Private Friends on a Social Networking Site Operated by an Overly Curious SNP

Abstract

These days, social networking sites are more popular than ever, with some sites having dozens or even hundreds of millions of users. At the same time, users on these sites are sharing an unprecedented amount of personal information, generating serious privacy concerns. Personal and sensitive content shared by users on social network sites is barely protected from access by unauthorized users and the Social Networking Provider (SNP) itself always has access to all content. To solve this problem, some existing solutions solicit an external third-party server to provide online privacy protection of content shared by users on social networking sites; other solutions incur a key distribution overhead among the users who are sharing content. These solutions usually have a noticeable impact on the user experience, or are susceptible to single-point-of-failure problems by requiring an external server.

In this paper, we propose a new solution which can achieve the following two desirable features through a novel application of a constant-size-ciphertext broadcast encryption scheme: (1) content posted by a user can only be read by authorized users and nobody else, not even the SNP itself; (2) no key distribution or any external server is necessary during normal operations. Apart from a key extraction server which is contacted only once by each user during an initial registration, the system is self-contained within the web browser (using a plugin) of each user. The system can be used directly with existing social networking sites. We also implemented a prototype for Facebook and perform a thorough evaluation which shows that the scheme is feasible, scalable and practical.