Published In A User Study of Policy Creation in a Flexible

Significant effort has been invested in developing expressive and flexible access-control languages and systems. How-ever, little has been done to evaluate these systems in prac-tical situations with real users, and few attempts have been made to discover and analyze the access-control policies that users actually want to implement. We report on a user study in which we derive the ideal access policies desired by a group of users for physical security in an office environment. We compare these ideal policies to the policies the users ac-tually implemented with keys and with a smartphone-based distributed access-control system. We develop a methodol-ogy that allows us to show quantitatively that the smartphone system allowed our users to implement their ideal policies more accurately and securely than they could with keys, and we describe where each system fell short. Author Keywords Access control, policy creation, smartphones, discretionar