Security and Privacy in Online Social Networks

Abstract

3Uno solo è il mio desiderio, quello di vedervi felici nel tempo e nell'eternità.sac. Giovanni Bosco 4 Abstract Social network applications allow people to establish links and exchange information based on various interests such as professional activities, hobbies, et similia. Several commercial social networking platforms that came to light recently suddenly became extremely popular at the international arena. Apart from obvious advantages in terms of fast community building, rapid exchange of information at the professional and private level, social network platforms raise several issues concerning the privacy and security of their users. The goal of this thesis is to identify privacy and security problems raised by the social networks and to come up with the design of radically new architectures for the social network platform.As current social network platforms are based on centralized architectures that inherently threat user privacy due to potential monitoring and interception of private user information, the goal is to design social network platforms based on a distributed architecture in order to assure user privacy. New mechanisms are investigated in order to solve some classical security and trust management problems akin to distributed systems by taking advantage of the information stored in the social network platforms. Such problems range from trust establishment in self-organizing systems to key management without infrastructure to cooperation enforcement in peer-to-peer systems.This thesis suggests a new approach to tackle these security and privacy problems with a special emphasis on the privacy of users with respect to the application provider in addition to defense against intruders or malicious users. In order to ensure users' privacy in the face of potential privacy violations by the provider, the suggested approach adopts a decentralized architecture relying on cooperation among a number of independent parties that are also the users of the online social network application. The second strong point of the suggested approach is to capitalize on the trust relationships that are part of social networks in real life in order to cope with the problem of building trusted and privacy-preserving mechanisms as part of the online application. The combination of these design principles is Safebook, i ii Abstract a decentralized and privacy-preserving online social network application. Based on the two design principles, decentralization and exploiting real-life trust, various mechanisms for privacy and security are integrated into Safebook in order to provide data storage and data management functions that preserve users'privacy, data integrity, and availability.Apart from the design of Safebook, a signicant part of the thesis is devoted to its analysis and evaluation using various methods such as experimenting with real social network platforms. A special acknowledgement goes to seventeen among the best students I have ever met:

A Secure and Privacy-Aware Cloud-Based Architecture for Online Social Networks

“…Table 2 is an analysis of the proposed system's vulnerability against different types of attacks as presented in [10]. It shows that the proposed architecture is resilient against many attacks where the existing popular OSNs such as Facebook and LinkedIn are not.…”

“…The authors in [10] presented an attack spectrum in the context of OSN environments. Table 2 is an analysis of the proposed system's vulnerability against different types of attacks as presented in [10].…”

Compliance of the Facebook Data Use Policy with the Principles of ISO 29100:2011

“…Figure 1 depicts in detail the diversity of SNS users and reflects their relationship to the SNS functionality and possible access to the PII of the SNS users. It also describes the access that SNSSP and Third Party Service Providers (SP) have to PII [11].…”

Compliance of the LinkedIn Privacy Policy with the Principles of the ISO 29100:2011 Standard

“…PII controllers and processors are considered to be members of the SNSSP team. The PII Controller or privacy stakeholder is the entity that determines the purposes and means of processing the user's PII other than natural persons who use data for personal purposes [8].…”