On protection in federated social computing systems

Tarameshloo, Ebrahim; Fong, Philip W. L.; Mohassel, Payman

doi:10.1145/2557547.2557555

Cited by 8 publications

(7 citation statements)

References 34 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…A fragment of hybrid logic was used to express complex relationship-based access control policies such as "at least three friends". Several other works [19][20][21] also utilized the hybrid logic to support better expression capacity of access control needs.…”

Section: Related Workmentioning

confidence: 99%

HAC: Hybrid Access Control for Online Social Networks

Shan

et al. 2018

Security and Communication Networks

View full text Add to dashboard Cite

The rapid development of communication and network technologies including mobile networks and GPS presents new characteristics of OSNs. These new characteristics pose extra requirements on the access control schemes of OSNs, which cannot be satisfied by relationship-based access control currently. In this paper, we propose a hybrid access control model (HAC) which leverages attributes and relationships to control access to resources. A new policy specification language is developed to define policies considering the relationships and attributes of users. A path checking algorithm is proposed to figure out whether paths between two users can fit in with the hybrid policy. We develop a prototype system and demonstrate the feasibility of the proposed model.

show abstract

Section: Related Workmentioning

confidence: 99%

HAC: Hybrid Access Control for Online Social Networks

Shan

et al. 2018

Security and Communication Networks

View full text Add to dashboard Cite

show abstract

“…Vulnerabilities and implementation problems have been reported in the SDKs of OSNs [115], and security APIs have been proposed for OSNs [116]. Anderson et al focus on privacy in OSNs in general [117], Tarameshloo et al propose specific privacy policies for information sharing in OSNs [118], which is similar to our work on permission agreements (app-rights), and Ko et al also do research on this subject by studying the flows of private data between third-party applications and sites they connect to [119]. In a broader sense, Birrell and Schneider [64] have compared both existing and deprecated SSO solutions from a privacy perspective, similarly to our early work on authentication solutions.…”

Section: Factors In Third-party Authenticationmentioning

confidence: 99%

Web Authentication using Third-Parties in Untrusted Environments

Vapen

2016

Linköping Studies in Science and Technology. Dissertations

View full text Add to dashboard Cite

With the increasing personalization of the Web, many websites allow users to create their own personal accounts. This has resulted in Web users often having many accounts on different websites, to which they need to authenticate in order to gain access. Unfortunately, there are several security problems connected to the use and re-use of passwords, the most prevalent authentication method currently in use, including eavesdropping and replay attacks.Several alternative methods have been proposed to address these shortcomings, including the use of hardware authentication devices. However, these more secure authentication methods are often not adapted for mobile Web users who use different devices in different places and in untrusted environments, such as public Wi-Fi networks, to access their accounts.We have designed a method for comparing, evaluating and designing authentication solutions suitable for mobile users and untrusted environments. Our method leverages the fact that mobile users often bring their own cell phones, and also takes into account different levels of security adapted for different services on the Web.Another important trend in the authentication landscape is that an increasing number of websites use third-party authentication. This is a solution where users have an account on a single system, the identity provider, and this one account can then be used with multiple other websites. In addition to requiring fewer passwords, these services can also in some cases implement authentication with higher security than passwords can provide.How websites select their third-party identity providers has privacy and security implications for end users. To better understand the security and privacy risks with these services, we present a data collection methodology that we have used to identify and capture third-party authentication usage on the Web. We have also characterized the third-party authentication landscape based on our collected data, outlining which types of third-parties are used by which types of sites, and how usage differs across the world. Using a combination of large-scale crawling, longitudinal manual testing, and in-depth login tests, our characterization and analysis has also allowed us to discover interesting structural properties of the landscape, differences in the cross-site relationships, and how the use of third-party authentication is changing over time.Finally, we have also outlined what information is shared between websites in third-party authentication, defined risk classes based on shared data, and profiled privacy leakage risks associated with websites and their identity providers sharing data with each other. Our findings show how websites can strengthen the privacy of their users based on how these websites select and combine their third-parties and the data they allow to be shared. Populärvetenskaplig sammanfattningAllt fler människor tillbringar stora delar av sina liv på Internet för att arbeta, uträtta myndighetsärenden, sköta sin ekonomi och umgås med vänner...

show abstract

“…Later, the authors of [12,4] exploit hybrid logics to specify these fine-grained policies. Their logic is quite expressive and has been used in several other systems [20,21,18], and we adopt the same logic to specify restricted access. In [8], Cheng et al consider not only user-to-user, but also user-to-resource and resource-to-resource relationships in OSNs, which enables them to express new types of policies such as users who are tagged in the same photo with the owner can view his profile can be expressed.…”

Section: Related Workmentioning

confidence: 99%

A Logical Approach to Restricting Access in Online Social Networks

Cramer

Pang

Zhang

2015

Proceedings of the 20th ACM Symposium on Access Control Models and Technologies

View full text Add to dashboard Cite

Nowadays in popular online social networks users can blacklist some of their friends in order to disallow them to access resources that other non-blacklisted friends may access. We identify three independent binary decisions to utilize users' blacklists in access control policies, resulting into eight access restrictions. We formally define these restrictions in a hybrid logic for relationship-based access control, and provide syntactical transformations to rewrite a hybrid logic access control formula when fixing an access restriction. This enables a flexible and user-friendly approach for restricting access in social networks. We develop efficient algorithms for enforcing a subset of access control policies with restrictions. The effectiveness of the access restrictions and the efficiency of our algorithms are evaluated on a Facebook dataset.

show abstract

On protection in federated social computing systems

Cited by 8 publications

References 34 publications

HAC: Hybrid Access Control for Online Social Networks

HAC: Hybrid Access Control for Online Social Networks

Web Authentication using Third-Parties in Untrusted Environments

A Logical Approach to Restricting Access in Online Social Networks

Contact Info

Product

Resources

About