practical distributed access-control systems. In ESORICS, 2007.
11. L. Bauer, M. A. Schneider, and E. W. Felten. A general and flexible access-control system for the Web. In Proc. USENIX Security, 2002.
12. A. Besmer and H. Richter Lipford. Moving beyond untagging: Photo privacy in a tagged world. In Proc. ACM CHI, 2010.
13. A. J. Brush and K. Inkpen. Yours, mine and ours? Sharing and use of technology in domestic environments. In Proc. UbiComp. 2007.
14. Facebook & your privacy: Who sees the data you share on the biggest social network? Consumer Reports Magazine, June 2012.
15. D. Coursey. Google apologizes for Buzz privacy issues. PCWorld. Feb. 15, 2010.
16. J. L. De Coi, E. Ioannou, A. Koesling, W. Nejdl, and D. Olmedilla. Access control for sharing semantic data across desktops. In Proc. ISWC, 2007.
17. E. De Cristofaro, C. Soriente, G. Tsudik, and A. Williams. Hummingbird: Privacy at the time of Twitter. In Proc. IEEE SP, 2012.
18. K. W. Edwards, M. W. Newman, and E. S. Poole. The infrastructure problem in HCI. In Proc. ACM CHI, 2010.
19. C. Elliott and F. Pfenning. A semi-functional implementation of a higher-order logic programming language. In P. Lee, editor, Topics in Advanced Language Implementation. MIT Press, 1991.
20. D. Garg and F. Pfenning. A proof-carrying file system. In Proc. IEEE SP, 2010.
21. R. Geambasu, M. Balazinska, S. D. Gribble, and H. M. Levy. Homeviews: Peer-to-peer middleware for personal data sharing applications. In Proc. ACM SIGMOD, 2007.
22. D. K. Gifford, P. Jouvelot, M. A. Sheldon, and J. W. O’Toole. Semantic file systems. In Proc. ACM SOSP, 1991.
23. M. Hart, C. Castille, R. Johnson, and A. Stent. Usable privacy controls for blogs. In Proc. IEEE CSE, 2009.
24. K. Hill. Teacher accidentally puts racy photo on students’ iPad. School bizarrely suspends students. Forbes, October 2012.
25. M. Johnson, S. Egelman, and S. M. Bellovin. Facebook and privacy: It’s complicated. In Proc. SOUPS, 2012.
26. M. Johnson, J. Karat, C.-M. Karat, and K. Grueneberg. Usable policy template authoring for iterative policy refinement. In Proc. IEEE POLICY, 2010.
27. A. K. Karlson, A. J. B. Brush, and S. Schechter. Can I borrow your phone? Understanding concerns when sharing mobile phones. In Proc. ACM CHI, 2009.
28. P. Klemperer, Y. Liang, M. L. Mazurek, M. Sleeper, B. Ur, L. Bauer, L. F. Cranor, N. Gupta, and M. K. Reiter. Tag, you can see it! Using tags for access control in photo sharing. In Proc. ACM CHI, 2012.
29. B. Lampson, M. Abadi, M. Burrows, and E. Wobber. Authentication in distributed systems: Theory and practice. ACM Trans. Comput. Syst., 10(4):265–310, 1992.
30. C. Lesniewski-Laas, B. Ford, J. Strauss, R. Morris, and M. F. Kaashoek. Alpaca: Extensible authorization for distributed services. In Proc. ACM CCS, 2007.
31. N. Li, J. C. Mitchell, and W. H. Winsborough. Design of a role-based trust-management framework. In Proc. IEEE SP, 2002.
32. L. Little, E. Sillence, and P. Briggs. Ubiquitous systems and the family: Thoughts about the networked home. In Proc. SOUPS, 2009.
33. A. Masoumzadeh and J. Joshi. Privacy settings in social networking systems: What you cannot control. In Proc. ACM ASIACCS, 2013.
34. M. L. Mazurek, J. P. Arsenault, J. Bresee, N. Gupta, I. Ion, C. Johns, D. Lee, Y. Liang, J. Olsen, B. Salmon, R. Shay, K. Vaniea, L. Bauer, L. F. Cranor, G. R. Ganger, and M. K. Reiter. Access control for home data sharing: Attitudes, needs and practices. In Proc. ACM CHI, 2010.
35. M. L. Mazurek, P. F. Klemperer, R. Shay, H. Takabi, L. Bauer, and L. F. Cranor. Exploring reactive access control. In Proc. ACM CHI, 2011.
