Enforcing access control in Web-based social networks

Abstract

In this article, we propose an access control mechanism for Web-based social networks, which adopts a rule-based approach for specifying access policies on the resources owned by network participants, and where authorized users are denoted in terms of the type, depth, and trust level of the relationships existing between nodes in the network. Different from traditional access control systems, our mechanism makes use of a semidecentralized architecture, where access control enforcement is carried out client-side. Access to a resource is granted when the requestor is able to demonstrate being authorized to do that by providing a proof. In the article, besides illustrating the main notions on which our access control model relies, we present all the protocols underlying our system and a performance study of the implemented prototype.

Multiparty Access Control Model for Collaborative Management of Shared Data in Online Social Networks

“…Each controller of the shared data item may have 1) a different trust level over the data owner and 2) a different reputation value in terms of collaborative control [7].Thus, a generalized decision voting scheme needs to introduce weights, which can be calculated by aggregating trust levels and reputation values, on different controllers. Different weights of controllers are essentially represented by different importance degrees on the aggregated decision.…”

A User-to-User Relationship-Based Access Control Model for Online Social Networks

“…Carminati et al [4][5][6] proposed a series of access control solutions for OSNs where the access rules are specified by the users at their discretion. The access requirements that the accessing user must satisfy are specified as type, depth, and trust metrics of the user-to-user relationships between the accessing user and the resource owner.…”

Privacy in Online Social Networks

“…On social networks, relationship can be used to organize contacts based on their relationship types. This is useful in different situations such as improving face clustering and annotation of personal photo collections [72], organizing friends into social circles [62] [64], and enforcing access control [73]. Relationship-based access control is highly interesting in order to enable users to manage and finetune their privacy settings.…”

“…Such access control systems integrate the purpose of the access in the decision process and consequently dynamically associate the purpose with the requested data objects. -Relationship-based access control [73] [95] [96]: the approaches in this category are designed to enforce users' privacy and enable users to tune their privacy settings by controlling access based on the type of relationship. For instance, the access to a specific content is authorized only for the user's colleagues, family members, etc.…”