Detecting and resolving privacy conflicts for collaborative data sharing in online social networks

ABSTRACT

We have seen tremendous growth in online social networks (OSNs) in recent years. These OSNs not only offer attractive means for virtual social interactions and information sharing, but also raise a number of security and privacy issues. Although OSNs allow a single user to govern access to her/his data, they currently do not provide any mechanism to enforce privacy concerns over data associated with multiple users, remaining privacy violations largely unresolved and leading to the potential disclosure of information that at least one user intended to keep private. In this paper, we propose an approach to enable collaborative privacy management of shared data in OSNs. In particular, we provide a systematic mechanism to identify and resolve privacy conflicts for collaborative data sharing. Our conflict resolution indicates a tradeoff between privacy protection and data sharing by quantifying privacy risk and sharing loss. We also discuss a proof-of-concept prototype implementation of our approach as part of an application in Facebook and provide system evaluation and usability study of our methodology.

References

1. Facebook Places. http://www.facebook.com/places/.
2. Facebook Privacy Policy. http://www.facebook.com/policy.php/.
3. Facebook Statistics. http://http://www.facebook.com/press/info.php?statistics.
4. Google+ Privacy Policy. http://http://www.google.com/intl/en/+/policy/.
5. The Google+ Project. https://plus.google.com.
6. J. Becker and H. Chen. Measuring privacy risk in online social networks. In Proceedings of the 2009 Workshop on Web, volume 2. Citeseer.
7. A. Besmer and H. Richter Lipford. Moving beyond untagging: Photo privacy in a tagged world. In Proceedings of the 28th international conference on Human factors in computing systems, pages 1563--1572. ACM, 2010.
8. J. Brickell and V. Shmatikov. The cost of privacy: destruction of data-mining utility in anonymized data publishing. In Proceeding of the 14th ACM SIGKDD, pages 70--78. ACM, 2008.
9. B. Carminati, E. Ferrari, and A. Perego. Rule-based access control for social networks. In On the Move to Meaningful Internet Systems 2006: OTM 2006 Workshops, pages 1734--1744. Springer, 2006.
10. B. Carminati, E. Ferrari, and A. Perego. Enforcing access control in web-based social networks. ACM Transactions on Information and System Security (TISSEC), 13(1):1--38, 2009.
11. E. Carrie. Access Control Requirements for Web 2.0 Security and Privacy. In Proc. of Workshop on Web 2.0 Security & Privacy (W2SP). Citeseer, 2007.
12. P. Fong. Relationship-Based Access Control: Protection Model and Policy Language. In Proceedings of the First ACM Conference on Data and Application Security and Privacy. ACM, 2011.
13. P. Fong, M. Anwar, and Z. Zhao. A privacy preservation model for facebook-style social network systems. In Proceedings of the 14th European conference on Research in computer security, pages 303--320. Springer-Verlag, 2009.
14. J. Golbeck. Computing and applying trust in web-based social networks. Ph.D. thesis, University of Maryland at College Park College Park, MD, USA. 2005.
15. H. Hu and G. Ahn. Multiparty authorization framework for data sharing in online social networks. In Proceedings of the 25th annual IFIP WG 11.3 conference on Data and applications security and privacy, DBSec'11, pages 29--43. Springer, 2011.
16. H. Hu, G. Ahn, and K. Kulkarni. Anomaly discovery and resolution in web access control policies. In Proceedings of the 16th ACM symposium on Access control models and technologies, pages 165--174. ACM, 2011.
17. S. Kruk, S. Grzonkowski, A. Gzella, T. Woroniecki, and H. Choi. D-FOAF: Distributed identity management with access rights delegation. The Semantic Web-ASWC 2006, pages 140--154, 2006.
18. A. Lampinen, V. Lehtinen, A. Lehmuskallio, and S. Tamminen. We're in it together: interpersonal management of disclosure in social network services. In Proceedings of the 2011 annual conference on Human factors in computing systems, pages 3217--3226. ACM, 2011.
19. T. Li and N. Li. On the tradeoff between privacy and utility in data publishing. In Proceedings of the 15th ACM SIGKDD, pages 517--526. ACM, 2009.
20. K. Liu and E. Terzi. A framework for computing the privacy scores of users in online social networks. ACM Transactions on Knowledge Discovery from Data (TKDD), 5(1):6, 2010.
21. M. Madejski, M. Johnson, and S. Bellovin. The Failure of Online Social Network Privacy Settings. Technical Report CUCS-010-11, Columbia University, NY, USA. 2011.
22. A. Squicciarini, M. Shehab, and F. Paci. Collective privacy management in social networks. In Proceedings of the 18th international conference on World wide web, pages 521--530. ACM, 2009.
23. N. Talukder, M. Ouzzani, A. Elmagarmid, H. Elmeleegy, and M. Yakout. Privometer: Privacy protection in social networks. In Proceedings of 26th International Conference on Data Engineering Workshops (ICDEW), pages 266--269. IEEE, 2010.
24. K. Thomas, C. Grier, and D. Nicol. unFriendly: Multi-party Privacy Risks in Social Networks. In Privacy Enhancing Technologies, pages 236--252. Springer, 2010.
25. G. Wondracek, T. Holz, E. Kirda, and C. Kruegel. A practical attack to de-anonymize social network users. In 2010 IEEE Symposium on Security and Privacy, pages 223--238. IEEE, 2010.
26. E. Zheleva and L. Getoor. To join or not to join: the illusion of privacy in social networks with mixed public and private user profiles. In Proceedings of the 18th international conference on World wide web, pages 531--540. ACM, 2009.

Index Terms

• Security and privacy

  • Database and storage security

  • Security services

    • Access control

  • Systems security

    • Operating systems security

• Theory of computation

  • Theory and algorithms for application domains

    • Database theory

      • Theory of database privacy and security