Poster: Exploring Reactive Access Control

As users store and share more digital content at home, effective access control becomes increasingly important. One promising approach to helping non-expert users create accurate access policies is reactive policy creation, in which users can update their policy dynamically in response to access requests that cannot otherwise succeed. An earlier study [8] suggested that reactive policy creation might be a good fit for file access control at home. To examine this theory in more depth, we conducted an experience-sampling study in which participants used a simulated reactive-access-control system for a week. Our results bolster the case for using reactive policy creation as one of the modes by which home users specify access-control policy for files. We found both quantitative and qualitative evidence of dynamic, situational access-control policies that are hard to implement using traditional models but that reactive policy creation can facilitate. Our study showed that the reactive model supports many of our participants’ policy creation needs, including the desire for more control and interactivity. While we found some clear disadvantages to the reactive model, they do not seem insurmountable. In fact, we found that some seemingly obvious disadvantages had only a minor impact on the usability of our simulated system and on user satisfaction. Based on these results, we believe that reactive policy creation has considerable potential as one component of a usable accesscontrol system. The design of our simulated system also helps pave the way for the design of future, more realistic, reactive-policy-creation mechanisms.