Preserving user privacy from third-party applications in online social networks

ABSTRACT

Online social networks (OSNs) facilitate many third-party applications (TPAs) that offer users additional functionality and services. However, they also pose serious user privacy risk as current OSNs provide little control over disclosure of user data to TPAs. Addressing the privacy and security issues related to TPAs (and the underlying social networking platforms) requires solutions beyond a simple all-or-nothing strategy. In this paper, we outline an access control framework that provides users flexible controls over how TPAs can access user data and activities in OSNs while still retaining the functionality of TPAs. The proposed framework specifically allows TPAs to utilize some private data without actually transmitting this data to TPAs. Our approach determines access from TPAs based on user-specified policies in terms of relationships between the user and the application.

References

1. Facebook platform. http://developers.facebook.com/.
2. Opensocial. http://opensocial.org/.
3. P. Anthonysamy, A. Rashid, J. Walkerdine, P. Greenwood, and G. Larkou. Collaborative privacy management for third-party applications in online social networks. In Proceedings of the 1st Workshop on Privacy and Security in Online Social Media, 2012.
4. A. Besmer, H. R. Lipford, M. Shehab, and G. Cheek. Social applications: exploring a more secure framework. In Proceedings of the 5th Symposium on Usable Privacy and Security, SOUPS '09, 2009.
5. B. Carminati, E. Ferrari, and A. Perego. Enforcing access control in web-based social networks. ACM Trans. Inf. Syst. Secur., 13(1), 2009.
6. Y. Cheng, J. Park, and R. Sandhu. Relationship-based access control for online social networks: Beyond user-to-user relationships. In Proceddings of the 4th IEEE International Conference on Information Privacy, Security, Risk and Trust (PASSAT), 2012.
7. Y. Cheng, J. Park, and R. Sandhu. A user-to-user relationship-based access control model for online social networks. In Proceedings of the 26th IFIP Annual WG 11.3 Conference on Data and Application Security and Privacy (DBSec '12), 2012.
8. M. Egele, A. Moser, C. Kruegel, and E. Kirda. Pox: Protecting users from malicious facebook applications. Computer Communications, 35(12), 2012.
9. A. Felt and D. Evans. Privacy protection for social networking apis. In Proc. of Workshop on Web 2.0 Security and Privacy (W2SP '08), 2008.
10. P. W. Fong. Relationship-based access control: protection model and policy language. In Proceedings of the first ACM conference on Data and application security and privacy, 2011.
11. C. E. Gates. Access control requirements for web 2.0 security and privacy. In Proc. of Workshop on Web 2.0 Security and Privacy (W2SP '07), 2007.
12. M. M. Lucas and N. Borisov. Flybynight: mitigating the privacy risks of social networking. In Proceedings of the 7th ACM workshop on Privacy in the electronic society, WPES '08, 2008.
13. M. Shehab, A. Squicciarini, and G.-J. Ahn. Beyond user-to-user access control for online social networks. In L. Chen, M. Ryan, and G. Wang, editors, Information and Communications Security, volume 5308 of Lecture Notes in Computer Science. Springer Berlin / Heidelberg, 2008.
14. K. Singh, S. Bhola, and W. Lee. xbook: redesigning privacy control in social networking platforms. In Proceedings of the 18th conference on USENIX security symposium, SSYM'09, 2009.
15. B. Viswanath, E. Kiciman, and S. Saroiu. Keeping information safe from social networking apps. In Proceedings of the 2012 ACM Workshop on online social networks, WOSN '12, 2012.

Index Terms

• Security and privacy

  • Cryptography

    • Cryptanalysis and other attacks

  • Intrusion/anomaly detection and malware mitigation

  • Security services

    • Access control

  • Systems security

    • Operating systems security

• Social and professional topics

  • Computing / technology policy

    • Computer crime