A Tag-Based, Logical Access-Control Framework for Personal File Sharing

摘要: People store and share ever-increasing numbers of digital documents, photos, other files, both on personal devices within online services. In this environment, proper access control is critical to help users obtain the benefits sharing varied content with different groups people while avoiding trouble at work, embarrassment, identity theft, problems related unintended disclosure. Current approaches often fail, either because they insufficiently protect data or confuse about policy specification. Historically, correctly managing has proven difficult, timeconsuming, error-prone, even for experts; make matters worse, remains a secondary task most non-experts are unwilling spend significant time on. To solve problem, file-sharing tools services should provide verifiable security, configuration andmanagement simple understandable users, reduce risk user error, minimize required effort. This thesis presents three studies that insight into people’s access-control needs preferences. Drawing results these studies, I present Penumbra, prototype distributed file system combines semantic, tag-based specification logicbased control, flexibly supporting intuitive policies providing high assurance correctness. Penumbra evaluated using set detailed, realistic case drawn from presented studies. Using microbenchmarks traces generated can enforce users’ overhead less than 5% calls. Finally, lessons learned, which inform further development usable mechanisms files in broader context data.