Computer Networks 75 (2014) 437–452
Contents lists available at ScienceDirect
Computer Networks
journal homepage: www.elsevier.com/locate/comnet
A survey on decentralized Online Social Networks ⇑ Thomas Paul a, , Antonino Famulari b, Thorsten Strufe c a Technische Universität Darmstadt, Hochschulstrasse 10, 64380 Darmstadt, Germany b Télécom ParisTech, INFRES, 23, Avenue d’Italie, 75013 Paris, France c Technische Universität Dresden, Nöthnitzer Straße 46, 01187 Dresden, Germany article info abstract
Article history: Because of growing popularity of Online Social Networks (OSNs) and huge amount of sen- Received 20 January 2014 sitive shared data, preserving privacy is becoming a major issue for OSN users. While most Received in revised form 15 September 2014 OSNs rely on a centralized architecture, with an omnipotent Service Provider, several Accepted 1 October 2014 decentralized architectures have recently been proposed for decentralized OSNs (DOSNs). Available online 12 October 2014 In this work, we present a survey of existing proposals. We propose a classification of pre- vious work under two dimensions: (i) types of approaches with respect to resource provi- Keywords: sioning devices and (ii) adopted strategies for three main technical issues for DOSN Online Social Network (OSN) (decentralizing storage of content, access control and interaction/signaling). We point Distributed Online Social Network (DOSN) Privacy out advantages and limitations of each approach and conclude with a discussion on the impact of DOSNs on users, OSN providers and other stakeholders. Ó 2014 Elsevier B.V. All rights reserved.
1. Introduction legitimate profit interests lead to strong incentives for OSN providers to monetize user data far beyond the user’s Online Social Networks (OSNs) are one of the most pop- sharing interests [20]. But users need to trust the latter not ular services on the Web with more than one billion users.1 to misuse the power, accompanied with being the operator Yet, OSNs are not just tremendously popular; they have also of the system, as well as to be able to protect the system changed the way we interact with the Web and its against both attackers from outside and from inside the resources: OSNs allow non-expert users to create and main- provider’s organization itself. The existence of a powerful tain a personal space in the Web in a simple way. OSNs system operator combined with monetization incentives evolved in time, providing several communications and cause privacy concerns [27]. Furthermore, different types sharing facilities which cause users to share huge quantities of censorship occur in today’s OSNs: the content-specific of personal information [22] over them. censorship with respect to different rules and traditions Nevertheless, users of today’s popular OSNs suffer unde- in different countries [1,2] as well as person-specific cen- sired side effects resulting from a centralized architecture of sorship which means disallowing subsets of the population OSNs in which one provider has the power that is accompa- to access the network (e.g. in Syria today [3]). nied with being the operator of the system. These side However, the importance of OSNs for the daily inter- effects include: the necessity for a high degree of trust in person communication puts the OSN providers in a posi- the OSN provider, censorship issues and privacy concerns. tion of being gate keepers to parts of the social life of their Economic pressure to earn money due to provider-side users. Due to this dependency, users strongly tend to infrastructure and maintenance costs and the provider’s accept the mentioned side effects and even disadvanta- geous terms of usage, since the OSN providers may exclude users from the OSNs and subsequently from parts of their ⇑ Corresponding author. social contacts. Authors of decentralized OSN (DOSN) 1 http://allfacebook.de/userdata/ – accessed on 16th of January 2014. http://dx.doi.org/10.1016/j.comnet.2014.10.005 1389-1286/Ó 2014 Elsevier B.V. All rights reserved. 438 T. Paul et al. / Computer Networks 75 (2014) 437–452 approaches aim to abolish OSN providers and the side- 46/EC of the European Parliament. PII is ‘‘any information effects of centralized OSNs by creating decentralized sys- relating to a [...] natural person [...] who can be identified, tems, providing the social networking functionality. directly or indirectly, in particular by reference [...] to one Approaches for encrypting content in centralized OSNs or more factors specific to his physical, physiological, men- (e.g. [27]) may mitigate content censorship and communi- tal, economic, cultural, or social identity’’. PII can consist of cation confidentiality concerns but they still allow the OSN content, e.g. pictures and messages, as well as all types of provider to observe communication patterns. Individuals incidental data which can be derived from e.g. technical can still be excluded from the system to conduct censor- properties (e.g. size) of content or communication ship. Those encryption approaches also raise the question parameters. whether the business models of today’s OSNs still work Authorization is a mechanism to decide about legitimi- and allow the providers to make sufficient infrastructure zation based on previously defined rules. Access control available. We thus argue that decentralization is the best denotes the action to allow legitimized subjects to access available concept to address the trust, the privacy and content and to prohibit unauthorized access. According to the censorship issues. ‘‘privacy as control’’ in [16], privacy in our context means Many kinds of DOSNs have been proposed by several the effectiveness of users to be able to restrict access to authors. Nevertheless, the idea of distributing OSNs has information that the user is responsible for (as a producer not been widely adopted. Beside Diaspora,2 none of the of the message). The effectiveness can be affected by tech- DOSNs has a denotative user basis. In contrast to the authors nical and social (e.g. social engineering) interferences. of many DOSNs, Narayanan et al. doubt in [34] that decen- An Online Social Network (OSN) in this article is ‘‘an tralizing OSNs is a feasible way to build social networking online platform that (1) provides services for a user to services. We argue that distributing OSNs is a worthwhile build a public profile and to explicitly declare the connec- idea and aim to help the DOSN community with this survey tion between his or her profile with those of the other by elaborating and evaluating what has been suggested in users; (2) enables a user to share information and content the field of DOSN. with the chosen users or public’’ [37]. In the remainder of this survey, we define the terms, Since each OSN provides different functionality, we which are elementary for this article in Section 2. We state decided to distinguish basic functionality which needs to our requirements and adversary models (Section 3) and be part of the system to be considered being an OSN and introduce a DOSN architecture model to explain the design the extended functionality, which is not qualifying but space (Section 4) as well as the design decisions that have extends the service in a specific way. to be made in case of creating DOSN architectures (Sec- Derived from the definition of OSN, basic functionality tion 5). These design decisions determine the properties of consists of: DOSNs. Thus, they are the basis for our classification in Table 1. In Section 6, we discuss both: the consequences Profile management: creating, maintaining and deleting caused by the design decisions as well as the properties of of user profiles, which subsequently includes authoriza- DOSN classes (with respect to our classification). Further- tion mechanisms for profile attributes. more we list all approaches which fit in the shape of our Relationship handling: establishing and removing new DOSN definition, discuss the features of the different DOSN relationship declarations. approaches and provide a publication time line to illuminate Interaction: direct interactions (internal messaging sys- the publication history (Section 7). Several ideas to improve tem – 1:1) and indirect interactions by sharing content aspects in the field DOSNs have been published without sug- (1:n). gesting a complete new architecture. Since we consider them to be important contributions, we introduce a selec- The extended functionality, we define for this article, is a tion of DOSN related approaches in Section 9. Finally, we set of features which some of today’s OSNs provide. The elaborate the impact of decentralization on different OSN reason for mentioning them in this definition is that we affiliates and summarize and conclude our article. consider these to be important pieces, contributing to the attractiveness and popularity of the OSN platforms. We take the following into account: 2. Definitions
An API, allowing third party applications to run on the This Section defines specific terms used in this article: OSN platform. Section 2.1 contains elementary terms, Section 2.2 defines A search function to find other users of the OSN. different types of decentralization as well as terms that are A recommender system that recommends users to closely related to decentralization and Section 2.3 specifies become friends or content to be consumed. DOSN components. A social network connector, bridging different social networks. 2.1. Elementary terms 2.2. OSN decentralization definitions We use the term Personal identifiable information (PII) as it has been introduced by the Data Protection Directive 95/ Decentralization has more than one dimension in the field of OSN. We distinguish between technical decentral- 2 https://joindiaspora.com/ – accessed on 14th of January 2014. ization (resource distribution) which means that parts of T. Paul et al. / Computer Networks 75 (2014) 437–452 439
Table 1 DOSN approaches; (D = distributed, FD = fully distributed, BE = broadcast encryption, OOB = out of band).