36. D. D. McCracken and R. J. Wolfe. User-centered website development: A human-computer interaction approach. Prentice Hall Englewood Cliffs, 2004.
37. Microsoft. Windows SkyDrive. http://windows.microsoft.com/en-us/skydrive/, 2013.
38. R. Needleman. How to fix Facebook’s new privacy settings. cnet, December 2009.
39. J. Nielsen and J. T. Hackos. Usability engineering, volume 125184069. Academic press Boston, 1993.
40. J. S. Olson, J. Grudin, and E. Horvitz. A study of preferences for sharing and privacy. In Proc. CHI EA, 2005.
41. D. Peek and J. Flinn. EnsemBlue: Integrating distributed storage and consumer electronics. In Proc. OSDI, 2006.
42. A. Post, P. Kuznetsov, and P. Druschel. PodBase: Transparent storage management for personal devices. In Proc. IPTPS, 2008.
43. V. Ramasubramanian, T. L. Rodeheffer, D. B. Terry, M. Walraed-Sullivan, T. Wobber, C. C. Marshall, and A. Vahdat. Cimbiosys: A platform for content-based partial replication. In Proc. NSDI, 2009.
44. M. N. Razavi and L. Iverson. A grounded theory of information sharing behavior in a personal learning space. In Proc. ACM CSCW, 2006.
45. R. W. Reeder, L. Bauer, L. Cranor, M. K. Reiter, K. Bacon, K. How, and H. Strong. Expandable grids for visualizing and authoring computer security policies. In Proc. ACM CHI, 2008.
46. O. Riva, Q. Yin, D. Juric, E. Ucan, and T. Roscoe. Policy expressivity in the Anzere personal cloud. In Proc. ACM SOCC, 2011.
47. B. Salmon, S. W. Schlosser, L. F. Cranor, and G. R. Ganger. Perspective: Semantic data management for the home. In Proc. USENIX FAST, 2009.
48. S. Schroeder. Facebook privacy: 10 settings every user needs to know. Mashable, February 2011.
49. M. Seltzer and N. Murphy. Hierarchical file systems are dead. In Proc. USENIX HotOS, 2009.
50. D. K. Smetters and N. Good. How users use access control. In Proc. SOUPS, 2009.
51. J. Staddon, P. Golle, M. Gagné, and P. Rasmussen. A content-driven access control system. In Proc. IDTrust, 2008.
52. J. Strauss, J. M. Paluska, C. Lesniewski-Laas, B. Ford, R. Morris, and F. Kaashoek. Eyo: device-transparent personal storage. In Proc. USENIX-ATC, 2011.
53. F. Stutzman, R. Gross, and A. Acquisti. Silent listeners: The evolution of privacy and disclosure on facebook. Journal of Privacy and Confidentiality, 4(2):2, 2013.
54. K. Vaniea, L. Bauer, L. F. Cranor, and M. K. Reiter. Out of sight, out of mind: Effects of displaying access-control information near the item it controls. In Proc. IEEE PST, 2012.
55. J. A. Vaughan, L. Jia, K. Mazurak, and S. Zdancewic. Evidence-based audit. Proc. CSF, 2008.
56. B. Weitzenkorn. McAfee’s rookie mistake gives away his location. Scientific American, December 2012.
57. S. Whittaker, O. Bergman, and P. Clough. Easy on that trigger dad: a study of long term family photo retrieval. Personal and Ubiquitous Computing, 14(1):31–43, 2010.
58. P. J. Wisniewski, H. Richter Lipford, and D. C. Wilson. Fighting for my space: Coping mechanisms for SNS boundary regulation. In Proc. ACM CHI, 2012.
59. E. Wobber, M. Abadi, M. Burrows, and B. Lampson. Authentication in the Taos operating system. In Proc. ACM SOSP, 1993.
60. T. Wobber, T. L. Rodeheffer, and D. B. Terry. Policy-based access control for weakly consistent replication. In Proc. Eurosys, 2010.
61. S. Yardi and A. Bruckman. Income, race, and class: Exploring socioeconomic differences in family technology use. In Proc. ACM CHI, 2012.
62. G. Zimmermann and G. Vanderheiden. Accessible design and testing in the application development process: Considerations for an integrated approach. Universal Access in the Information Society, 7(1-2):117–128, 2008.