Skip to main content
SpringerLink
Log in

Relationship-Based Access Control for Resharing in Decentralized Online Social Networks

  • Conference paper
  • First Online:
Foundations and Practice of Security (FPS 2017)

Part of the book series: Lecture Notes in Computer Science ((LNSC,volume 10723))

Included in the following conference series:

Abstract

Decentralized online social networks (DOSNs) have adopted quite coarse-grained policies for sharing messages with friends of friends (i.e., resharing). They either forbid it completely or allow resharing of messages only without any possibility to constrain their subsequent distribution. In this article, we present a novel enforcement mechanism for securing resharing in DOSNs by relationship-based access control and user-determined privacy policies. Our mechanism supports resharing and offers users control over their messages after resharing. Moreover, it addresses the fact that DOSNs are run by multiple providers and honors users’ choices of which providers they trust. We clarify how our mechanism can be effectively implemented by a prototype for the DOSN Diaspora*. Our experimental evaluation shows that controlling privacy with our prototype causes only a rather small performance overhead.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution
Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 39.99
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 54.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

Notes

  1. 1.

    Even the centralized OSN Facebook supports controlled resharing only with users with whom the message had been already shared with. The alternative in Facebook is uncontrolled sharing where users may arbitrarily reshare messages that they receive.

  2. 2.

    Available at http://www.mais.informatik.tu-darmstadt.de/CReDiC.html.

References

  1. Albertini, D.A., Carminati, B.: Relationship-based information sharing in cloud-based decentralized social networks. In: 4th Conference on Data and Application Security and Privacy, pp. 297–304 (2014)

    Google Scholar 

  2. Bahri, L., Carminati, B., Ferrari, E.: CARDS - Collaborative audit and report data sharing for a-posteriori access control in DOSNs. In: IEEE Conference on Collaboration and Internet Computing, pp. 36–45. IEEE Computer Society (2015)

    Google Scholar 

  3. Beato, F., Conti, M., Preneel, B., Vettore, D.: VirtualFriendship: hiding interactions on online social networks. In: Conference on Communications and Network Security, pp. 328–336 (2014)

    Google Scholar 

  4. Beth, T., Borcherding, M., Klein, B.: Valuation of trust in open networks. In: Gollmann, D. (ed.) ESORICS 1994. LNCS, vol. 875, pp. 1–18. Springer, Heidelberg (1994). https://doi.org/10.1007/3-540-58618-0_53

    Chapter  Google Scholar 

  5. Bodriagov, O., Kreitz, G., Buchegger, S.: Access control in decentralized online social networks: applying a policy-hiding cryptographic scheme and evaluating its performance. In: 2014 International Conference on Pervasive Computing and Communication Workshops, pp. 622–628 (2014)

    Google Scholar 

  6. Bruns, G., Fong, P.W.L., Siahaan, I., Huth, M.: Relationship-based access control: its expression and enforcement through hybrid logic. In: 2nd Conference on Data and Application Security and Privacy, pp. 117–124 (2012)

    Google Scholar 

  7. Buchegger, S., Schiöberg, D., Vu, L.-H., Datta, A.: PeerSoN: P2P social networking: early experiences and insights. In: 2nd EuroSys Workshop on Social Network Systems, pp. 46–52 (2009)

    Google Scholar 

  8. Carminati, B., Ferrari, E., Perego, A.: Enforcing access control in web-based social networks. Trans. Inf. Syst. Secur. 13(1), 6:1–6:38 (2009)

    Google Scholar 

  9. Conti, M., Hasani, A., Crispo, B.: Virtual private social networks and a facebook implementation. Trans. Web 7(3), 14:1–14:31 (2013)

    Google Scholar 

  10. Cutillo, L.A., Molva, R., Strufe, T.: Safebook: a privacy-preserving online social network leveraging on real-life trust. Commun. Mag. 47(12), 94–101 (2009)

    Article  Google Scholar 

  11. Cutillo, L.A., Molva, R., Strufe, T.: Safebook: feasibility of transitive cooperation for privacy on a decentralized social network. In: 10th International Symposium on a World of Wireless, Mobile and Multimedia Networks, pp. 1–6 (2009)

    Google Scholar 

  12. Datta, A., Buchegger, S., Vu, L.-H., Strufe, T., Rzadca, K.: Decentralized online social networks. In: Furht, B. (ed.) Handbook of Social Network Technologies and Applications, pp. 349–378. Springer, Boston (2010). https://doi.org/10.1007/978-1-4419-7142-5_17

    Chapter  Google Scholar 

  13. Fong, P.W.L.: Relationship-based access control: protection model and policy language. In: 1st Conference on Data and Application Security and Privacy, pp. 191–202 (2011)

    Google Scholar 

  14. Fong, P.W.L., Anwar, M., Zhao, Z.: A privacy preservation model for facebook-style social network systems. In: Backes, M., Ning, P. (eds.) ESORICS 2009. LNCS, vol. 5789, pp. 303–320. Springer, Heidelberg (2009). https://doi.org/10.1007/978-3-642-04444-1_19

    Chapter  Google Scholar 

  15. Gates, C.E.: Access control requirements for web 2.0 security and privacy. In: Workshop on Web 2.0 Security & Privacy (2007)

    Google Scholar 

  16. Gay, R., Hu, J., Mantel, H.: CliSeAu: securing distributed Java programs by cooperative dynamic enforcement. In: Prakash, A., Shyamasundar, R. (eds.) ICISS 2014. LNCS, vol. 8880, pp. 378–398. Springer, Cham (2014). https://doi.org/10.1007/978-3-319-13841-1_21