Arch. Ref Degree Storage AC Interact Mech. Comments Peers Server ACLs Encr. Centr. Dec. P2P-OSN PeerSoN FD Previous – – – PKI – Direct + DHT Support for direct interactions (also with no download Internet access) Safebook FD Trusted – – PKI – DHT Anonymity of interactions via encryption friends and recursive hop-by-hop routing LifeSocial. FD DHT – – BE – Plugins Interactions based on external applications KOM (plugins) LotusNet FD DHT – – PKI – DHT Based on Likir DECENT FD Random – – ABE – DHT Social network functionality on top of nodes in a EASIER DHT Cachet FD Random – – ABE – DHT Performance improvement of DECENT nodes in a DHT F-OSN SoNet FD – Active Servers OOB or – XMPP XMPP-like architecture/social graph SMP obfuscation Mantle FD – Passive – OOB – Pub/ Group encryption on any storage, pub/sub submodel for interactions PrPl FD – Active Cloud Undef. – Plugins Cloud buttler either at home or in the cloud/ buttler own language: SocialLite Diaspora FD – Active Hosting – – Hosting Trusted social hubs, hosting several user nodes nodes pods each [Anderson] D – Active – PKI – Pub/sub Multi-layer clients with sandbox for external applications Hybrid Vis-a-Vis FD – Passive User – – DHT P2P substrate, data stored in user pods on pod personal devices/cloud services [Kryczka] D Social graph, Active Hosting – Central – Centralized OSN extended with P2P content locality node index storage [Raji] D – Active – BE – Pub/sub Private data on personal storage, rest at OSN provider Polaris FD – Passive User – – Ext. Storage on phones or servers, NAT traversal home apps + direct necessary Confidant D Trusted – – OOB Extern. – Storage on trusted servers, existing OSN is friends platform used for signaling (notification) Vegas FD – Passive – PKI – Direct P2P/reliable storage
the system run on different machines, at different parts of or dedicated servers which work together by processing the network and authorial decentralization which means federation protocols. A mixture of both has been suggested distinct and independent authorities run and maintain as well. technical resources. For the rest of the article, we thus define P2P-OSNs to be Since today’s OSN have a huge number of users, store a DOSNs that leverage P2P technology to provide the basic huge amount of data and cause a huge amount of network functionality, F-OSNs to be DOSNs that rely on a client–ser- traffic, they cannot rely on a single machine at a single ver infrastructure which is owned and maintained by dif- place in the web. Thus, all OSNs with a certain number of ferent authorities and Hybrid DOSNs to be DOSNs that users are technically distributed. Since in Facebook, Goo- rely on a mixture of P2P and client–server infrastructure gle+ and related OSNs one single entity (e.g. company) for different functionalities. has the omnipotent power to decide about what is allowed Unreliable resources may cause negative effects on the on their OSN platform, we define them to be centralized for performance of DOSN. Unavailable storage nodes can the rest of the paper. potentially be an obstacle for users to access profile data To be considered as a Distributed Online Social Network of other users. Thus, the availability of the user data (given (DOSN), a communication system needs to fulfill the two as a fraction or percentage of time a data item is available), criteria: to provide the core functionality, defined above, which is called profile availability in the remainder of this and at least one core functionality must not rely on cen- article, is an important quality criterion for DOSN. In con- tralized infrastructure. A DOSN is considered fully decen- trast, the service availability means the fraction of time, tralized if this holds for all basic functions. the social networking service is available to the user. Abolishing the social network provider along with its The issue of profile availability is a particular concern in infrastructure and data centers raises the question how P2P systems where a set of (unreliable) equal nodes are to organize resource provision. Authors of DOSN communicating directly without the necessity of server- approaches offer different answers: decentralization of based message distribution. Participating nodes join and OSN can be achieved using Peer-to-Peer (P2P) technology leave the network regularly depending on whether the 440 T. Paul et al. / Computer Networks 75 (2014) 437–452 user uses the service or not. We call this effect Churn [50]. sequently represented by the set of functionality and It represents the online behavior of nodes in P2P DOSN in performance properties of the proposed DOSN. Further- the remainder of this article. more, censorship resistance, security issues and economi- cal issues are discussed in the remainder of this article. 2.3. DOSN components We thus assume that DOSN need to provide a comparable level (compared to centralized OSN) of Service Quality in Components of DOSNs are briefly defined below for order to be considered as an alternative with respect to: later use within this article: 1. System performance User: person or organization owning an message transfer and profile update delays. identifier and a user profile within 2. Privacy of content and interactions the OSN. confidentiality and integrity of communication; User profile: digital representation of a user in the user authentication and access control; OSN, containing all user-owned data accountability of user actions within the system; items. incidential data evaluation vulnerabilities (e.g. in User handle: unique identifier for every user being case of cipher text access); part of the OSN system. resistance to censorship; Content: Data item which is stored or shared membership concealment. within the OSN. 3. Functionality (e.g. user handle and content search func- Connection: declared affiliation or acquaintance tionality, recommender systems, API). between users (e.g. friendships). 4. Economical issues Node: network device, used by users to con- network infrastructure costs and storage resource nect to the OSN. provisioning; Server: network device, which reliably sup- type of payment (e.g. money to rent servers or ports service provision. resource contribution via P2P approach).
3.2. Adversary models 3. Requirements and adversary models The existence of an omnipotent Social Network Provider In this Section, we discuss the requirements that are our (SNP) is considered to be a privacy problem by the authors benchmark to evaluate DOSNs and introduce the adversary of DOSN approaches. The underlying assumption is that models that are later used to discuss the security of DOSNs. the provider can neither be trusted to protect user data from external attackers nor to withstand misusing the data 3.1. Requirements for monetization purposes. However, the OSN provider maintains a closed system with little attack surface for In the remainder of the paper we present and discuss external attackers. The question thus is whether decentral- different DOSN approaches, but none of them has a deploy- ization is the way to go for improving privacy. To discuss ment with a reasonable user base and the full set of func- this issue, we define the following set of attackers: tionality compared to today’s most popular OSN, Facebook. We consider the non-academic approach, Diaspora, with 1. An adversary which has read and write access to all 3 about 400,000 users to be the most successful DOSN. It still data, stored in the system (curious omnipotent SNP). comes without a recommender system for friends and con- 2. A traffic observer, having an Internet Service Pro- tent and without a system-wide content and profile discov- vider (ISP)-like view at the network traffic. ery mechanism. 3. An adversary who can enforce all authorities (organi- Elaborating success determinants of DOSN is out of the zations and companies like SNP and ISP) to corporate scope of this article, but according to [34], we assume that with her (governmental attacker). it is a necessary success-precondition for DOSN to imple- 4. The mass data collector, collecting as much data ment attractive functionality in a usable way. Subse- about as many users as possible (e.g. crawler). quently, we assume that users do not completely trust 5. The stranger adversary which represents an arbitrary their OSN providers not to misuse private data [19], but user of the OSN (no direct friendship connection to that they do not want to abdicate benefit of OSN function- the attack target). ality. Hence, DOSN need to become as usable and as useful 6. The friend adversary, defined in [25] which is as their centralized counterparts in addition to respect exploiting the friend connection in the OSN. user’s privacy to become successful competitors. 7. The online reputation attacker, aiming at destroying In our discussion we thus use Facebook as a baseline for the reputation of individual users (cyber bullying). the Quality of Service (QoS). Since we do not have access to implementations of all proposed DOSN systems (the 4. DOSN architecture model majority of approaches are scientific and thus implementa- tions may even not exist), we discuss the approaches sub- The following 3-layer DOSN – architecture model (Fig. 1) introduces an abstraction of the DOSN design space. 3 https://diasp.eu/stats.html. Subsequently it describes its components which are T. Paul et al. / Computer Networks 75 (2014) 437–452 441 addressed by approaches which are covered by this survey or are core functionalities of today’s popular OSNs. Existing DOSN approaches individually take just a subset of the optional extensions into account, but minimally specify the DOSN core layer. The lowest layer represents the communication net- work which is used for all participating entities to commu- nicate. We assume that it reliably transmits messages from one entity to the other. The middle layer, called ’’DOSN – core’’ contains all components which are necessary to pro- vide the basic DOSN functionality. The upper layer repre- sents extensions aiming at making the user experience enjoyable. It is divided into two sublayers where the lower part is hidden from the users and thus provides services for the elements of the upper part, facing direct user interactions. Fig. 1. Architecture for DOSN. The core component contains three main parts:
