Ensuring Privacy in Presence Awareness Systems An Automated Verification Approach

  • 格式:pdf
  • 大小:139.14 KB
  • 文档页数:10

EnsuringPrivacyinPresenceAwarenessSystems:An

AutomatedVerificationApproach

PatriceGodefroid,JamesD.Herbsleb,LalitaJategaonkarJagadeesan,DuLi

BellLabs,LucentTechnologies

263ShumanBlvd.

Naperville,IL60566

god,herbsleb,lalita@research.bell-labs.comDepartmentofComputerScience

UniversityofCalifornia,LosAngeles

LosAngeles,CA90024

lidu@cs.ucla.edu

ABSTRACT

Providinginformationaboutotherusersandtheiractivities

isacentralfunctionofmanycollaborativeapplications.The

datathatprovidethis"presenceawareness"areusuallyauto-

maticallygeneratedandhighlydynamic.Forexample,ser-

vicessuchasAOLInstantMessengerallowuserstoobserve

thestatusofoneanotherandtoinitiateandparticipateinchat

sessions.Assuchservicesbecomemorepowerful,privacy

andsecurityissuesregardingaccesstosensitiveuserdatabe-

comecritical.Twokeysoftwareengineeringchallengesarise

inthiscontext:

Policiesregardingaccesstodataincollaborativeapplica-

tionshavesubtlecomplexities,andmustbeeasilymodifi-

ableduringacollaboration.Usersmustbeabletohaveahighdegreeofconfidencethat

theimplementationsofthesepoliciesarecorrect.

Inthispaper,weproposeaframeworkthatusesanautomated

verificationapproachtoensurethatsuchsystemsconformto

complexpolicies.OurapproachtakesadvantageofVeriSoft,

arecenttoolforsystematicallytestingimplementationsof

concurrentsystems,andisapplicabletoawidevarietyof

specificationanddevelopmentplatformsforcollaborativeap-

plications.Weillustratethekeyfeaturesofourframework

byapplyingittothedevelopmentofapresenceawareness

system.

Keywords

Computer-supportedCooperativeWork,PresenceAwareness,

Privacy,Security,Verification,Coordination

INTRODUCTION

ManyCSCWapplicationdomainscreatespecificanddiffi-

cultsoftwareengineeringproblems.Ubiquitouscomputing,

forexample,presentsanumberofspecificissuesforthede-

velopmentoftoolkits,rapidprototyping,andintegration[1].

Newsoftwareengineeringchallengesarepresentedbytech-

nologiesdesignedtosupportdistancecollaboration,which

arebecomingincreasinglycommonandimportant.AOLIn-stantMessenger,forexample,nowclaims80millionusers

whosend750millionmessagesaday[30].Itallowsusers

tocreate"buddylists"ofpeoplewithwhomtheyfrequently

communicate.Eachtimeauserlogson,heorsheisinformed

ofeveryoneontheirbuddylistwhoisalsologgedon.The

usercantheninitiateachatwithanyofthese"buddies."The

applicationdependscriticallyonusersreceivinginformation

aboutthepresenceofothersonthesystem.

PresenceInformation

Thisabilitytoconvey"presenceawareness"israpidlybecom-

inganimportantcomponentofmanycollaborativeapplica-

tions(e.g.,[23,25]).Forexample,manycalendarprograms

supportsharing,sothatcoworkerscanseewhenothersare

busy,orevenseethecontentsofothers’calendarentries.This

detailedinformationcanbeextremelyvaluableforquicklylo-

catingcolleagues,orforreviewingagendasofongoingmeet-

ingstostayabreastofcurrentissuesanddecisions[24].

Awarenessinformationisparticularlyimportantforlarge,

globalorganizations.Ingeographicallydistributedsoftware

development,forexample,oneofthemostseriousproblems

isthetimeittakestoresolveissuesinvolvingpeopleatmore

thanonesite[14].Presenceinformationcouldgoalong

waytowardalleviatingproblemslikephonetagbyinforming

distantcolleaguesaboutwhoisactuallyavailable,andwhen.

Manykindsofdatacanbeusedbycurrentapplicationsfor

presenceawarenesspurposes,includingwhetherapersonis

loggedon(asinAOLInstantMessenger),audioandvideoof

varyingresolution(e.g.[31]),locationinformation[29],and

informationaboutcurrentenvironment(e.g.,hasthescreen

saverengaged,whatwebsiteistheusercurrentlybrowsing,

whatfileiscurrentlybeingedited).Manykindsof"presence"

dataaregeneratedautomaticallybytheuser’sactivities.Ap-

plicationswillbeabletotakeadvantageofadditionalsources

ofinformationasnetworksmovetowardconvergence,i.e.,

carryingtelephonyandvideo,aswellasdatafromnetworked

applications.Nearlyanydetectableeventcouldconceivably

findalegitimateuseinsome"presenceaware"application.

PrivacyConcerns

Fromtheusers’pointofview,thereisafundamentaltradeoff

betweenaccesstopresencedataforlegitimateuses,andcon-

cernsaboutprivacy(e.g.,[17]).PreciselytotheextentthatI

amabletoidentifywhatyouaredoing,Icancommunicatewithyouwhentheneedarises,makemycommunications

moretimelyandconvenientforyou,andgenerallybeamore

effectivecolleague.Thisisthesortofinformation,however,

thatuserswouldgenerallynotliketoprovidetostrangers,nor

perhapstomanagers,ortocompetitors.Moreover,thedata

arelargelygeneratedautomaticallyandpotentiallyquitefre-

quently,souserscannotbeexpectedtomonitorallpresence

eventsinordertoensureappropriatelevelsofprivacy.

Therearesimilarissues,ofcourse,inmanagingaccesspriv-

ilegesmoregenerally,forexampleinafilesystem.While

implementationsvaryconsiderably,agoodsolutioniscon-

ceptuallyquitesimple.Eachuserhascontrolovertheirown

data,andtheabilitytodeterminewhat,ifanything,isavail-