Ensuring Privacy in Presence Awareness Systems An Automated Verification Approach
- 格式:pdf
- 大小:139.14 KB
- 文档页数:10
EnsuringPrivacyinPresenceAwarenessSystems:An
AutomatedVerificationApproach
PatriceGodefroid,JamesD.Herbsleb,LalitaJategaonkarJagadeesan,DuLi
BellLabs,LucentTechnologies
263ShumanBlvd.
Naperville,IL60566
god,herbsleb,lalita@research.bell-labs.comDepartmentofComputerScience
UniversityofCalifornia,LosAngeles
LosAngeles,CA90024
lidu@cs.ucla.edu
ABSTRACT
Providinginformationaboutotherusersandtheiractivities
isacentralfunctionofmanycollaborativeapplications.The
datathatprovidethis"presenceawareness"areusuallyauto-
maticallygeneratedandhighlydynamic.Forexample,ser-
vicessuchasAOLInstantMessengerallowuserstoobserve
thestatusofoneanotherandtoinitiateandparticipateinchat
sessions.Assuchservicesbecomemorepowerful,privacy
andsecurityissuesregardingaccesstosensitiveuserdatabe-
comecritical.Twokeysoftwareengineeringchallengesarise
inthiscontext:
Policiesregardingaccesstodataincollaborativeapplica-
tionshavesubtlecomplexities,andmustbeeasilymodifi-
ableduringacollaboration.Usersmustbeabletohaveahighdegreeofconfidencethat
theimplementationsofthesepoliciesarecorrect.
Inthispaper,weproposeaframeworkthatusesanautomated
verificationapproachtoensurethatsuchsystemsconformto
complexpolicies.OurapproachtakesadvantageofVeriSoft,
arecenttoolforsystematicallytestingimplementationsof
concurrentsystems,andisapplicabletoawidevarietyof
specificationanddevelopmentplatformsforcollaborativeap-
plications.Weillustratethekeyfeaturesofourframework
byapplyingittothedevelopmentofapresenceawareness
system.
Keywords
Computer-supportedCooperativeWork,PresenceAwareness,
Privacy,Security,Verification,Coordination
INTRODUCTION
ManyCSCWapplicationdomainscreatespecificanddiffi-
cultsoftwareengineeringproblems.Ubiquitouscomputing,
forexample,presentsanumberofspecificissuesforthede-
velopmentoftoolkits,rapidprototyping,andintegration[1].
Newsoftwareengineeringchallengesarepresentedbytech-
nologiesdesignedtosupportdistancecollaboration,which
arebecomingincreasinglycommonandimportant.AOLIn-stantMessenger,forexample,nowclaims80millionusers
whosend750millionmessagesaday[30].Itallowsusers
tocreate"buddylists"ofpeoplewithwhomtheyfrequently
communicate.Eachtimeauserlogson,heorsheisinformed
ofeveryoneontheirbuddylistwhoisalsologgedon.The
usercantheninitiateachatwithanyofthese"buddies."The
applicationdependscriticallyonusersreceivinginformation
aboutthepresenceofothersonthesystem.
PresenceInformation
Thisabilitytoconvey"presenceawareness"israpidlybecom-
inganimportantcomponentofmanycollaborativeapplica-
tions(e.g.,[23,25]).Forexample,manycalendarprograms
supportsharing,sothatcoworkerscanseewhenothersare
busy,orevenseethecontentsofothers’calendarentries.This
detailedinformationcanbeextremelyvaluableforquicklylo-
catingcolleagues,orforreviewingagendasofongoingmeet-
ingstostayabreastofcurrentissuesanddecisions[24].
Awarenessinformationisparticularlyimportantforlarge,
globalorganizations.Ingeographicallydistributedsoftware
development,forexample,oneofthemostseriousproblems
isthetimeittakestoresolveissuesinvolvingpeopleatmore
thanonesite[14].Presenceinformationcouldgoalong
waytowardalleviatingproblemslikephonetagbyinforming
distantcolleaguesaboutwhoisactuallyavailable,andwhen.
Manykindsofdatacanbeusedbycurrentapplicationsfor
presenceawarenesspurposes,includingwhetherapersonis
loggedon(asinAOLInstantMessenger),audioandvideoof
varyingresolution(e.g.[31]),locationinformation[29],and
informationaboutcurrentenvironment(e.g.,hasthescreen
saverengaged,whatwebsiteistheusercurrentlybrowsing,
whatfileiscurrentlybeingedited).Manykindsof"presence"
dataaregeneratedautomaticallybytheuser’sactivities.Ap-
plicationswillbeabletotakeadvantageofadditionalsources
ofinformationasnetworksmovetowardconvergence,i.e.,
carryingtelephonyandvideo,aswellasdatafromnetworked
applications.Nearlyanydetectableeventcouldconceivably
findalegitimateuseinsome"presenceaware"application.
PrivacyConcerns
Fromtheusers’pointofview,thereisafundamentaltradeoff
betweenaccesstopresencedataforlegitimateuses,andcon-
cernsaboutprivacy(e.g.,[17]).PreciselytotheextentthatI
amabletoidentifywhatyouaredoing,Icancommunicatewithyouwhentheneedarises,makemycommunications
moretimelyandconvenientforyou,andgenerallybeamore
effectivecolleague.Thisisthesortofinformation,however,
thatuserswouldgenerallynotliketoprovidetostrangers,nor
perhapstomanagers,ortocompetitors.Moreover,thedata
arelargelygeneratedautomaticallyandpotentiallyquitefre-
quently,souserscannotbeexpectedtomonitorallpresence
eventsinordertoensureappropriatelevelsofprivacy.
Therearesimilarissues,ofcourse,inmanagingaccesspriv-
ilegesmoregenerally,forexampleinafilesystem.While
implementationsvaryconsiderably,agoodsolutioniscon-
ceptuallyquitesimple.Eachuserhascontrolovertheirown
data,andtheabilitytodeterminewhat,ifanything,isavail-