    Google Scholar 

  17. Golbeck, J.A.: Computing and applying trust in web-based social networks. Ph.D. thesis, University of Maryland (2005)

    Google Scholar 

  18. Grippi, D., Salzberg, M., Sofaer, R., Zhitomirskiy, I.: The Diaspora* Project, February 2016. http://diasporafoundation.org/

  19. Hang, C., Wang, Y., Singh, M.P.: Operators for propagating trust and their evaluation in social networks. In: 8th International Joint Conference on Autonomous Agents and Multiagent Systems. vol. 2, pp. 1025–1032 (2009)

    Google Scholar 

  20. Hu, H., Ahn, G., Jorgensen, J.: Multiparty access control for online social networks: model and mechanisms. IEEE Trans. Knowl. Data Eng. 25(7), 1614–1627 (2013)

    Article  Google Scholar 

  21. Jøsang, A.: A subjective metric of authentication. In: Quisquater, J.-J., Deswarte, Y., Meadows, C., Gollmann, D. (eds.) ESORICS 1998. LNCS, vol. 1485, pp. 329–344. Springer, Heidelberg (1998). https://doi.org/10.1007/BFb0055873

    Chapter  Google Scholar 

  22. Jøsang, A., Ismail, R., Boyd, C.: A survey of trust and reputation systems for online service provision. Decis. Support Syst. 43(2), 618–644 (2007)

    Article  Google Scholar 

  23. Kruk, S.R., Grzonkowski, S., Gzella, A., Woroniecki, T., Choi, H.-C.: D-FOAF: distributed identity management with access rights delegation. In: Mizoguchi, R., Shi, Z., Giunchiglia, F. (eds.) ASWC 2006. LNCS, vol. 4185, pp. 140–154. Springer, Heidelberg (2006). https://doi.org/10.1007/11836025_15

    Chapter  Google Scholar 

  24. Kumari, P., Pretschner, A., Peschla, J., Kuhn, J.M.: Distributed data usage control for web applications: a social network implementation. In: 1st Conference on Data and Application Security and Privacy, pp. 85–96 (2011)

    Google Scholar 

  25. Mao, H., Shuai, X., Kapadia, A.: Loose tweets: an analysis of privacy leaks on Twitter. In: 10th Annual ACM Workshop on Privacy in the Electronic Society, pp. 1–12 (2011)

    Google Scholar 

  26. Mayer, R.C., Davis, J.H., Schoorman, F.D.: An integrative model of organizational trust. Acad. Manag. Rev. 20(3), 709–734 (1995)

    Google Scholar 

  27. Oaks, S.: Java Performance - The Definitive Guide: Getting the Most Out of Your Code. O’Reilly, Sebastopol (2014)

    Google Scholar 

  28. Paul, T., Famulari, A., Strufe, T.: A survey on decentralized online social networks. Comput. Netw. 75, 437–452 (2014)

    Article  Google Scholar 

  29. Trivellato, D., Zannone, N., Etalle, S.: GEM: a distributed goal evaluation algorithm for trust management. Theory Pract. Logic Program. 14(3), 293–337 (2014)

    Article  MathSciNet  Google Scholar 

  30. Wampler, D.: Aquarium: AOP in Ruby. In: Aspect Oriented Software Development (2008)

    Google Scholar 

Download references

Acknowledgments

We thank the anonymous reviewers for their comments and thank Sarah Ereth for her feedback at an early stage of this work. This work was partially funded by CASED (www.cased.de) and by the DFG (German research foundation) under the project FM-SecEng in the Computer Science Action Program (MA 3326/1-3).

Author information

Authors and Affiliations

  1. Modeling and Analysis of Information Systems, Department of Computer Science, TU Darmstadt, Darmstadt, Germany

    Richard Gay, Jinwei Hu & Heiko Mantel

  2. Cryptography and Complexity Theory, Department of Computer Science, TU Darmstadt, Darmstadt, Germany

    Sogol Mazaheri

Authors
  1. Richard Gay
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Jinwei Hu
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Heiko Mantel
    View author publications

    You can also search for this author in PubMed Google Scholar

  4. Sogol Mazaheri
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Richard Gay .

Editor information

Editors and Affiliations

  1. University of Lorraine, Villers-lès-Nancy, France

    Abdessamad Imine

  2. Polytechnique de Montréal, Montreal, Québec, Canada

    José M. Fernandez

  3. LORIA, Vandœuvre-lès-Nancy, France

    Jean-Yves Marion

  4. Université du Québec en Outaouais, Gatineau, Québec, Canada

    Luigi Logrippo

  5. Télécom SudParis, Evry Cedex, France

    Joaquin Garcia-Alfaro

Rights and permissions

Reprints and permissions

Copyright information

© 2018 Springer International Publishing AG, part of Springer Nature

About this paper

Check for updates. Verify currency and authenticity via CrossMark

Cite this paper

Gay, R., Hu, J., Mantel, H., Mazaheri, S. (2018). Relationship-Based Access Control for Resharing in Decentralized Online Social Networks. In: Imine, A., Fernandez, J., Marion, JY., Logrippo, L., Garcia-Alfaro, J. (eds) Foundations and Practice of Security. FPS 2017. Lecture Notes in Computer Science(), vol 10723. Springer, Cham. https://doi.org/10.1007/978-3-319-75650-9_2

Download citation

  • DOI: https://doi.org/10.1007/978-3-319-75650-9_2

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-319-75649-3

  • Online ISBN: 978-3-319-75650-9

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics

Search

Navigation