the access control component which can be realized appearing while developing DOSN, lead us to identify the either via access policies, via encryption schemes or a three main criteria for classification: (i) the way of decen- combination of both, tralizing the storage of content, (ii) the mechanisms to the profile storage component which describes how decentralize access control and (iii) the way how decen- profile data is stored in the system and tralized interaction and signaling mechanisms are an overlay or federation component to organize the implemented. communication between nodes. We distinguish between protocols supporting direct user interactions 5.1. Decentralized storage of data (communication) and those supporting technical infor- mation exchange (e.g. profile update propagation) Decentralized storage is a very strong concern of the where the latter is transparent to the user and hence authors of OSN. The main idea is to put the data owner into may raise different time and volume requirements. a position to hold sway over her PII by keeping the data stor- age in her influence zone (sphere wherein the user or a The extensions layer consists of two sublayers. Only the trusted third party, e.g. a friend, is directly capable to deter- components on the upper layer face direct user interac- mine storing, erasure and access operations). In fact, differ- tions while components of the lower sublayer are hidden ent storage concepts strongly characterize the different from the user. We define the following hidden modules DOSN approaches, since they have a big impact on the nat- of the extensions that implement the extended functional- ure of the architecture itself. Three different fundamental ity (Section 2): types of decentralized storage of content have been pro- posed: storing on (i) peer nodes (P2P-OSN), on (ii) external API as an interface for third party applications; permanent servers (F-OSN) or on (iii) a mix of both (Hybrid a recommender system which can potentially recom- OSN). mend both: friends relationships to create as well as In the case of storage on peers (users’ devices), one main content items to consume; challenge is to handle churn provoked resource unreliably. a search scheme which supports privacy preserving To minimize the risk for data loss and data unavailability, search for user handles or content addresses; redundant service provision is mandatory. Different perfor- a social network connector, connecting the new DOSN mance implications of redundancy procuring approaches to existing OSNs, since network effects yield the largest yield this design decision crucial for P2P-OSNs. Since repli- OSN the most attractive since the probability of finding cation of resources is the only type of redundancy leveraged friends is growing with a growing number of users. in the literature, one important storage-related system design decision for P2P-DOSN approaches is to choose the The two components with the closest position from nodes where to save the copies (i.e. replica placement). user perspective (and hence not hidden from the users) The suggested replica placement strategies are to store: are the GUI (graphical user interface) and the applications which can be built by third parties or users. We consider data items somewhere randomly in the network; both to be on the same layer since applications may realize data on a set of strangers’ devices; own GUIs. data on friends’ nodes; data on a chosen subset of friends; data by leveraging a DHT. 5. Desing decisions To circumvent the availability issue, the replica place- Representing the core of our DOSN model and under- ment and maintaining effort, storing on reliable external standing the different ideas to address the challenges servers has been suggested. Profile owners in DOSN have 442 T. Paul et al. / Computer Networks 75 (2014) 437–452
– in contrast to centralized OSN – the choice where to store lower level aspects and relying on higher level plug-ins their data. The criteria for this decision are monetary cost, for handling interactions. trust toward the service provider or guaranteed levels of In our classification, we thus distinguish between cen- availability and reliability. We distinguish between flat tralized and decentralized handling of interactions and storage on arbitrary resources and F-OSN based on special- point out the adopted approach. ized servers implementing OSN logic at the same place. Hybrid approaches may allow both: storing data on 6. Resulting effects of design decisions dedicated servers as well as storing locally on churn- exposed peers. In this section, we discuss the properties and implica- tions of the respected classes entailed by the basic design 5.2. Decentralized access control decision elaborated in Section 5.
Since one goal of DOSNs is to improve privacy in OSN 6.1. Decentralized storage of data (definition in Section 2), DOSN should allow users to define exactly who is part of the set of legitimate content recipi- The answer to the question of where is a convenient ents for each single piece of content. Two general primi- place to store data in DOSNs naturally commemorates tives have been suggested: access control which is the impacts of the issues of data availability, storage costs performed by trusted entities as well as encrypting content as well as trust. Data availability is an important issue in and distributing keys among legitimate recipients. Further- case of using unreliable resources (P2P). Storage costs more, mixtures of both primitives are part of some become important in case of applying replication schemes approaches. that maintain multiple copies in the network or in case of Approaches relying on ACLs are based on the principle using dedicated resources. In either case, the storage that users have to prove they own necessary rights to an devices have to be trusted to reliably serve legitimate authority enforcing policies defined in the ACLs to access requests and not to leak or misuse accidental data or even or modify a given piece of content. In our classification, the content itself if it is not encrypted. we characterized works relying on ACLs based on who In P2P-OSNs [10,12,24,5,30,36] data availability is enforces the policies, which can be peers or external serv- bound to the on-line time of the different principals and ers (based on where data are stored). Finally the ACLs can can be enhanced thanks to the discussed replication mech- be enforced by external services in the form of applications anisms. In [11] several replication mechanisms are dis- or plug-ins, run on the top of the platform, which allow cussed, which show how availability increases with users to interact with each others. replication granularity. Data encryption approaches are based on the principle No matter how the replication nodes are chosen, stor- that anybody can retrieve a piece of content, but only users age on peers costs storage as well as bandwidth resources who have decryption keys can interprete it. Relying on con- which are not for free. Sophisticated approaches [31,46] tent encryption for performing AC, implies the definition aim at minimizing resource consumption while of a key management mechanism. In our classification, maximizing profile availability. We briefly describe them we thus characterize several works based on the adopted in Section 9, since these approaches are just replication mechanism. schemes rather then complete DOSN approaches A motivation for implementing both: an ACL as well as according to our definition and hence not part of our an encryption scheme is that ACL does not protect from classification. access to encrypted content (ciphertext) and thus still However, data replication may affect data consistency, allows for inferring communication details like e.g. the since the latter is significantly harder to achieve as the data size or communication patterns [26]. number of copies of a single piece of content, distributed on several nodes, increases. From the user’s point of view, 5.3. Interaction and signaling mechanisms all replication schemes, suggested by the authors of DOSN, come with serious disadvantages: Interactions among users in terms of sending messages are at the core of any social platform and may include sig- 1. Storing replicas at friends’ nodes naling and notification and establishment of new relation- Bootstrapping: it is difficult when entering the net- ships, etc. In centralized OSNs, the service provider work while having no friends. mediates interaction among users. Correlated failure: the profile cannot be found by In DOSNs, interaction mechanisms can be either: (i) still unconnected friends and strangers if all friends are centralized, meaning that they are handled by one single offline at a given point in time. logical entity (in some cases DOSN still rely on classical Load balancing is not scalable to popularity peaks if centralized counterparts for handling interactions [33])or the set of replica nodes is fixed and limited to the (ii) decentralized. Decentralized interaction can be realized friend’s devices, assuming that profile data items based on a P2P substrate, relying on direct interactions can be requested publicly (e.g. requests caused by among user terminals, on the publish-subscribe models a newspaper article about a person). or on federation protocols including inter-server commu- 2. Random replication without management requires a to nication (e.g. XMPP). Some DOSNs do not define how such high number of replicas to be feasible under realistic mechanisms should be implemented, rather addressing churn assumptions [38]. T. Paul et al. / Computer Networks 75 (2014) 437–452 443
3. Passive replication in which offering access to previ- Credential Authorities/PKI. In those cases, the Credential ously downloaded profiles is granted, does not support Authorities (CA) are only used to cryptographically initiate unpopular profiles to stay available since unpopular the OSN, while they do not mediate communications and profiles are not frequently accessed. cannot trace interactions. Finally, Graffi et al. in [24] propose to rely on a DHT sub- Assuring data availability and integrity is not an issue in strate also for distributing keys, which allows to avoid any F-OSNs, since users may store a single copy of their data necessity for a central node in the network. As a conse- only on a reliable professional storage which they trust quence, there is no need for OOB communication nor Cre- for not altering or removing their data. Social network dential Authority, but it comes without any kind of architectures relying on flat storage [21] with no OSN-spe- identification. cific logic implemented, allow flexible choice of storage Cryptographic methods which allow malicious parties resources, since different types of storage resources (e.g. to access cipher code still do not prevent from inference upload and download services, e-mail boxes or personal attacks. Attackers may infer the type of a message (e.g. web space services) exist. Users may choose external serv- video vs. chat) from the size. Furthermore, access to cipher ers for data storage based on criteria such as technical code allows attackers to notice actions (depending on the specifications (storage size and bandwidth), trust, mone- encryption mechanism) like revocation of access rights or tary costs or reliability. The drawback is that there must access patterns [26]. A combination of limiting access via be a place to process the OSN logic and if it is not the stor- ACLs and encryption or obfuscating methods like chunking age offering server, an additional party, which has to be and salting can mitigate this issue. trusted, is necessary. In contrast, approaches relying on special OSN servers 6.3. Interaction and signaling mechanisms for storing user data [44,45,43,6] abolish the need for external OSN logic deployment but limit the users in Different types of interaction handling mechanisms choosing a storage location to the OSN servers instead of with contrary implications have been proposed by the any arbitrary storage resource. authors of the approaches which are covered by this arti- Hybrid approaches, allowing both: to store on dedicated cle. Interaction includes messaging as well as sharing servers as well as to store on own hardware (e.g. diaspora), pieces of content. Sharing operations consist of making relieve users from the need for external services. pieces of content available for being downloaded by other users. We distinguish between centralized and decentral- 6.2. Decentralized access control ized interaction mechanisms.
