The Swirl Project:
Effective Security Through Visualization
 

Impromptu

Our current testbed for experimentation is an application called Impromptu. Impromptu is a collaborative peer-to-peer file sharing application for small group synchronous and collocated interaction. Informally, Impromptu can be thought of as an application designed to augment face-to-face meetings by providing a shared data space with zero set-up costs. Impromptu provides a visual client interface designed to support our two major principles – the integration of configuration and action, dynamic visualization of activity. Figure 1 depicts the Impromptu client interface. The primary interface feature is the circular “pie” corresponding to the shared workspace as a whole in which each “slice” corresponds to a single user’s area of the shared workspace. These areas expand and contract as users arrive and leave. Files, represented by labeled dots, are placed in and around the circular region. Each area is tagged, on the pie’s perimeter, with a unique color for each user; this color is also associated with that user’s files, and with indicators of that user’s activity. The organization and orientation of this circular region are consistent for all participants.

Figure 1: Impromptu Client Interface. Spatial organization integrations configuration and action; color dynamics are used to provide real-time feedback on activities.

The interface is separated into multiple concentric regions; the basic metaphor is that the closer the files are to the center, the “more shared” they are. Various degrees of sharing might be implemented. The particular mappings we have been using are that files outside the circle are not shared at all, but available to the local user; files in the outer region are visible but not readable or writable to others; files in the next region are readable but not writable; in the next, readable and writable; and in the center, readable, writable, and available persistently. Persistent access means that, even when someone leaves the session, his or her files remain accessible to others in the group; by default, files are non-persistent, meaning that when the user leaves the session, their files will disappear from others’ interfaces. The provision of persistence serves two functions here, one pragmatic and one research-oriented. The pragmatic motivation is that persistence is a necessary feature of many of our usage scenarios (e.g. information sharing in group meetings); the research motivation is that we wanted to be sure that our different “sharing degrees” did not simply correspond to conventional file access rights. File access is managed by moving the files between the levels. People can only control the accessibility of their own files; moving files onto and off other people’s segments initiates a copy operation, if access rights allow. This direct coupling between location and sharing reflects the principle of integration of configuration and action. The mechanisms by which files are shared and by which their sharing is controlled are not separate; rather, they are one and the same.

The dynamics of the interface reflect its concern with the visualization of internal actions. Individual activities are reflected quickly to the group as a whole, for two reasons – first, this ensures that everyone can see potentially consequential actions, and second, it provides individuals with direct visual feedback on the ways in which their own actions are seen by others. This is an important consideration in developing an understanding of the consequences of action. Further, the dots that represent files do more than that; they also represent activities over those files. So, for example, remote file accesses to local files cause the icons for the files to blink in colors that indicate the identity of the user accessing them. This dynamic visual display draws attention to current activity and allows for a quick overview of access patterns. Since Impromptu is designed as a testbed for principles and design approaches with broader applicability, it is based on a combination of open standards including WebDAV (Web-based Distributed Authoring and Versioning - an IETF standard for collaborative editing via extended Web protocols) and the IETF Zeroconf protocols for service discovery (see below). Overall, Impromptu’s infrastructure provides a shared working space available across a wide range of system platforms, supporting multiple degrees of sharing, with no preconfiguration. Either using wired or wireless network connections, or 802.11 network cards in “ad hoc” mode (allowing them to communicate directly without the use of an access point), it also operates even when disconnected from the public Internet.

Figure 2: Impromptu architecture

The current Impromptu architecture is illustrated in Figure 2. Each client's files are stored in a WebDAV repository. WebDAV provides a standard interface to access files and control access permissions. Each client runs a local instance of Jetty, a Java HTTP server containing a Slide WebDAV servlet. A Jetty filter stitches these separate servers/repositories together to create on each client a unified, virtual shared space. WebDAV was chosen for its easy integration with current operating systems being broadly accessible across platforms both through Web interfaces and also through native file system interfaces on a range of systems including Windows, MacOS X, and Linux. Peer discovery is accomplished using an implementation of the IEFT Zeroconf protocols. Impromptu uses event-based integration. Events are used both to visualize dynamic activity as well as to ensure view consistency. The event bus was implemented using the YANCEES configurable and extensible event service. YANCEES, configured for a peer-to-peer setting, maintains the client Pie views in sync by informing each client of events taking place on the others.

One particular challenge in a peer-to-peer workspace implementation is the identification and management of peers that are constantly arriving and departing from the network. We accomplish this using an implementation of the IETF Zeroconf protocols. Zeroconf is a set of protocols that implement peer discovery, address allocation, name resolution, and related services over the TCP/IP protocols. This allows Impromptu clients to find each other automatically with no previous configuration or user intervention. Whenever someone runs Impromptu, it automatically finds and joins other Impromptu clients on the same network. Accordingly, the questions of who is connected, who else might be unconnected but “lurking,” etc., are ones that the interface should illuminate.

In our federated WebDAV model, there is no central server; the system operates entirely as a peer-to-peer architecture in which each “client” is, essentially, also a server and in which no server has a uniquely distinguished role. Shared files, then, are distributed across the set of clients that make up a session, and so when a user leaves, their files disappear from the workspace. When users leave the system, all their persistently shared files are automatically allocated to another machine. In this way, a session persists through multiple arrivals and departures until, finally, there is no Impromptu client running.