Access Control for Active Spaces

Recent advances in embedded computing and communications technology have facilitated the development of intelligent environments, enabling exciting new applications, but also creating new challenges for security. The large number of heterogeneous devices, mobile users, and new kinds of applications all contribute to making security administration and enforcement more difficult. We study the problem of access control for such environments, which we call Active Spaces. Context plays an important role in these systems---users may have different permissions in different situations, making access control harder to configure, enforce and understand. Collaboration between users is common in these spaces, and needs to be supported by the system. My thesis is that existing models for access control, such as Role-Based Access Control, can be extended to satisfy the access control requirements for Active Spaces. An access control architecture for Active Spaces must integrate physical and virtual aspects of the environment, provide explicit support for collaborative applications, and support the dynamic and heterogeneous nature of ubiquitous computing environments. Usability, for end-users as well as security administrators, is an important concern. The system must be flexible enough to support a variety of access control models, as new applications, with varying security requirements, are still being developed for these environments. We propose an access control model that is designed for such environments. We have developed a prototype implementation in the framework of the Gaia system, which we use to demonstrate our thesis. Our model supports discretionary and mandatory access controls, and allows a variety of collaborative modes of usage. We evaluate our model on the criteria of expressiveness, performance and usability. The model is sufficiently expressive for applications used in our Active Space. The performance overhead of our access control is demonstrated to be negligible. We conducted user studies for an administrative tool for our access control system to identify requirements for security administrative tools. To improve usability for the end-users of this system, we developed KNOW, a framework to provide feedback about access control decisions while protecting the access control policy