A visualization tool for evaluating access control policies in facebook-style social network systems

Abstract

Understanding the privacy implication of adopting a certain privacy setting is a complex task for the users of social network systems. Users need tool support to articulate potential access scenarios and perform policy analysis. Such a need is particularly acute for Facebook-style Social Network Systems (FSNSs), in which semantically rich topology-based policies are used for access control. In this work, we develop a prototypical tool for Reflective Policy Assessment (RPA) -a process in which a user examines her profile from the viewpoint of another user in her extended neighbourhood in the social graph. We verify the utility and usability of our tool in a within-subject user study.

Envisioning secure and usable access control for patients

“…Regarding now the use of visual tools, this work [21] shows that users perform more accurate access control policy analysis with social network's style visualization tools, than without them. Such a strategy may be of use in PACVIM, because it is difficult for a user to mentally keep track of the topology of his/her constantly changing healthcare EHR network.…”

Relationship-based access control policies and their policy languages

“…of what has come to be known as relational policies [1]. We demonstrate, in Section 2, that a number of relational policies previously studied in the context of Facebook-style Social Network Systems [18] cannot be expressed in the policy language of Fong.…”

“…In an unpublished manuscript [1], Anwar et al identify a family of policies, called relational policies, the use of which distinguishes ReBAC from traditional access control paradigms. Intuitively, a relational policy is special in two ways.…”

Survey on Access Control for Community-Centered Collaborative Systems

“…Other research efforts provide users with tools that support them in comprehending and configuring access control policies [Rode et al 2006;Reeder et al 2008;Schlegel et al 2011;Anwar and Fong 2012]. The main difference among these tools is the type of visualization used to represent the policies.…”

“…1: Interactive interfaces for Policy Comprehension category (e.g., colleague, friend) to which the user belongs is revealed, while the identity of the user is kept private. Anwar and Fong [2012] adopt a mirror-looking metaphor where a profile owner is given a visual representation of its neighborhood. In particular, it can select a user and examine its profile from the perspective of the selected user.…”