The Grey Project

Co-leads: Lujo Bauer and Mike Reiter

The Grey project is an experiment to create a universal and highly secure access-control device via software extensions to off-the-shelf "smart phones". Grey builds from formal techniques for proving authorization that assure sound access decisions and that permit virtually unlimited flexibility in the policies that can be implemented. Moreover, it leverages "capture resilience" to ensure that the device cannot be misused even if captured and reverse-engineered by a skilled attacker.

Grey is currently deployed to provide access control to physical space and computer logins in parts of the Collaborative Innovation Center on CMU's campus.

Publications

Detecting and resolving policy misconfigurations in access-control systems.
Lujo Bauer, Scott Garriss, Michael K. Reiter.
In Proceedings of the 13th ACM Symposium on Access Control Models and Technologies, pages 185–194, June 2008. [BibTeX]

A user study of policy creation in a flexible access-control system.
Lujo Bauer, Lorrie Cranor, Robert W. Reeder, Michael K. Reiter, and Kami Vaniea.
In CHI 2008: Conference on Human Factors in Computing Systems, pages 543–552, April 2008. [BibTeX]

Efficient proving for practical distributed access-control systems.
Lujo Bauer, Scott Garriss, and Michael K. Reiter.
In Computer Security—ESORICS 2007: 12th European Symposium on Research in Computer Security, volume 4734 of Lecture Notes in Computer Science, pages 19–37, September 2007. [BibTeX]

Lessons learned from the deployment of a smartphone-based access-control system.
Lujo Bauer, Lorrie Faith Cranor, Michael K. Reiter, and Kami Vaniea.
In Symposium On Usable Privacy and Security, pages 64–75, July 2007. [BibTeX]

Consumable credentials in logic-based access-control systems.
Kevin D. Bowers, Lujo Bauer, Deepak Garg, Frank Pfenning, and Michael K. Reiter.
In Proceedings of the 2007 Network & Distributed System Security Symposium, pages 143–157, February 2007. © Internet Society [BibTeX]

Comparing access-control technologies: A study of keys and smartphones.
Lujo Bauer, Lorrie Faith Cranor, Robert W. Reeder, Michael K. Reiter, and Kami Vaniea.
Technical Report CMU-CYLAB-07-005, CyLab, Carnegie Mellon University, February 2007.

User-controllable security and privacy for pervasive computing.
Jason Cornwell, Ian Fette, Gary Hsieh, Madhu Prabaker, Jinghai Rao, Karen Tang, Kami Vaniea, Lujo Bauer, Lorrie Cranor, Jason Hong, Bruce McLaren, Mike Reiter, and Norman Sadeh.
In Eighth IEEE Workshop on Mobile Computing Systems and Applications (HotMobile), February 2007. [BibTeX]

Lessons learned from the deployment of a smartphone-based access-control system.
Lujo Bauer, Lorrie Faith Cranor, Michael K. Reiter, and Kami Vaniea.
Technical Report CMU-CYLAB-06-016, CyLab, Carnegie Mellon University, October 2006. [BibTeX]

A linear logic of authorization and knowledge.
Deepak Garg, Lujo Bauer, Kevin D. Bowers, Frank Pfenning, and Michael K. Reiter.
In Computer Security—ESORICS 2006: 11th European Symposium on Research in Computer Security, volume 4189 of Lecture Notes in Computer Science, pages 297–312, September 2006. Official, slightly abbreviated version. © Springer-Verlag DOI:10.1007/11863908_19 [BibTeX]

Device-enabled authorization in the Grey system.
Lujo Bauer, Scott Garriss, Jonathan M. McCune, Michael K. Reiter, Jason Rouse, and Peter Rutenbar.
In Information Security: 8th International Conference, ISC 2005, volume 3650 of Lecture Notes in Computer Science, pages 431–445, September 2005. An extended version of this paper appears as CMU Computer Science Department Tech Report 05-111. © Springer-Verlag DOI:10.1007/11556992_31 [BibTeX]

Distributed proving in access-control systems.
Lujo Bauer, Scott Garriss, and Michael K. Reiter.
In Proceedings of the 2005 IEEE Symposium on Security & Privacy, pages 81–95, May 2005. © IEEE DOI:10.1109/SP.2005.9 [BibTeX]


Last updated 2007.06.02. Copyright © 2007 by Lujo Bauer & Mike Reiter.