A Secure and Privacy-aware Cloud-based Architecture for Online Social Networks

Online Social Networking
"By giving people the power to share,
we're making the world more transparent."
"The question isn't, 'What do we want to know
about people?', It's, 'What do people want to
tell about themselves?'"
- Mark Zuckerberg, chairman and chief
executive of Facebook
Security and Privacy
“I think we're seeing privacy diminish, not by
laws... but by young people who don't seem
to value their privacy."
-Alan Dershowitz, prominent scholar on
United States constitutional law and
criminal law

"You already have zero privacy. Get over it."
-Scott G. McNealy, co-founder of Sun
Microsystems
Cloud Computing
“I don’t need a hard disk in my computer
if I can get to the server faster…
Carrying around these non-connected computers is byzantine by comparison.”
-Steve Jobs, late chairman of Apple
Shamir's Secret Sharing
"This technique [secret sharing] enables the
construction of robust key management
schemes for cryptographic systems that can
function securely and reliably even when
misfortunes destroy half the pieces and
security breaches expose all but one of the
remaining pieces.
-Adi Shamir, inventor of secret sharing,
co-inventor of the RSA algorithm

The use of social networks has grown exponentially in recent years, and these social networks continue to have an ever-increasing impact on human lives. There are many concerns regarding the privacy of users in these environments, such as how trustworthy the social network operators are, in addition to the external adversaries. In this this research project, we propose a new architecture for online social networking, based on distributed cloud-based datacenters and using Shamir's secret sharing as the method of encrypting user profile data, for enhanced privacy and availability.

Research Motivation and Goals

With or without proper thought, users share privacy sensitive data and information in online social networks. Therefore, users' privacy can be at stake, unless it is addressed sufficiently. Some online social network users are already very much aware of potential third party adversaries. However, when considering the privacy threat model, users have to think beyond the third party adversaries. Specially, the question of "How trustworthy is the social network operator?" is getting more and more attention in the online social network user community. Another interesting conflict associated with the Social Network Operators is the intellectual property rights of the content users share in an online social network.

We believe that users cannot trust social network operators for user privacy and to safekeep the intellectual property rights of the content they share in online social networks. Nevertheless, online social networks add value to efficiently maintaining real world social networks in an online environment. Hence, there is a need for a secure online social network that trusts only a user's approved contacts (friends), but no one else. This will ensure that users can still benefit from online social networks without risking their privacy. This is the problem we tried to solve in this research project.

The facts presented in the following two videos and links further support our arguments on the research motivation.