Limiting access to content to a desired set of recipients 6.3.1. Centralized handling of signaling is at the core of each privacy concept. Three general con- Centralized interaction handling can be achieved by cepts can be found: ACLs (Access Control Lists), encryption purpose-built specialized services or via utilizing existing schemes and a combination of both. All those concepts can OSNs (e.g. Facebook) for signaling. be realized on the granularity of individuals, role based The centralized interaction mediation and handling of access control as well as access control on the basis of a metadata is suggested in [32]. In contrast to centralized group management system. OSNs where resources of a central authority takes care of Restricting access via ACLs can be realized straightfor- different functionalities (e.g. storage, authentication and ward via granting access to legitimate users after authenti- interaction management), a (single) central node is respon- cation (before accessing content, the knowledge of the sible just for the interaction and metadata handling. The secret needs to be proven) or identities (users being part aim is that interaction handling can be done via reliable of a content owner-defined set of legitimate identities are and powerful units for achieving good quality of service allowed to access). without having a central authority which is able to access Since ACLs do not provide any kind of protection against user data. The underlaying assumption is that user data attackers which are able to listen to the communication at access (like in centralized OSNs) is a crucial part of the ser- the underlaying network and access policy enforcing par- vice provider’s omnipotence and needs to be abolished. ties need to be trusted, several authors of DOSN suggest Lockr [53], Polaris [54] and Confidant [33] rely on existing to implement encryption schemes in spite of their need platforms performing signaling mechanism. for key distribution. In our classification, we thus charac- However, centralized interaction and metadata han- terize the approaches based on the trusted parties enforc- dling approaches still give the OSN provider access to ing the ACLs and the adopted key management mechanism metadata and content access information. That means in case of content encryption. the central authority is still able to learn e.g. the interests, Most encryption based DOSNs [54,21,7,6] rely on Out- social connections and popularity of users and their pro- Of-Band (OOB) mechanisms for exchanging the whole keys files. Hence these approaches require the users to trust (or fingerprints of the key that can be used for retrieving the authority to a certain level. the associated key, for example relying on cryptoIDs [39], as suggested in [6]). This of course implies the disadvan- 6.3.2. Decentralized handling of interactions tage of the need for a secure and trustworthy OOB channel. P2P systems often rely on a DHT as a signaling mecha- As an alternative to OOB mechanisms, Safebook [13], nism thus mediating interactions. For example, in Safebook PeerSoN [10,51] rely on trusted nodes playing the role of [13], PeerSoN [10] and Vis-a-Vis [47] the DHT system can 444 T. Paul et al. / Computer Networks 75 (2014) 437–452 be used as an asynchronous messaging mechanism, which profiles are replicated for better profile availability at may include signaling of new actions/interactions. Users friend’s nodes in the innermost shell. Nodes at the outer- can query the DHT with the ID of a user or a specific piece most shell are entry points for routing requests to the cen- of content. ter of the Matryoshka and can be found via querying the A unique feature of P2P-OSNs consists of the possibility lookup service. This overlay structure hides the friendship of direct interactions among users, also with no Internet relations from strangers by multihop routing. TIS verifies access, how suggested in PeerSoN [10] and in Polaris user identities. [54], at least for some kind of interactions. While PeerSoN relies on direct data exchange among user devices, in 7.1.3. LotusNet Polaris data may be stored/replicated on external servers LotusNet [5] is a modular P2P-OSN platform, realizing and user smart phones only play the role of entry point social network functionality in widgets. The communica- to user data. tion infrastructure as well as the encryption scheme and The decentralized interaction handling comes with the the identify management is realized by using the DHT main advantages not to require trust into a single entity modification Likir [4]. Access control is realized by signed for that (interaction) purpose. Drawbacks are that those grants for proofing social relations. The data owner hence decentralized systems may leak metadata by cipher evalu- specifies the type of social relation which is necessary to ation [26]. They may also suffer from churn-caused node access the data item. unavailabilities and – like approaches with purpose-built centralized interaction mechanisms – from missing con- 7.1.4. LifeSocial.KOM nectivity to popular centralized OSNs like Facebook. Graffi et al. [24] present an approach where all OSN functionality is realized by plug-ins. Storing and exchang- ing data items is realized with the help of FreePastry 7. DOSN approaches [41]. PAST [17] is used for data replication. Cryptographic Public Keys are leveraged to be user IDs in the network This section supplements the Table 1 with a short par- thus uniquely identify users in addition to encrypt content agraph of text for each approach. The rationale behind this and messages. section is that a classification cannot capture all unique details of all approaches. The aspects which are already 7.1.5. DECENT covered in the classification are not mentioned again, DECENT [30] is a modular and object-oriented architec- except when they are part of the unique clue of the ture DOSN architecture. It leverages a DHT to store user approach. Advantages and disadvantages of approaches data and uses cryptography to protect confidentiality and are not discussed in this section for each approach, since integrity of user-owned content. The focus of the authors similarity of approaches causes redundancy in the evalua- is a blog-like wall rather than chat messages. The architec- tion. Section 8 encloses an evaluation based on classes ture is modular, i.e. the data objects, cryptography and instead (Fig. 2). DHT are three separate components interacting with each Furthermore, we explain the publication time line aim- others based on an interface. This modularity causes free- ing at making it easy to grasp when an approach was pub- dom to use any kind of cryptography (ABE based on [29] lished and which approaches can be assumed as known by is suggested in DECENT) and any type of DHT. which authors of newer approaches.
7.1.6. Cachet 7.1. P2P-OSN Cachet [36] is an improvement of DECENT. Thus it is also a decentralized architecture for social networks that 7.1.1. PeerSoN provides strong security and privacy. The main difference The authors of PeerSon [10] propose a two-tier architec- is that Cachet introduces social caches to improve the per- ture in which the first tier is a Distributed Hash formance of the system by avoiding the pull-based grasp- Table (DHT) and the second tier consists of the nodes rep- ing of many single data items from different sources. resenting users. The idea is to use the DHT to find the nec- Therefore nodes leverage social trust relationships to essary information for users connecting directly to the ‘‘maintain continuous secure (SSL) connections with online target nodes. This approach comes without a replication contacts to receive updates directly as soon as they are scheme and stores offline messages at the DHT (OpenDHT produced’’. In case of overlapping online times, this type in the prototype implementation). All user content is of presence protocol can effectively reduce communication encrypted. delays.
