A Policy Based Infrastructure for Social Data Access with Privacy Guarantees

Abstract

In this paper, we present a policy based infrastructure for social data access with the goal of enabling scientific research, while preserving privacy. We describe motivating application scenarios that could be enabled with the growing number of user datasets such as social networks, medical datasets etc. These datasets contain sensitive user information and sufficient caution must be exercised while sharing them with third parties to prevent privacy leaks. One of the goals of our framework is to allow users to control how their data is used, while at the same time enable researchers to use the aggregate data for scientific research. We extend existing access control languages to explicitly model user intent in data sharing as well as supporting additional access modes viz. Complete Access, Abstract Access and Statistical Access that go beyond the traditional allow/deny binary semantics of access control. We then describe our policy infrastructure and show how it can be used to enable the above scenarios while still guaranteeing individual privacy. We then present our initial implementation of the framework extending the SecPAL authorization language to account for new roles and operations.

Policy-Based Access Control in Mobile Social Ecosystems

“…The KB currently uses the filesystem as a backing store. For the Android prototype we exploit Androjena 4 , an Android-compatible port of the Jena framework that has been recently released. This allows us to transparently run Yarta on the laptop and on the mobile phone by replacing Jena libraries with Androjena ones.…”

“…For example, [4] proposes fine-grained access policies to medical data, based on the purpose of the requested access. The policy model is SecPAL [15], which however does not provide support for MSE data modeling nor semantic inference.…”

“…Nevertheless, all these solutions rely on a rather simple modeling of social networks, which only includes the base "friendship" relationship, often considered as bi-directional (which is not the case in most real life social relationships, e.g., the "know of" relationship). In addition, current access control policy-based frameworks for social applications are generally designed to protect specific resources, such as media contents [3], [5] or medical information [4], and do not provide a generic model for any type of social information as an accessible resource.…”