Privacy-Enhanced Sharing of Personal Content on the Web Mohammad - - PowerPoint PPT Presentation

privacy enhanced sharing of personal content on the web
SMART_READER_LITE
LIVE PREVIEW

Privacy-Enhanced Sharing of Personal Content on the Web Mohammad - - PowerPoint PPT Presentation

IMPECS WWW Presentation- April 24, 2008 Privacy-Enhanced Sharing of Personal Content on the Web Mohammad Mannan and P . C. van Oorschot Carleton University, Canada M. Mannan April 24, 2008 1 IMPECS The need for sharing is real People


slide-1
SLIDE 1

IMPECS

  • M. Mannan

April 24, 2008 1

WWW Presentation- April 24, 2008

Privacy-Enhanced Sharing of Personal Content on the Web

Mohammad Mannan and P . C. van Oorschot Carleton University, Canada

slide-2
SLIDE 2

IMPECS

  • M. Mannan

April 24, 2008 2

The need for sharing is real

People want to share: – photos, contact info – “What are you doing?” – preferences, opinions

slide-3
SLIDE 3

IMPECS

  • M. Mannan

April 24, 2008 3

Sharing is easy

Popular techniques: – Social networking sites, blogs – Cheap (or free) personal web space But maintaining “privacy” is not so easy.

slide-4
SLIDE 4

IMPECS

  • M. Mannan

April 24, 2008 4

Common solutions for privacy

Popular techniques: – Passwords (distribution, retraction) – Obscure web links – “Friends’ circle” on social networking sites

slide-5
SLIDE 5

IMPECS

  • M. Mannan

April 24, 2008 5

Privacy in social networking sites – Usability

  • 1. Build the friends’ circle (without annoying others?)
  • 2. Viewers must join the same network as the publisher
  • 3. Publisher is restricted to a particular site
slide-6
SLIDE 6

IMPECS

  • M. Mannan

April 24, 2008 6

So your profile is “privacy-protected”

– but you forgot about the “U.S. Patriot Act” – also forgot to read the site’s privacy policy (Facebook “beacon”, no deleting of accounts)

slide-7
SLIDE 7

IMPECS

  • M. Mannan

April 24, 2008 7

Consequences: job lost

slide-8
SLIDE 8

IMPECS

  • M. Mannan

April 24, 2008 8

Consequences: job denied

You have “cleaned” your profile before an interview – but profiles are incrementally archived

slide-9
SLIDE 9

IMPECS

  • M. Mannan

April 24, 2008 9

Consequences: targeted phishing/malware

slide-10
SLIDE 10

IMPECS

  • M. Mannan

April 24, 2008 10

Problem statement

  • 1. How to share personal content on the web among selected peers
  • 2. Goals:

– share only within a “circle of trust” – deny access to strangers, web crawlers, auto-indexers – usable security Military-grade security is a non-goal

slide-11
SLIDE 11

IMPECS

  • M. Mannan

April 24, 2008 11

Our proposal: overview

IMPECS: IM-based Privacy-Enhanced Content Sharing – only a publisher’s IM contacts can view her web page – IM and web servers share a user-specific key – IM server generates a ‘ticket’ for a viewing user (contact) – Web server validates the ticket before serving content

slide-12
SLIDE 12

IMPECS

  • M. Mannan

April 24, 2008 12

Notation used in IMPECS A, B

Two IM users Alice and Bob

Si, Sw

IM and web servers

IDAw A’s user ID at Sw which is unique in Sw’s domain KAw A’s content sharing key, shared with both Sw and Si

URLA The URL of A’s publishing web folder on Sw

R

A set of access restrictions on URLA as imposed by A

Tiw

= {IDAw, R}KAw (access control ticket for viewing URLA)

slide-13
SLIDE 13

IMPECS

  • M. Mannan

April 24, 2008 13

Registering a URL in IMPECS

Publisher (A) IM Server (Si) Web Server (Sw)

  • Auth (between A, Sw)
  • Request a key for URLA, specifying restrictions R
  • URLAR

=http://URLA/?userid=IDAw&key=KAw&restrictions=R

  • Auth (between A, Si)
  • URLAR
slide-14
SLIDE 14

IMPECS

  • M. Mannan

April 24, 2008 14

Viewing a personal URL in IMPECS

Viewer (B) IM Server (Si) Web Server (Sw)

  • Auth (between B, Si)
  • Request to access URLA
  • URLAT

=http://URLA/?userid=IDAw&ticket=Tiw

URLAT

  • Content hosted at URLA
slide-15
SLIDE 15

IMPECS

  • M. Mannan

April 24, 2008 15

IMPECS in action

slide-16
SLIDE 16

IMPECS

  • M. Mannan

April 24, 2008 16

IMPECS – Advantages

  • 1. Privacy-friendly sharing
  • 2. ‘Improved’ usability
  • 3. Interoperability – publish ‘anywhere’
  • 4. Decreased risks related to sharing
slide-17
SLIDE 17

IMPECS

  • M. Mannan

April 24, 2008 17

IMPECS – Shortcomings

  • 1. Must use IM

– modification of IM server source code – may require IM client updates – needs to run PHP scripts at the web server

  • 2. Malicious contacts may copy and publish personal content on

public forums

  • 3. Only as secure as the underlying IM and web protocols
slide-18
SLIDE 18

IMPECS

  • M. Mannan

April 24, 2008 18

Concluding thoughts

  • 1. Any pre-arranged grouping can be used as “circle of trust”
  • 2. How to protect against compromised/malicious IM and web servers?
  • 3. How to make people privacy-aware?
slide-19
SLIDE 19

IMPECS

  • M. Mannan

April 24, 2008 19

Thank you

Question/Comments?

mmannan@scs.carleton.ca http://www.ccsl.carleton.ca