7.1.2. Safebook 7.2. F-OSN Main objective in case of Safebook [13] is to protect pri- vacy of users in a DOSN setting. The architecture consists of 7.2.1. SoNet three main components, namely: Matryoshkas (a ring-like SoNet [44] circumvents the implications of P2P mecha- ego graph reflecting friendship relations), a P2P lookup ser- nisms (like profile availability and free-riding attempts in vice and a Trusted Identity Service (TIS). resource provision) by suggesting an XMPP-like architec- Each node is surrounded by its friends (first shell) and ture. Every node is attached to one server, implying the friends-of-friends (second) shell in its Matroyschka. User address scheme to be user@host (RFC 822). Profile data is T. Paul et al. / Computer Networks 75 (2014) 437–452 445
Fig. 2. Time line of the publication dates. encrypted and replication is still part of the architecture to 7.2.5. [Anderson] mitigate server failures. The clue of this approach is to The authors of [6] define a privacy preserving architec- obfuscate the social graph by introducing single direction ture for decentralized social networking that takes advan- pseudonyms. tage of the simplicity and performance of the centralized client–server model. The main goals are to protect personal data from unauthorized access, to hide the social graph 7.2.2. Mantle (like friendship links) as well as assuring content integrity. Mantle [21] is a DOSN approach, settled around the idea The ideas described in this approach are closely related to leverage arbitrary storage in the web (cloud services as to the field of software engineering rather than network well as mailboxes, etc.), to store user data. Since the arbi- architecture. The authors suggest the client software to trary storage concept disallows storage entities to deploy consist of the following layers: the application layer, the any logic, the service-related logic is implemented in data structures layer, the cryptographic layer and the net- user-owned clients. Interaction is managed by employing work layer. The layered architecture render the software a publish/subscribe model and is handled locally without components on each layer exchangeable. All applications any help of centralized server. are supposed to run in a sandbox, allowing the applications to access just a predefined subset of the private data. 7.2.3. PrPl PrPl [45] stands for Private Public. The main goals are to 7.3. Hybrid DOSN allow users to store data in their own influence zone by choosing trusted storage resources and to run social appli- 7.3.1. Vis-à-Vis cations across different domains while sharing data with- A VIS (virtual individual server) [47] is a reliable per- out privacy concern. The idea of the architecture is to sonal server, assigned to every user to store her data. The have Personal Cloud Butlers to store personal digital assets main idea is to build overlay networks (with VISs as mem- to support access control mechanisms. A Pocket Butler bers) that correspond to social groups. Members of groups handles all authentication and communication with per- are supposed to have the intention to share their location. sonal cloud Butler along with the facility to allow sharing The focus of Vis-à-Vis is to support location-based OSNs of resources across multiple applications. while preserving privacy of location information by sup- PrPl uses SociaLite: a language based on Datalog which porting flexible degrees of location sharing in different allows developers to access the data by just querying on groups. the data served by Butlers. OpenID is used for authentication. 7.3.2. [Kryczka] In this approach, a User Assisted OSN (uaOSN) [32] is 7.2.4. Diaspora proposed where users can contribute resources to reduce The main aim of Diaspora [43] is to build a reliable and the costs of the OSN provider and to increase scalability. usable decentralized online social network. The architec- In uaOSN, queries are sent to the provider which informs ture is based (similar to PrPl) on a client–server model the user about storage placement for large content items where every user has his own server instance (Pod) which like photos or videos. The uaOSN provider stores the user is used for storage, communication and access control. profiles and metadata of the outsourced content. Data in Since there is no data or service replication, pods must uaOSN can be either stored on user’s desktop or set top always be online for reliable service provision. A Pod can box/residential router which can have a hard disk or on be hosted either on own hardware or by a service provider paid storages like Amazon cloud services. To achieve better (cloud service) Data is stored unencrypted on the pod, pro- a profile availability, data is replicated. An encryption tected by an access control mechanism. scheme is not part of this approach. 446 T. Paul et al. / Computer Networks 75 (2014) 437–452
7.3.3. [Raji] The user-assisted OSN (uaOSN)-approach of Kryczka Similar to the uaOSN, Raji et al. propose in [40] to store et al. uses user devices for data storage. Even though the private data (encrypted) beside the OSN on personal stor- users may be able to exactly specify which data is sensitive age servers which are assumed to be honest but curious. (we doubt that, since sensitivity is depending on the A BE scheme enforces the access control as well as the con- knowledge of the attacker) and store this data on private fidentiality of the data. storages, the OSN provider is still able to learn sensitive facts about the users by evaluating incidental data. The 7.3.4. Polaris SNP may learn habits like diurnal usage patterns (e.g. con- Polaris [54] is an ‘‘architecture for OSNs that preserves clude that the user works at night) and the social graph. monetary incentives for OSN providers to store and man- That issue applies for Polaris in the same way, since every age user data, while also mitigating the systemic privacy provider of a particular functionality can learn usage pat- concerns associated with monolithic OSNs.’’ To realize this, terns and two-sided actions like messaging (sender and a user can choose a different provider for each functional- receiver) potentially leak knowledge about social relation- ity (e.g. photo storing or microblogging). Highly sensitive ships. We argue that it is necessary to hide metadata and data is stored at a mobile phone which is assumed to be communication habits as well as social graph information able for keeping small pieces of content available. The from the SNP to protect user’s privacy. authors argue that as a result every provider which is involved in service provisioning can just access a subset 8.1.2. Traffic observer of the whole personal data. The situation in the field of P2P-OSNs is that all approaches implement some kind of encryption. Assuming 7.3.5. Confidant that the attacker is not able to decrypt ciphers, she is still Confidant [33] fosters decentralized data-processing able to infer who communicated with whom and how being scalable and affordable by storing data without often. Furthermore, the data item sizes can be inferred by encryption. It relies on social trust relationships in friends observing the traffic. This allows for guessing what kind to replicate the data on secure devices. The challenges of data is exchanged (chat messages, photos or videos). If addressed in this paper are to manage access control and replication schemes rely on social graph metrics (e.g. to assure data consistency among the distinct replicas. friendships or trust), those can potentially be observed as well. Only one approach, covered by this survey (Safe- book), tackles these issues by redirection schemes or traffic 7.3.6. Vegas obfuscation. Vegas [18] is a DOSN architecture proposing to use reli- Safebook introduces the concept of Matryoshkas where able data storages for increasing the availability of user friends form ring-like structures in egocentric networks. data in a P2P setting. The encryption scheme based mutual Traffic is redirected from outer to inner circles. Neverthe- public keys for exchanging symmetric keys is used to less, Matryoshkas are still vulnerable to timing and traffic ensure the confidentiality of user data. observation attacks since there is no traffic obfuscation or message throttling included. 8. Evaluative discussion Inferring facts by observing traffic in F-OSN can be chal- lenging if more than one user is using one server and if the In this Section, we discuss the present situation in the servers are re-encoding the data items, since the traffic field of DOSNs on the way to become an alternative to their observing attacker can than only observe that a set of users centralized counterparts. We thus elaborate the degree of is connected to the server but not who exactly communi- achievement with respect to our requirements. We focus cates with whom. The success of the attacker depends on on the fitness of the DOSN approaches to help to improve how much information can be learned from communica- privacy as well as on the quality of user experience. We tion intensity (traffic, data size) and timing attacks. discuss the latter by looking at performance issues, Considering hybrid solutions, the situation strongly resource provision, technical knowledge which is neces- depends on the concrete architecture. They are as vulnera- sary to use the DOSN and finally the offered functionality. ble to traffic observing attacks as P2P solutions are if direct communication happens among peers or if it can be 8.1. Privacy and security inferred from the storage place to which the latter is assigned. Approaches like Polaris [54] may mitigate the The major reason for authors to suggest a distributed success of traffic observers by combining different central- approach for social networking is to increase privacy and ized services for communication and storage. The uaOSN security. Hence, the enthralling question is: Are the sug- [32] cannot be evaluated by now, since it is highly depen- gested approaches appropriate to achieve better privacy dent on what exactly is stored at the peers and how it is and security? We discuss this question with respect to accessed. A caching mechanism in the centralized part of our adversary models (Section 3.2). the uaOSN can be a game changer for traffic observing.
