Data Privacy in Online Social Networks With FineGrained Access Control

Abstract

Online Social Networks (OSNs), such as Facebook and Twitter, are popular platforms that enable users to interact and socialize through their networked devices. However, the social nature of such applications forces users to share a great amount of personal data with other users and the OSN service providers, including pictures, location check-ins, etc. Even though some OSNs offer configurable privacy controls that limit access to shared data, users might misconfigure these controls due to their complexity or lack of clear instructions. Furthermore, the fact that OSN service providers have full access over the data stored on their servers is an alarming thought, especially for users who are conscious about their privacy. For example, OSNs might share such data with third parties, data mine them for targeted advertisements, collect statistics, etc. As a result, data and communication privacy over OSNs is a popular topic in the data privacy research community. Existing solutions include cryptographic mechanisms [1], trusted third parties [2], external dictionaries [3], and steganographic techniques [4]. Nevertheless, none of the aforementioned approaches offers a comprehensive solution that (i) implements fine-grained access control over encrypted data and (ii) works seamlessly over existing OSN platforms. To this end, we will design and implement a flexible and user-friendly system that leverages encryption-based access control and allows users to assign arbitrary decryption privileges to every data object that is posted on the OSN servers. The decryption privileges can be assigned on the finest granularity level, for example, to a hand-picked group of users. In addition, data decryption is performed automatically at the application layer, thus enhancing the overall experience for the end-user. Our cryptographic-based solution leverages hidden vector encryption (HVE)[5], which is a ciphertext policy-based access control mechanism. Under HVE, each user generates his/her own master key (one-time) that is subsequently used to generate a unique decryption key for every user with whom they share a link in the underlying social graph. Moreover, during the encryption process, the user interactively selects a list of friends and/or groups that will be granted decryption privileges for that particular data object. To distribute the decryption keys, we utilize an untrusted database server where users have to register before using our system. The server stores (i) the social relationships of the registered users, (ii) their public keys, and (iii) the HVE decryption keys assigned to each user. As the database server is untrusted, the decryption keys are stored in encrypted form, i.e., they are encrypted with the public key of the underlying user. Therefore, our solution relies on the existing public key infrastructure (PKI) to ensure the integrity and authenticity of the users’ public keys. To facilitate the deployment of our system over existing OSN platforms, we use steganographic techniques [6] to hide the encrypted data objects within randomly chosen cover images (stego images). The stego images are then uploaded to the OSN servers, and only authorized users (with the correct decryption keys) would be able to extract the embedded data. Unauthorized users will simply see the random cover images. We aim to implement our system as a Chrome-based browser extension where, after installation, the user registers with the un- trusted server and uploads/downloads the necessary decryption keys. The keys are also stored locally, in order to provide a user-friendly interface to share private information. Specifically, our system will offer a seamless decryption process, where all hidden data objects are displayed automatically while surfing the OSN platform, without any user interaction. References [1] S. Jahid, P. Mittal, and N. Borisov, “EASiER: encryption-based access control in social networks with efficient revocation,” in Proc. ACM Symposium on Information, Computer and Communications Security (ASIACCS), pp. 411–415, 2011.[2] A. Tootoonchian, S. Saroiu, Y. Ganjali, and A. Wolman, “Lockr: better privacy for social networks,” in Proceedings of the 2009 ACM Conference on Emerging Networking Exper- iments and Technology, CoNEXT 2009, Rome, Italy, December 1-4, 2009, pp. 169–180, 2009.[3] S. Guha, K. Tang, and P. Francis, “NOYB: privacy in online social networks,” in Proc. Workshop on Online Social Networks (WOSN), pp. 49–54, 2008.[4] J. Ning, I. Singh, H. V. Madhyastha, S. V. Krishnamurthy, G. Cao, and P. Mohapatra, “Secret message sharing using online social media,” in Proc. IEEE Conference on Commu- nications and Network Security (CNS), pp. 319–327, 2014.[5] T. V. X. Phuong, G. Yang, and W. Susilo, “Efficient hidden vector encryption with constant- size ciphertext,” in Proc. European Symposium on Research in Computer Security (ES- ORICS), pp. 472–487, 2014.[6] S. Kaur, S. Bansal, and R. K. Bansal, “Steganography and classification of image steganog- raphy techniques,” in Proc. International Conference on Computing for Sustainable Global Development (INDIACom), 2014.

A Secure and Efficient Cloud-Centric Internet-of-Medical-Things-Enabled Smart Healthcare System With Public Verifiability

“…In contrast, the security of the RSA-based cryptosystem is based on finding the factor of the product of two large prime integers. The factorization Problem (FP) is solved using the Number Field Sieve (NFS) Algorithm with sub-exponential complexity 1 . In contrast, no known sub-exponential algorithm can solve the ECDLP if the curves are chosen suitably.…”

“…If the ballots satisfy these equations, stop the process; otherwise, the process is repeated until the size of the ballot becomes one. Thus, the proposed system has Olog(n) time complexity for the batch of n invalid and valid ballots, the complexities for n valid ballots and single ballot are O(1) and O(n), respectively, as shown in Table4.5.…”

“…PBC is one of the standard cryptographic libraries for pairing-based cryptography proposed by Ben Lynn that supports MNT curves, BN curves, Freeman curves, and supersingular curves[122]. Another library for pairing-based cryptography is the mcl that supports BN-254 curves, BN-SNARK1, BN-382, BN-462, and BLS12-381[1]. Tsukuba Elliptic Curve and Pairing Library (TEPLA) support BN254N andBN254B 1 .…”

“…1 . Let two cryptographic hash functions are H 1 : {0, 1} n × G 1 → Z q and H 2 : {0, 1} n → {0, 1} n , and a bilinear map e : G 1 × G 1 → G 2 .…”