NORMAN SADEH
Professor, Computer Science
www

My research interests over the past several years have revolved around following subjects:

1. User-Controllable Security and Privacy

Managing security and privacy policies is known to be a difficult problem. Studies have shown that lay users often do not know their own policies or are unable to express them. To make matters worse, desired security and privacy settings are not just difficult to articulate, but they also tend to change over time. In short, emerging demands for empowering end users to set up policies are often unrealistic. This in turn may result in new sources of vulnerability and high levels of user frustration. In contrast to much of prior work done in this area, I have attempted to take a more fundamental view that weaves together issues of security, privacy and usability to:

• Systematically evaluate key tradeoffs between expressiveness, tolerance for errors, burden on users and overall user acceptance, and
• Develop novel mechanisms and technologies that help mitigate these tradeoffs, maximizing accuracy and trustworthiness while minimizing the time and effort required by end users to specify and maintain policies

In particular, I have been researching new interfaces that combine user-centered design principles with dialogue, explanation and learning technologies to assist users in specifying and refining policies. This involves developing policy authoring tools for a growing collection of mobile and social networking applications and evaluating the effectiveness of these tools with users in longitudinal studies. I am also looking at a variety of enterprise scenarios.

2. Adaptive Trading Technologies

Enterprise supply chains are the foundation of today’s global economy with annual flows worth tens of trillions of dollars. As companies focus on core competencies and outsource functions ranging from the procurement of raw materials and components all the way to logistics and after sales support, they weave increasingly complex networks of interdependent organizations often spanning multiple continents. Concurrently, pressure to shorten product lifecycles and offer higher levels of customization is forcing them to explore increasingly flexible contractual relationships aimed at reducing inventory risks while providing protection against shortages and price fluctuations. By their very nature, these more flexible relationships in turn place a premium on the ability of supply chains to rapidly adapt and reconfigure themselves in the presence of unpredictable events. Yet, today, our understanding of supply chains and their reconfigurability is limited to highly stylized models that fail to capture the full range of available behaviors and the complex many-to-many strategic interactions (think game theory) flexible contractual relationships give rise to. Under routine, steady-state conditions, this in turn translates into inherent supply chain inefficiencies. In more severe situations (e.g. weather, seismic, regulatory, or geopolitical events), it can lead to catastrophic supply chain disruptions.

My research interests in this area include:

-Studying new types of contracts/mechanisms that help reduce deleterious “price of anarchy” effects in emerging supply chain scenarios, whether in consumer electronics supply chains or in flu vaccine supply chains.
-Developing advanced online learning and stochastic optimization algorithms for competitive supply chain trading. A good bit of this work has been conducted in the context of the International Supply Chain Trading Agent Competition, an event I launched in 2002. The 46
competition has attracted over 150 entries from over 20 different countries.

3. Semantic Web Service and Policy Technologies

Here my work focuses on the development of semantic technologies aimed at enhancing trust, dependability and re-use in the context of both consumer and enterprise applications. A central theme is the development of semantic web technologies for service-oriented architectures and pervasive computing environments. This includes developing infrastructures for enforcing a variety of policies, from security and privacy policies to corporate and even regulatory policies. In contrast to much of the work being done in this area, we are not necessarily assuming that ontologies and annotations are available from the start. In particular, our work on service-oriented architectures includes mixed initiative frameworks for service composition, focusing on the development of user-oriented services that work from day one even in the presence of incomplete and possibly inconsistent ontologies and annotations.

In each of the above areas, I have attempted to combine multiple research perspectives, integrating technology innovation with the study of relevant management, organizational, usability and policy issues. I generally strive to maintain a good balance between fundamental research and opportunities to interact with industry.

For more details, please see my website: www.cs.cmu.edu/~sadeh