8.1.1. SNP attacker 8.1.3. Governmental attacker The overwhelming majority of approaches abolishes the Governments tend to try to censor or even disable social SNP completely and hence it does not exist as attacker networks as soon as riots start in that country. The Arab anymore. spring is a prominent example for that phenomena. Gov- T. Paul et al. / Computer Networks 75 (2014) 437–452 447 ernmental type of attacker can (simplified) be considered become a focus of DOSN. Accountability, however, may being a unification of the SNP attacker as well as the traffic affect the achievement of anonymity goals. observer. The questions is: Is there an approach which can resist the governmental attacker? 8.1.8. Conclusion for the privacy and security evaluation Even though assuming that the government does not The main advantage in privacy protection, which can be want to disable the whole communication infrastructure achieved with the approaches in this survey, can be seen in of a country to disable social networking, we argue that protecting against the central OSN provider. Authors tend none of the approaches is bullet proof. P2P approaches to protect communication content rather than hiding com- (without traffic obfuscation) are vulnerable to traffic munication. From our point of view, no approach can pro- observing attacks: Governments could find out who com- tect against the governmental attacker being interested in municates with whom and who is important for organizing building communication graphs. demonstrations. Server-based architectures can easily be Censorship is not an issue in most DOSN (in Polaris and deactivated if the servers are well known and run within uaOSNs it still is) because of the usage of cryptography. the influence zone of the government. From our point of That implies that it is hard to frustrate illegal actions. Ille- view, research in making DOSN more resilient against gov- gal content can be shared with only a minimal risk and ernments is eligible. attacks on the reputation of users are abetted. The answer to the general question whether DOSNs improve privacy 8.1.4. Stranger and security of users strongly depends on the point of Stranger attacks with the goal to learn private facts view: DOSN can effectively protect the content which is about a particular user would be very weak if people would shared but they may foster misusage. use the access control mechanisms in OSNs properly and if they would be aware of inference attacks (assuming facts 8.2. User experience to be valid also for friends). The success of stranger attacks are in general less depending on the architecture of DOSN Measuring user experience by conducting a user study but rather on efficient access control. Perfect usage in DOSN is hard to perform since no DOSN (except Dias- assumed, none of the presented DOSN open an attack sur- pora) has a user basis rather than public-available and face for stranger attacks. usable prototypes. Having no better alternative, we discuss performance issues, the skills being necessary for using 8.1.5. Mass data collector DOSN and the functionality instead. State of the art for mass data collection is building crawlers. That could be possible if data items are pub- 8.2.1. Performance licly-accessible and if user handles are available to address P2P approaches replace the database queries in central- profiles. The straightforward approach for crawling a social ized OSN by vast inter-node messaging for accessing data. network is to first create a user account then initially con- The authors of Safebook [13] consider 11 s to be a realistic nect to arbitrary users and try to crawl their friend lists. time for requests if no performance optimizations are Iterating over friend lists can theoretically lead to a dis- employed. Cachet introduces a caching strategy for covery of the whole connected region if every user allows improving the performance by maintaining encrypted to access a list of her friends. Hence, no matter at which channels to friends. Receiving unpredictable data items type of architecture, it is very important to disallow strang- from strangers (e.g. friend-of-friend) still causes time con- ers accessing friend list in general. DOSN architectures thus suming operations. do not help to mitigate attacks from mass data collectors in F-OSN and Hybrid approaches do not suffer from these case that access to profiles is restricted in centralized OSNs. P2P-specific performance limitations, but still cause feder- ation overhead. In general we would see a performance 8.1.6. Friend attackers advantage for centralized OSNs since a single authority is Friends, being attackers aiming at accessing more infor- able to globally optimize its databases and to build caches. mation than authorized by the data owner, can be success- ful either when access control is not performed properly or 8.2.2. Usability if replication schemes in P2P-OSN rely on social trust. A If DOSNs leverage cryptography for privacy, basic node where friend’s (encrypted) content is stored can still knowledge about cryptography may be necessary to use learn incidental data. the DOSN. For example, users need to understand that they need to exchange public keys. Furthermore, the presented 8.1.7. Cyber bullying approaches (except Polaris) require users to install a client The social phenomena to attack the reputation of an software instead of being only a web application. Installing individual can be observed in an environment like OSN software on local machines may cause a need for actions as well. In a centralized setting without content encryp- which require administrative rights on the local system. tion, the omni-potent provider can delete content as well Moreover, the necessity of local software installations as user accounts if the well-behavior rules are not could cause interoperability issues and is an additional respected by users. No author of a DOSN considered misbe- procedure which might be an obstacle for users. We thus havior of users by now. To tackle that issue, accountability argue that any kind of DOSN should be running at every of actions (e.g. posting content or messages) needs to web-connected device without installation obstacles to 448 T. Paul et al. / Computer Networks 75 (2014) 437–452 achieve a usability which is comparable with centralized quently updated. This is in stark contrast to file sharing OSNs. applications, which usually provide a comparatively low number of large and popular files to a high number of 8.2.3. Functionality users. A stark contrast exists even to conventional P2P No DOSN provides the same functionality like Facebook. backup and storage scenarios, which are characterized by One reason of course is that the approaches are academic rather infrequent I/O access to the stored data. Further- and concentrate on a particular ideas to present rather more, contrary to file sharing and P2P backup and storage, being intended to be a social network which can be used in which all participants are treated somewhat identical, by the users. OSNs contain information about friendship and trust rela- The second reason is more wholesale in nature: popular tionships that can be exploited. Many techniques that are functionality like recommender systems, search function- deployed in P2P storage environments – like erasure codes ality and some online games leverage the social graph – are not convenient in this dynamic environment. Thus, and user attributes. Having only local knowledge, the none of the P2P-OSN approaches is based on a file sharing whole social graph is not known to any single entity. The nor P2P storage scheme. The following subsection explains local (egocentric) structure can be learned via exchanging the solutions for profile availability in P2P-OSNs that are messages, functionality based on global knowledge will discussed in the literature. be too expensive. As shown in [38], choosing replication nodes randomly Acquiring the graph knowledge beyond the own graph leads to a high number of replicas if a convenient availabil- neighbors (friends) via messaging may effect the user pri- ity of user profile data should be achieved. Friend storage vacy. Even paramount functions like a sophisticated search approaches suffer from localization effects: if all friends mechanisms for user handles is not available in a privacy live in the same time zone (e.g. same city), it is very likely preserving manner. that they have the same off-line times in the night. Fur- thermore, if a new node has no connections to friends, it does not benefit from replication. Choosing the best subset 8.2.3.1. Conclusion for the user experience evalua- of friends for profile replication is an NP-hard problem tion. Considering our metrics for the user experience, [49]. the presented approaches (except uaOSN) will suffer Finding a systematic solution for having a good avail- disadvantages in comparison with centralized OSNs. This ability with minimum of cost and overhead is the goal of holds for performance as well as for the skills and the the authors of MY3 [35], SuperNova [48], Gemstone [52], functionality. We consider F-OSN and Hybrid DOSN to SOUP [31] and S-Data [46]. have the biggest potential to present a good trade-off: they SuperNova introduces super nodes for bootstrapping can be web-based as OSN are nowadays, do not suffer the and circumventing the disadvantages of utilizing friends’ performance limitations caused by maintaining P2P nodes for storing. Gemstone has a metric-based approach structures, and in case that the majority of friends is to select some friends which are a good choice for achiev- assigned to one server, they allow efficient local operations ing a high availability with low costs and SOUP proposes to instead of grasping data items from a high number of select replica nodes by calculating an online experience different sources. among friends. S-Data is a group-based approach where groups are generated on the basis of diurnal online pat- 9. Related approaches terns to reduce the number of replicas. The authors of MY3 [35] propose users to choose a subset of friends We discuss some approaches in this Section which (trusted proxy set) for performing profile replication and address DOSN related issues or approaches only aiming access control. Arguing that trusting the friends which at improving specific sub-aspects of DOSNs to highlight are performing the access control can replace the encryp- current challenges. We include approaches addressing tion of content and hence abolishing key distribution. This the profile availability issue in P2P DOSNs, encryption assumption simplifies the approach. schemes for DOSN as well as for centralized OSN being one alternative to distributing OSN and finally we include 9.2. Encryption schemes for OSNs social network integrators. Social network integrators are also included, since they Abolishing the omnipotent and trusted social network offer potential ways of extending the initially limited user provider as a mediator of communication between social basis of DOSN to temporarily increase their attractiveness network users, combined with the introduction of replica- until sufficient adoption. We thus think that a social net- tion schemes in P2P-OSN, leads to the need for encryption work connector is a crucial success component for new of content and communication (in case of leveraging upcoming social networks. untrusted resources). F-OSNs or hybrid solutions often aim at mitigating the need for trusting server entities and 9.1. Profile availability in P2P OSN rely on cryptography for this purpose. Only a minority of DOSN approaches comes without encryption and relies The load and requirements for storage in P2P-OSNs dif- on trust in friends (e.g. My3 [35]). fers strongly from distributed storage as well as from file Thus, the efficiency, performance and usability of sharing. OSNs environments require the storage layer to encryption and key distribution schemes are crucial factors reliably store many unpopular content items which are fre- for DOSNs for being widely adopted. For this reason, some T. Paul et al. / Computer Networks 75 (2014) 437–452 449 authors work on building new cryptographic mechanisms Günther et al. [28] provide a building block for privacy for that specific issue. Mentioning their relevance, we pres- preserving treatment (including encryption) of user pro- ent a brief sketch of the ideas and a brief overview of this files in OSNs. The authors of [8] compared different field. encryption mechanisms and evaluated them for their applicability