Methods and Countermeasures of Malicious Information Retrieval in Online Social Networks

Größe: px

Ab Seite anzeigen:

Download "Methods and Countermeasures of Malicious Information Retrieval in Online Social Networks"

Steffen Becker
vor 7 Jahren
Abrufe

1 Methods and Countermeasures of Malicious Information Retrieval in Online Social Networks Lars Fischer, Doǧan Kesdoǧan IT-Security Managment, University of Siegen GOR x6.0x3.0x3f4 Lars Fischer, Doǧan Kesdoǧan 1/21

2 Overview 1. Technical View 2. Threats 3. Profile Manager 3.1 Safe Publication 3.2 Transparency 3.3 di.me Lars Fischer, Doǧan Kesdoǧan 2/21

3 Online Social Network Computer Scientists View Relational Database with Attributes: A=130 B=orange X=3 G = (V, E, attr) V : User Profiles E V V attr : V E Attributes + other objects (e. g. posts) + access control Lars Fischer, Doǧan Kesdoǧan 3/21

4 Linking Profiles Attributes: A=130 B=orange X=3 Domain A Domain B Lars Fischer, Doǧan Kesdoǧan 4/21

5 Linking Profiles Attributes: A=130 B=orange X=3 Domain A Domain B Lars Fischer, Doǧan Kesdoǧan 5/21

6 Linking Profiles Attributes: A=130 B=orange X=3 Domain A Domain B Lars Fischer, Doǧan Kesdoǧan 6/21

7 De-Anonymization Attribute based Seed identification Relation based Propagation Link Profiles flickr twitter [Narayanan 2009] 12% error rate De-Anonymization (Group Membership Wondracek 2010) Quasi-Identifiers Lars Fischer, Doǧan Kesdoǧan 7/21

8 Positional Linkability k-anonymity Trace Similarity D(τ 1, τ 2 ) = t s+ T t s d(τ 1 (t), τ 2 (t))dt T Linkability: Shokri 2011, Fischer 2008 Lars Fischer, Doǧan Kesdoǧan 8/21

9 Unintended Leakage Derive Information Harvesting [Polakis 2010] Sensitive Binary Vectors [Asuncion 2010] Third Party Disclosure manual/automated mutual consent Lars Fischer, Doǧan Kesdoǧan 9/21

10 Threat Summary Linking between Domains Unintended Leakage Third Party Disclosure Lars Fischer, Doǧan Kesdoǧan 10/21

11 Privacy Objectives Privacy Protection Module Conjurers Problem: Do this and nothing more Separation of Domain Identity separation (pseudonyms) Separation of privilege [Papadimitratos 06] Awareness of 3rd-Party actions Privacy as a Practise [Danezis, Gürses 2010] Lars Fischer, Doǧan Kesdoǧan 11/21

12 Profile Manager Sketch A Action transparency Browser / App. Profile Mgr. P3P World FB g+... Twitter Lars Fischer, Doǧan Kesdoǧan 12/21

13 Safe Publication Pre-Publication Check Domain Crossing Safe State Transition (Syntactical/Semantical) Action Alert Browser / App. Domain Sep. Spec. P3P Profile Mgr. Domain Knowledge World Lars Fischer, Doǧan Kesdoǧan 13/21

14 Transparency Browser / App. Profile Mgr. The Web Domain Sep. Spec. Domain Knowledge P3P World Lars Fischer, Doǧan Kesdoǧan 14/21

15 Transparency Browser / App. Profile Mgr. The Web Domain Sep. Spec. Domain Knowledge P3P World Lars Fischer, Doǧan Kesdoǧan 15/21

16 Transparency Browser / App. Profile Mgr. The Web Domain Sep. Spec. Domain Knowledge P3P World Lars Fischer, Doǧan Kesdoǧan 16/21

17 Transparency Alert Browser / App. Domain Sep. Spec. P3P Profile Mgr. Domain Knowledge World The Web Lars Fischer, Doǧan Kesdoǧan 17/21

18 Reciprocity Break-the-glass-tools (needs trust) Decentralised/Federated OSN Incremental Information Disclosure e. g. [Fischer 2011] Lars Fischer, Doǧan Kesdoǧan 18/21

19 Lars Fischer, Doǧan Kesdoǧan 19/21

20 Conclusion What s to do? Separation of Domain Procedural Privacy Decentralisation Lars Fischer, Doǧan Kesdoǧan 20/21

21 End... Dr. Lars Fischer IT-Sicherheitsmanagement Universität Siegen... Questions? Ideas? Lars Fischer, Doǧan Kesdoǧan 21/21

Ähnliche Dokumente

Addressing the Location in Spontaneous Networks

Addressing the Location in Spontaneous Networks Enabling BOTH: Privacy and E-Commerce Design by Moritz Strasser 1 Disappearing computers Trends Mobility and Spontaneous Networks (MANET = Mobile Ad hoc