Collaborative Privacy Policy Authoring in a Social Networking Context

Abstract

Abstract-Recent years have seen a significant increase in the popularity of social networking services. These online services enable users to construct groups of contacts, referred to as friends, with which they can share digital content and communicate. This sharing is actively encouraged by the social networking services, with users' privacy often seen as a secondary concern. In this paper we first propose a privacy-aware social networking service and then introduce a collaborative approach to authoring privacy policies for the service. In addressing user privacy, our approach takes into account the needs of all parties affected by the disclosure of information and digital content.

Policy-Based Access Control in Mobile Social Ecosystems

“…The policy model is SecPAL [15], which however does not provide support for MSE data modeling nor semantic inference. Authors of [3] complement Facebook-like applications with support for collaborative policy editing, which can be useful when multiple users have interest in restricting access to a resource (e.g., a picture). To automatically infer user policies based on user behavior, authors of [5] propose machine learning techniques.…”

“…Some recent efforts propose policy-based approaches to control access to shared resources in social networking applications [3]- [5]. Nevertheless, all these solutions rely on a rather simple modeling of social networks, which only includes the base "friendship" relationship, often considered as bi-directional (which is not the case in most real life social relationships, e.g., the "know of" relationship).…”

“…Nevertheless, all these solutions rely on a rather simple modeling of social networks, which only includes the base "friendship" relationship, often considered as bi-directional (which is not the case in most real life social relationships, e.g., the "know of" relationship). In addition, current access control policy-based frameworks for social applications are generally designed to protect specific resources, such as media contents [3], [5] or medical information [4], and do not provide a generic model for any type of social information as an accessible resource.…”

“…To the best of our knowledge, only a few solutions have been actually implemented as running systems [3], [5] but they may be difficult to reuse out of their proof-of-concept scenario, whereas no complete policy infrastructure exists for access control in mobile social applications. Note that the availability of fully implemented policy architectures has been crucial in the past towards the adoption of policies in real application scenarios for distributed systems, such as QoS and network management [6] or autonomous agent coordination [7].…”

“…At present, policy frameworks for social applications often extend the interface of the target application [8], which are by definition application-specific, or they present policies according to their internal representation, thus requiring significant technical expertise to deal with the interface [3]. This is not suitable for social scenarios, where mobile users become the security administrator of their devices and applications, managing their own data and applications, rather than simply relying on external centralized or outsourced security management services [9].…”