in the DOSN context and concluded that 9.2.1. Brief OSN encryption background broadcast encryption would be the best choice for this Mutual public keys are the straight forward type of real- use-case. izing an encryption. For every recipient of a message, one EASIER [29] is an ABE architecture for DOSN, supporting encryption procedure has to be performed. Asymmetric dynamic group memberships and revocation of rights cryptography, however, is comparatively expensive com- without re-encrypting data items or issuing new keys. pared with symmetric cryptographic algorithms. Group The main idea is to introduce a proxy which needs to be key management mechanisms based on symmetric keys contacted before decryption. A user sends a part of the tackle that issue by distributing one symmetric key among cipher text (CT) to the proxy where a transformation takes a group of recipients (e.g. via mutual public key schemes). place. The transformed CT can only be decrypted if the Hence, one (symmetric) encryption process is sufficient to right was not revoked. share content with a group of recipients. As long as the Lockr [53] is an identity-management tool for OSNs that group setting does not change, a new key distribution is allows users to codify their relationships through social not necessary. attestations. The primary goal is to provide privacy as well Broadcast encryption (BE) schemes can rely either on as to simplify site management and accelerating content symmetric or asymmetric encryption and are used by delivery. Lockr’s decoupling eliminates the burden on senders to share confidential data with a dynamic set of users of maintaining, several up-to-date copies of social recipients in a cost-effective way. BE requires each recipi- networks, performing user-ID reconciliation across sites, ent to have an individual key. In BE schemes, the encryptor and familiarizing themselves with the varied access con- uses an encryption mechanism that allows to produce trol mechanisms provided by each site. A social attestation ciphertext that can be decrypted by plenty of keys which is a piece of data that certifies a social relationship. By issu- are defined during the encryption process. If a private ing an attestation, the issuer tells a recipient that they have key generator, leveraging identities to decide about legiti- formed a relationship. mation is part the system, the broadcast encryption The presented encryption approaches show that retain- scheme is called identity based broadcast encryption ing confidentiality of content in OSNs is possible. In case of (IBBE) [15,9]. suggesting a new DOSN approach, authors may rely on Attribute based encryption (ABE) [42,23] schemes existing encryption mechanisms. adopt that idea. An encryptor decides who is able to decrypt the ciphertext by labeling the latter with a set of 9.3. Private discovery of common social contacts descriptive attributes. Private keys are associated with ACL structures to decide, based on those attributes, which Discovering common social contacts is a common fea- ciphertexts can be decrypted. The encryptor thus does not ture in today’s OSNs like Facebook. In privacy preserving decide about decryption by taking single keys or identities distributed systems, it may not be desired to exchange into account but defines attributes or combinations of contact lists. De Cristofaro et al. [14] introduces a scheme attributes which a decryptor needs to meet to be able to which allows for finding common friends without disclos- decrypt a message. ing non-common friends. To the best of our knowledge, there is no discovery mechanism which neither disclose 9.2.2. (D)OSN encryption contributions the search index nor the search queries. As a result, there The main goal of Persona [7] is to disallow third parties is a trade-off between implementing (or using) a discovery to access personal information by deploying attribute- mechanism or preserving privacy with respect to search based encryption (ABE) in an OSN context. Each user gen- index and queries. erates an ABE public key (APK) and an ABE master secret key (AMSK). For each friend, the user can generate an 9.4. Social network integrators ABE secret key (ASK) corresponding to the set of attributes that defines the groups that friend should be part of. OneSocialweb4 is a project aiming at building an XMPP- The main contribution of the model from Sun et al. [51] based connector which potentially integrates all OSNs into compared with Persona is to have a very efficient revoca- one large social network. Other social network integrators, tion of content access rights. It uses broadcast encryption connecting a subset of popular services are: that enables the data owner to exercise desired access control. 1. Meople (http://meople.net/, accessed on 20th of The authors of Noyb [27] (‘‘none of your business‘‘) sug- January 2014) aggregated SNSs: Facebook, Link- gest to improve privacy by encrypting content and to mod- edIn, Google+, Twitter, Instagram, YouTube, Flickr, ify it in a way that it looks like legitimate content. Hence, it Groupon, Tumblr, Foursquare, VK, Odnoklassniki. allows users to use existing OSN while disallowing pro- vider to access the content. Applying this approach is not an obstacle for the provider to learn usage patterns as well as friendship relationships. 4 http://onesocialweb.org/, accessed on 20th of January 2014. 450 T. Paul et al. / Computer Networks 75 (2014) 437–452
2. Jyst (http://jyst.us/, accessed on 20th of January the service provider itself. In most cases, they present 2014) aggregated SNSs: Facebook, Twitter. no monetary costs to the final users [20], which pay 3. Alternion (http://www.alternion.com/, accessed on by agreeing for such platforms to exploit their data with 20th of January 2014) aggregated SNSs: Facebook, a commercial purpose. LinkedIn, Twitter, Instagram, YouTube, Flickr, Four- One of the benefits a decentralized approach should square, Picasa and the mail accounts: Gmail, Hot- bring to users, is that they should have the possibility mail, Yahoo!, AOL. to choose what resources to rely on. For example, a user 4. Yoono (http://www.yoono.com/, accessed on 20th can choose whether adding the own device’s resources of January 2014) aggregated SNSs: Facebook, Link- (e.g. P2P approaches) or relying on dedicated servers edIn, Twitter, YouTube, Flickr, Foursquare, (e.g. Diaspora). Using dedicated resources for building MySpace, Yahoo!, Google Talk, AIM, FriendFeed. DOSN does not cause an exploitable dependency like 5. TweetDeck (http://www.tweetdeck.com/, accessed using the resources of centralized OSN provider, since on 20th of January 2014) aggregated SNSs: Twitter, the OSN membership does not require an affiliation Facebook, Myspace, Linkedln, FourSquare, with one specific authority. Hence, the resource pro- GoogleBuzz. vider is replaceable. 6. Hootsuite (http://hootsuite.com/, accessed on 20th This opens to several business models which strongly of January 2014) aggregated SNSs: Facebook, differ from exploiting user data for commercial Linkedln, Foursquare, MySpace, PingFm, purposes. Wordpress. No censorship: Several centralized OSNs perform active 7. SpredFast (http://spredfast.com/, accessed on 20th censorship6,7 – called decency or content control – on of January 2014) aggregated SNSs: Facebook, Twitter, user behavior and content. This imposes significant limi- LinkedIn, Google+, YouTube. tations on what a user can or cannot do within the plat- form, based on rules which may strongly vary from one The aforementioned social network connectors could platform to another and are in general very subjective. potentially been leveraged to bootstrap a new (D)OSN Such rules can also be very country-specific, since OSNs since the attractiveness of OSNs is strongly bound to the have already accepted to be compliant to local laws user basis. imposed by several governments. Openness: DOSNs abolish the central authority, causing 10. Impacts on stakeholders caused by the that no single authority is able to exclude a user from decentralization of OSN the platform by suspending his account (e.g. because of not accepting copyright transfer rules). In this Section, we discuss the impact of decentralizing OSN on today’s OSN stakeholders. This includes benefits, While decentralizing OSNs does not come without drawbacks and challenges. drawbacks, the following aspects may become an issue The stakeholders in the context of OSN, considered in for users: this work, are: the OSN users, the OSN provider, the advertising companies which benefit from utilizing the Resource provision: Centralized as well as decentralized advertising opportunities offered by the OSN provider, OSNs need technical resources (e.g. storage, bandwidth) the governmental state and media consumers which are to operate. In centralized OSNs, the provider is respon- not necessarily part of an OSN. Effects on extenders (e.g. sible for making them available. The most popular application sellers) like Zynga5 are not discussed since the approach to compensate these efforts is to sell opportu- effects on them is strongly depending on the particular nities for personalized advertising. In the decentralized architecture. case, other mechanisms need to tackle the resource Since we consider the user to be the most important issue. affiliate, we start our discussion with the following bene- Profile availability: Availability of user profiles is fits of OSN decentralization for the users: strongly linked to the architecture of an OSN. In the cen- tralized case, the provider takes care of storing and Ownership: Facebook and other OSN provider ask the keeping user profiles available. Federated DOSNs rely users to transfer the copyrights of any content from on independent professional and reliable resources the user to the OSN owner. In contrast, decentralization while P2P OSNs utilize the unreliable resources of the holds user data in the influence zone of the users (Sec- users devices. tion 2). The copyright transfer can be avoided. Cyber bullying: Since decentralized OSNs hide or encrypt Privacy: In centralized OSNs, users need to trust the the communication, no central authority can enforce omnipotent provider not to misuse the data and to be rules. In the real world, no administrator can switch able to protect the data from attackers. off the voice of people which are bullying others as well, Flexible choice of resources: Building, running and main- taining OSN platforms cause expenditures. In central- 6 http://www.facebookcensorship.com/, accessed on 20th of January ized OSNs, platform-related resources are provided by 2014. 7 http://www.dailytech.com/Google+Plays+Name+Police+Conducts+Baf- fling+Censorship+Crusade/article22238.htm, accessed on 20th of January 5 http://zynga.com/, accessed on 06th of July 2014. 2014. T. Paul et al. / Computer Networks 75 (2014) 437–452 451
but everybody is responsible for what he or she is doing. social-graph based functionality like a comprehensive pri- We argue that DOSN should support accountability to vacy preserving search and a recommender system like in protect users. the centralized OSN counterparts. Hence, we argue that the Metadata privacy and the concealment of communication field of DOSN could benefit from research in building pri- partners: Depending on the particular architecture, vacy preserving graph-based functionality, combined with decentralizing OSNs may raise security issues that do performance optimizations. not exist in centralized OSNs [26]. An attacker which is able to observe traffic in the underlying communica- Acknowledgements tion network (e.g. IP) could track who communicates with whom if OSN devices are assigned to a single user This work has been [co-]funded by the German and can send messages to other devices without obfus- Research Foundation (DFG) in the Collaborative Research cation. In contrast, a centralized OSN has a mixing func- Center (SFB) 1053 ’’MAKI – Multi-Mechanism-Adaptation tionality. Assumin frequent usage, mixing functionality for the Future Internet’’. implies that the observer could only find out that users This research in parts has been funded by the MSIP communicate with the provider but not track single (Ministry of Science, ICT & Future Planning), Korea, in the communication paths among users. ICT R&D Program 2013. Functionality: OSNs allow to build social applications which are based on interactions between users who References share social links or special interests. Examples for these applications are recommender systems, interest [1] Censorship in Facebook.
