PRIVACY PRESERVING SOCIAL NETWORKING THROUGH DECENTRALIZATION AUTHORS: L.A. CUTILLO, REFIK MOLVA, THORSTEN STRUFE INSTRUCTOR DR. MOHAMMAD ASHIQUR RAHMAN PRESENTED BY GIRISH VENKATA SATAVALLI

CONTENTS Introduction Problem Proposed Scheme Evaluation Conclusion

INTRODUCTION Social Network : The way of extending ones’ social group i.e. getting connected to family, friends, partners etc.. with the usage of social media like LinkedIn, facebook, Twitter. Mainly used for social purposes, business purposes. It’s main goal to get everyone registered on the network to connect with each other and also setup & maintain a user’s list of contacts.

The Social Networks in detail deals with the information sharing like sending pictures, tagging, status update of its users and conserve their identity. For business purposes it deals with the marketing, advertising and also helps in receiving the feedback of a product or a service, helps in business expansion in terms of market intelligence

PROBLEM There are many problems which are coming up in social networking in the last few years of which some directly can harm the users. Privacy is the most prominent problem in all social networks, without proper protection of user’s identity it can be collected by the attackers and then can be used in defamation or impersonation attacks

SECURITY OBJECTIVES In addition to privacy the paper talks about a few security objectives in social networking like End- to – End Confidentiality Access Control Data Integrity Authentication Availability

PROPOSED SCHEME To ensure the privacy of the user in the social network the paper proposes a different scheme which avoids the centralization of the network structure. The scheme is rather a system which consists of three parts. Matryoshkas Peer -to- Peer substrate Trusted Identification Service

MATRYOSHKAS The Matryoshkas is the basic structure for a user in this system proposed by the paper. Its purpose to save user’s preferences and data and to restrict accessing of that data by other users Privacy preservation is attained in this stage

PEER -TO- PEER SUBSTRATE Based on a user’s identity this stage of the system allows global access to that particular user. The peer-to-peer substrate works on the DHT (Distributed Hash Table) The user is located based on the data saved on the outer ring of the its matryoshka.

TRUSTED IDENTIFICATION SERVICE The Trusted Identification Service(TIS) is the main part of this system as it will certify each and every user in the network. It is only limited to authenticate the users in the network and will not affect the service’s control It also assigns a pseudonym to the node corresponding to the user.

WORKING OF THE SYSTEM There are five different operations that are handled by the system Account Creation Profile Publication Data Retrieval Contact Request and Acceptance Message Management

ACCOUNT CREATION For a user ‘V’ account creation four steps are involved, which are Identity Creation: The TIS creates two key pairs ‘I’ & ‘P’ for a new user. To create it’s identity, the node pseudonym P v = h 1 (N) and node identifier v = h 2 (N). Then it generates two certificates (I +; v) STTP and (P + ;P V ) STTP Joining the P-to-P substrate Profile creation Matryoshka creation: the registration request

Then encapusalted message confirming the authentication of the user is sent back and then it is created.

Profile Publication: The data in a network may be public or private. For a node there are three types of data Profile information Trusted contact relations Messages Data retrieval: This is done in the reverse way of registration of the user. The DHT routes the information to the correct node to the requesting node.

Contact Request and Acceptance: The request message is sent to the node in the way similar to data request. If the user accepts the request it’s inner shell will increase with trusted nodes.

Message Management: The message are also similar to sending data requests to other users. The public messages like wall posts or comments are addressed publicly and private messages are directly delivered at the corresponding of the user associated with it.

CONCLUSION The paper has proposed a decentralized system to protect the identity of the user as well as the anonymization of data traffic With the proposed scheme they could evaluate the security objectives Authentication, End-to-End confidentiality, Data integrity, Availability of Profiles,.. Etc But there is no complete performance evaluation mentioned in the paper.

Also, we have to note that the scheme assumes a trusted user inside the matryoshka and it should also help to plot in finding malicious peer for the next shell. Due to the replications in the inner shell of the matryoshka, the user data deletion completely from the system might be difficult.

THANK YOU