Access control for online social networks third party applications

Abstract

With the development of Web 2.0 technologies, online social networks are able to provide open platforms to enable the seamless sharing of profile data to enable public developers to interface and extend the social network services as applications. At the same time, these open interfaces pose serious privacy concerns as third party applications are usually given access to the user profiles. Current related research has focused on mainly user-to-user interactions in social networks, and seems to ignore the third party applications. In this paper, we present an access control framework to manage third party applications. Our framework is based on enabling the user to specify the data attributes to be shared with the application and at the same time be able to specify the degree of specificity of the shared attributes. We model applications as finite state machines, and use the required user profile attributes as conditions governing the application execution. We formulate the minimal attribute generalization problem and we propose a solution that maps the problem to the shortest path problem to find the minimum set of attribute generalization required to access the application services. We assess the feasibility of our approach by developing a proof-of-concept implementation and by conducting user studies on a widely-used social network platform.

Introduction

The recent growth of social network sites such as Facebook, Twitter and MySpace has created many interesting and challenging security and privacy problems. In social networks, users manage their profile, interact with other users, and self-organize into different communities. Users profiles usually include information such as the user's name, birthdate, address, contact information, emails, education, interests, photos, music, videos, blogs and many other attributes. Controlling access to the information posted on user profile is a challenging task as it requires average Internet users to act as system administrators to specify and configure access control policies for their profiles. To control interactions between users, the user's world is divided into a trusted and a non-trusted set of users, typically referred to as friends and strangers respectively. Furthermore, some social networks allow users to further partition the set of friends by geographical location, social group, organization, or by how well they know them. Users are provided with group based access control mechanisms (Facebook Inc, 2011) that apply access rules on the different groups of friends and strangers. Facebook, one of the most popular social sites, enables users to create friend lists and to compose profile policies based on these friend lists (Facebook Inc, 2010). In addition to the challenges involved with enabling fine grain access control for user profiles (Damiani et al., 2002) to control which data attributes viewable by other users, a yet unexplored problem is related to users' profile access from entities different from other social network users.

With the development of Web 2.0 technologies (O'Reilly, 2005), online social networks are able to provide open platforms to enable the seamless sharing of profile data to enable public developers to interface and extend the social network services as applications (or APIs). For example, Facebook allows anyone to create software plug-ins that can be added to user profiles to provide services based on profile data. Although these open platforms enable such advanced features, they also pose serious privacy risks (Tootoonchian et al., 2008; Gates, 2007; Hart et al., 2007). Users' profiles in fact have a great commercial value to marketing companies, competing networking sites, and identity thieves.

Social networks platforms have focused on user-to-user fine grain access control, for example, the Facebook Privacy Policy allows users to specify fine grain policies controlling which profile attributes can be accessed by their friends and friends of friends (Facebook Inc, 2009). When installing social network applications users have to grant the applications all the requested permissions in order to successfully complete the installation process (Facebook Inc, 2010; Myspace Inc, 2009). For example, Fig. 1(a) and (b), show the application permission request displayed by the Google+ and Facebook platforms respectively when the user attempts to install an application. Basically, the adopted application access control model is an all-or-nothing policy, where the application should be granted all the requested permissions in order to install it successfully. In addition, API developers have access to users' data regardless of the actual applications' needs, leading to potentially serious privacy breaches (Irvine, 2008; CNET Blog, 2008; Washington Chronicle, 2008). Such privacy threat is often hidden or not clear to social network users, who are often not aware of the amount of data that is actually being disclosed, since they do not really distinguish between social network users and developers outside the social network boundaries. In November 2011, Facebook's privacy practices were the subject of complaints filed with the Federal Trade Commission (FTC) (2011). The complaints were related to the Facebook's privacy practices that deceived customers and failed to keep privacy promises. One of the main complaints was related to Facebook's claim that third-party applications that users' installed would have access only to user information that they needed to operate, where in fact, the apps could access nearly all of users' personal data. In addition, Facebook claimed that it certified the security of apps participating in its “Verified Apps” program, where in fact they did not.

We believe, in order to promote healthy development of social network environments and to protect individuals' privacy rights, users should be able to take advantage of the available applications while still having a stronger control on their data. The problem is not trivial, in that it requires designing new access control models for APIs in social networks, as well as extending social network applications. Applications should be designed and customized with the users' profile preferences, and users should have the ability to specify the data that they are willing to reveal. Additionally, users should be able to use data privacy mechanisms such as generalization to enjoy the services provided through APIs without having to disclose identifying or private information.

In this paper we address this issue by deploying an access control mechanism for applications in social networks. Our goal is to provide a privacy-enabled solution that is in line with social network ethics of openness, and does not hinder users' opportunities of adding useful and entertaining applications to their profiles. Our access control mechanism is based on enabling the user to specify the data attributes to be shared with the application and at the same time be able to specify the degree of specificity of the shared attributes. Enabling such a mechanism requires applications to be developed to accommodate different user preferences. We model applications as finite state machines, and use the required user profile attributes as conditions governing the application execution. The user is faced with the challenge of specifying the minimum set of attributes and their minimum generalization levels required to acquire specific services provided by the application. In order to address this problem we proposed the weighted application transition system and formulated the Minimal Attribute Generalization Problem. Furthermore, we propose a solution that maps the problem to the shortest path problem to find the minimum set of attribute generalization required to access the application services. We assess our solution by implementing a proof-of-concept prototype using the Drupal platform, which is an open source platform for the development of online communities and social networks. Additionally, we conduct extensive user studies using the Facebook social network. We simulate our selective installation process for different applications currently provided by Facebook and assess the users' perceived benefits and ease of use. The response is encouraging and positive, in that respondents acknowledge the need for solutions of this kind to better protect their privacy and security. They also believed that our approach is appropriate to gain control of the data disclosed at the application's end.

The rest of the paper is organized as follows. In Section 2, we describe the related work. In Section 3, we provide background information related to Social Network APIs. In Section 4, we introduce our developer APIs access control framework. In Section 5, we discuss how to provide customized applications. Section 6 presents our implementation and experimental results. The conclusion and future work are discussed in Section 7.