[20] M. Falch, A. Henten, R. Tadayoni, I. Windekilde, Business models in [47] A. Shakimov, A. Varshavsky, L.P. Landon, R. Càceres, Privacy, cost, social networking, in: CMI International Conference – Social and availability tradeoffs in decentralized osns, WOSN, 2009. Networking and Communities, 2009. [48] Rajesh Sharma, Anwitaman Datta, Supernova: super-peers based [21] Antonino Famulari, Artur Hecker, Mantle: a novel dosn leveraging architecture for decentralized online social networks, in: free storage and local software, in: ICAIT, 2012. COMSNETS, IEEE, 2012, pp. 1–10. [22] H. Gao, J. Hu, T. Huang, J. Wang, Y. Chen, The status quo of online [49] Rajesh Sharma, Anwitaman Datta, M. DeH’Amico, Pietro Michiardi, social network security: a survey, IEEE Int. Comput. (2011). An empirical study of availability in friend-to-friend storage [23] Vipul Goyal, Omkant Pandey, Amit Sahai, Brent waters, Attribute- systems, in: IEEE P2P, IEEE, 2011, pp. 348–351. based encryption for fine-grained access control of encrypted data, [50] Daniel Stutzbach, Reza Rejaie, Understanding churn in peer-to-peer in: CCS, 2006. networks, in: IMC, ACM, 2006, pp. 189–202. [24] K. Graffi, S. Podrajanski, P. Mukherjee, A. Kovacevic, R. Sreinmetz, A [51] J. Sun, X. Zhu, Y. Fang, A privacy-preserving scheme for online social distributed platform for multimedia communities, in: Tenth IEEE networks with efficient revocation, in: INFOCOM, 2010. International Symposium on Multimedia, 2008. [52] Florian Tegeler, David Koll, Xiaoming Fu, Gemstone: empowering [25] Benjamin Greschbach, Sonja Buchegger, Friendly surveillance – a decentralized social networking with high data availability, in: new adversary model for privacy in decentralized online social GLOBECOM, IEEE, 2011, pp. 1–6. etworks, in: Current Issues in IT Security, 2012, pp. 195–206. [53] A. Tootoonchian, S. Saroiu, Y. Ganjali A. Wolman, Lockr: better [26] Benjamin Greschbach, Gunnar Kreitz, Sonja Buchegger, The devil is privacy for social network, CoNEXT, 2009. in the metadata – new privacy challenges in decentralised online [54] C. Wilson, T. Steinbauer, G. Wang, A. Sala, H. Zheng, B.Y. Zhao. social networks, in: SESOC (PERCOM Workshops), 2012. Privacy, availability and economics in the polaris mobile social [27] Saikat Guha, Kevin Tang, Paul Francis, NOYB: privacy in online social network, in: HotMobile, 2011. networks, in: First Workshop on Online Social Networks, 2008. [28] Felix Günther, Mark Manulis, Thorsten Strufe, Cryptographic treatment of private user profiles, in: Financial Cryptography and Data Security, Springer, 2012, pp. 40–54. Thomas Paul is a Ph.D. Student and Research [29] Sonia Jahid, P Mittal, Nikita Borisov, EASiER: encryption-based Engineer at TU-Darmstadt. He received his access control in social networks with efficient revocation, in: Dipl. Wirt.-Inf. degree from TU Ilmenau. After ASIACCS, 2011. spending three years as a business (pricing) [30] Sonia Jahid, Shirin Nilizadeh, Prateek Mittal, Nikita Borisov, Apu consultant, he returned to science. His thesis Kapadia, Decent: a decentralized architecture for enforcing privacy will focus on security in Online Social Net- in online social networks, SESOC (PERCOM Workshops), 2012, pp. works. 326–332. [31] David Koll, Jun Li, Xiaoming Fu, With a little help from my friends: replica placement in decentralized online social networks, 2013. [32] M. Kryczka, R. Cuevas, C. Guerrero, A first step towards user assisted online social networks, SNS, 2010. [33] D. Liu, A. Shakimov, R. Càceres, A. Varshavsky, L.P. Cox, Confidant: protecting osn data without locking it up, in: Middleware, 2011. [34] Arvind Narayanan, Vincent Toubiana, Solon Barocas, Helen Nissenbaum, Dan Boneh, A critical look at decentralized personal data architectures. arXiv preprint arXiv:1202.4503, 2012. Antonino Famulari is a Ph.D Student at [35] Rammohan Narendula, T.G. Papaioannou, Karl Aberer, A Telecom ParisTech, affiliated with the doctoral decentralized online social network with efficient user-driven school in Innovation and Entrepreneurship of replication, in: Enabling Technologies: Infrastructures for the EIT. Previously, he obtained his MsC in Collaborative Enterprises, 2010. telecommunication engineering (Pisa) and [36] Shirin Nilizadeh, Sonia Jahid, Prateek Mittal, Nikita Borisov, Apu gained experience in consulting and research Kapadia, Cachet: a decentralized architecture for privacy preserving at the Italian National Institute of Nuclear social networking with caching, in: CoNEXT, 2012. Physics. His thesis will focus on protection of [37] Thomas Paul, Sonja Buchegger, Thorsten Strufe, Decentralizing social online privacy, in particular in Online Social networking services, in: International Tyrrhenian Workshop on Networks and content sharing platforms. Digital Communications, 2010. [38] Thomas Paul, Benjamin Greschbach, Sonja Buchegger, Thorsten Strufe, Exploring decentralization dimensions of social network services: adversaries and availability, in: HotSoc (KDD Workshop), 2012. [39] T. Perrin, Public key distribution through ’’cryptoids’’, in: Workshop on New Security Paradigms, 2003, pp. 82–102. Thorsten Strufe is professor Privacy and IT [40] Fatemeh Raji, Ali Miri, Mohammad Davarpanah Jazi, Behzad Malek, Security at Technische Universität Dresden. Online social network with flexible and dynamic privacy policies, in: His research interests lie in the areas of pri- CSSE, IEEE, 2011, pp. 135–142. vacy and resilience, especially in the context [41] Antony Rowstron, Peter Druschel, Pastry: scalable, decentralized of social networking services and large scale object location, and routing for large-scale peer-to-peer systems, distributed systems. Recently, he has focused Middleware, 2001. on studying user behavior and security in [42] Amit Sahai, Brent Waters, Fuzzy identity-based encryption, in: Online Social Networks and possibilities to Advances in Cryptology EUROCRYPT 2005, Springer, 2005. [43] Stephan Schulz, Thorsten Strufe, d2 deleting diaspora: practical provide privacy-preserving and secure social attacks for profile discovery and deletion, in: ICC, 2013, pp. 2042– networking services and big data solutions. 2046. He was appointed professor for Peer-to-Peer [44] Lorenz Schwittmann, Christopher Boelmann, Matthaus Wander, networks at Technische Universität Darms- Torben Weis, Sonet-privacy and replication in federated online tadt, Germany, from 2009 to 2014, and visiting professor for Dependable social networks, in: ICDCSW, Springer, 2013, pp. 51–57. Distributed Systems at University of Mannheim, Germany, throughout [45] S. Seong, J. Seo, M. Nasielsky, D. Sengupta, S. Hangal, S.K. Teh, R. Chu, 2011. Previously, he took posts as senior researcher at EURECOM and at B. Dodson, M.S. Lam, Prpl: a decentralized social networking TU Ilmenau, working on analysis and the security of Online Social Net- infrastructure, in: Workshop of on Mobile Computing and works, as well as resilient networking. He received his PhD degree from Services: Social Networks and Beyond, 2010. TU Ilmenau in 2007. His PhD thesis deals with the construction of cen- [46] Nashid Shahriar, Shihabur Rahman Chowdhury, Mahfuza Sharmin, sorship resistant and network efficient overlay topologies for live multi- Reaz Ahmed, Raouf Boutaba, Bertrand Mathieu, Ensuring beta- media streaming, and means to making them especially resilient towards availability in p2p social networks, in: ICDCSW, IEEE, 2013, pp. 150– both the failure of nodes and DoS attacks. 155.