Toward strong, usable access control for shared distributed data
Michelle L. Mazurek, Yuan Liang, William Melicher, Manya Sleeper, Lujo Bauer, Gregory R. Ganger, Nitin Gupta, Michael K. Reiter · 2014
As non-expert users produce increasing amounts of per-sonal digital data, usable access control becomes critical. Current approaches often fail, because they insufficiently protect data or confuse users about policy specification. This paper presents Penumbra, a distributed file sys-tem with access control designed to match users ’ mental models while providing principled security. Penumbra’s design combines semantic, tag-based policy specification with logic-based access control, flexibly supporting intu-itive policies while providing high assurance of correct-ness. It supports private tags, tag disagreement between users, decentralized policy enforcement, and unforgeable audit records. Penumbra’s logic can express a variety of policies that map well to real users ’ needs. To evaluate Penumbra’s design, we develop a set of detailed, real-istic case studies drawn from prior research into users’ access-control preferences. Using microbenchmarks and traces generated from the case studies, we demonstrate that Penumbra can enforce users ’ policies with overhead less than 5 % for most system calls. 1