A Privacy-Preserving Framework With Self-Governance and Permission Delegation in Online Social Networks

With the wide use of online social networks (OSNs), the problem of data privacy has attracted a lot of attention from not only the research community but also the general public. To meet the privacy needs of OSNs, we present a new framework for protecting information published through online social network websites through encryption by taking into account special features of OSNs. In this framework, autonomous private communities, called as zones, are set up by one or a set of mutually-trusted users collaboratively without any third party intervention. Sensitive information (i.e., posts, photos, etc.) within a zone can only be accessed by authorized members of the zone. A user joins a zone by obtaining a permission from an authorized zone member and uses it along with her private key to access contents inside the zone. One striking feature about our design of permission is that it is not secret information and thus can be left in the user's account in the OSN. Compared with prior work, this design of public permission greatly reduces user-side overhead on secret key management as a user only needs to maintain one secret key and use as many public permissions as she wants to access contents in different zones. Furthermore, our framework allows efficient access permission delegation and revocation. We develop a prototype to evaluate its computation performance in an acceptable level. Meanwhile, we prove that our construction is semantically secure against chosen plaintext attack, existential forgery attack and key forgery attack.