Cachet: a decentralized architecture for privacy preserving social networking with caching

Online social networks (OSNs) such as Facebook and Google+ have transformed the way our society communicates. However, this success has come at the cost of user privacy; in today's OSNs, users are not in control of their own data, and depend on OSN operators to enforce access control policies. A multitude of privacy breaches has spurred research into privacy-preserving alternatives for social networking, exploring a number of techniques for storing, disseminating, and controlling access to data in a decentralized fashion. In this paper, we argue that a combination of techniques is necessary to efficiently support the complex functionality requirements of OSNs. We propose Cachet, an architecture that provides strong security and privacy guarantees while preserving the main functionality of online social networks. In particular, Cachet protects the confidentiality, integrity and availability of user content, as well as the privacy of user relationships. Cachet uses a distributed pool of nodes to store user data and ensure availability. Storage nodes in Cachet are untrusted; we leverage cryptographic techniques such as attribute based encryption to protect the confidentiality of data. For efficient dissemination and retrieval of data, Cachet uses a hybrid structured-unstructured overlay paradigm in which a conventional distributed hash table is augmented with social links between users. Social contacts in our system act as caches to store recent updates in the social network, and help reduce the cryptographic as well as the communication overhead in the network. We built a prototype implementation of Cachet in the FreePastry simulator. To demonstrate the functionality of existing OSNs we implemented the "newsfeed" application. Our evaluation demonstrates that (a) decentralized architectures for privacy preserving social networking are feasible, and (b) use of social contacts for object caching results in significant performance improvements.

[1]  Ariel J. Feldman,et al.  Social Networking with Frientegrity: Privacy and Integrity with an Untrusted Provider , 2012, USENIX Security Symposium.

[2]  Ping Zhang,et al.  On Cooperative Caching in Wireless P2P Networks , 2008, 2008 The 28th International Conference on Distributed Computing Systems.

[3]  Brent Waters,et al.  Ciphertext-Policy Attribute-Based Encryption , 2007, 2007 IEEE Symposium on Security and Privacy (SP '07).

[4]  Markulf Kohlweiss,et al.  Scramble! Your Social Network Data , 2011, PETS.

[5]  Prateek Mittal,et al.  X-Vine: Secure and Pseudonymous Routing Using Social Networks , 2011, ArXiv.

[6]  Krishna P. Gummadi,et al.  On the evolution of user interaction in Facebook , 2009, WOSN '09.

[7]  Giancarlo Ruffo,et al.  LotusNet: Tunable privacy for distributed online social network services , 2012, Comput. Commun..

[8]  Anne-Marie Kermarrec,et al.  Gossiping in distributed systems , 2007, OPSR.

[9]  Eytan Modiano,et al.  Maximizing throughput in wireless networks via gossiping , 2006, SIGMETRICS '06/Performance '06.

[10]  Prateek Mittal,et al.  DECENT: A decentralized architecture for enforcing privacy in online social networks , 2011, 2012 IEEE International Conference on Pervasive Computing and Communications Workshops.

[11]  Vivien Quéma,et al.  FireSpam: Spam Resilient Gossiping in the BAR Model , 2010, 2010 29th IEEE Symposium on Reliable Distributed Systems.

[12]  Nathaniel Husted,et al.  Pythia: a privacy aware, peer-to-peer network for social search , 2011, WPES '11.

[13]  Honggang Zhang,et al.  Design and analysis of a choking strategy for coalitions in data swarming systems , 2012, 2012 Proceedings IEEE INFOCOM.

[14]  Matthew K. Wright,et al.  Salsa: a structured approach to large-scale anonymity , 2006, CCS '06.

[15]  Apu Kapadia,et al.  Halo: High-Assurance Locate for Distributed Hash Tables , 2008, NDSS.

[16]  Emiliano De Cristofaro,et al.  Private discovery of common social contacts , 2011, International Journal of Information Security.

[17]  Michael Backes,et al.  A Security API for Distributed Social Networks , 2011, NDSS.

[18]  Miguel Castro,et al.  Secure routing for structured peer-to-peer overlay networks , 2002, OSDI '02.

[19]  M. van Steen,et al.  A Gossip-based Distributed News Service for Wireless Mesh Networks , 2006 .

[20]  Alexandru Iosup,et al.  TRIBLER: a social-based peer-to-peer system: Research Articles , 2008 .

[21]  Antony I. T. Rowstron,et al.  Pastry: Scalable, Decentralized Object Location, and Routing for Large-Scale Peer-to-Peer Systems , 2001, Middleware.

[22]  Alberto Montresor,et al.  Efficient dissemination in decentralized social networks , 2011, 2011 IEEE International Conference on Peer-to-Peer Computing.

[23]  John R. Douceur,et al.  The Sybil Attack , 2002, IPTPS.

[24]  Refik Molva,et al.  Safebook: Feasibility of transitive cooperation for privacy on a decentralized social network , 2009, 2009 IEEE International Symposium on a World of Wireless, Mobile and Multimedia Networks & Workshops.

[25]  Prateek Mittal,et al.  EASiER: encryption-based access control in social networks with efficient revocation , 2011, ASIACCS '11.

[26]  M. van Steen,et al.  Canning spam in wireless gossip networks , 2007, 2007 Fourth Annual Conference on Wireless on Demand Network Systems and Services.

[27]  Peter Druschel,et al.  Pastry: Scalable, distributed object location and routing for large-scale peer-to- , 2001 .

[28]  David Mazières,et al.  Kademlia: A Peer-to-Peer Information System Based on the XOR Metric , 2002, IPTPS.

[29]  Nikita Borisov,et al.  FlyByNight: mitigating the privacy risks of social networking , 2008, WPES '08.

[30]  Kai Hwang,et al.  Gossip-based Reputation Aggregation for Unstructured Peer-to-Peer Networks , 2007, 2007 IEEE International Parallel and Distributed Processing Symposium.

[31]  Antonio F. Gómez-Skarmeta,et al.  Cyclone: a novel design schema for hierarchical DHTs , 2005, Fifth IEEE International Conference on Peer-to-Peer Computing (P2P'05).

[32]  Mehdi Mani,et al.  SCOPE: A prototype for spontaneous P2P social networking , 2010, 2010 8th IEEE International Conference on Pervasive Computing and Communications Workshops (PERCOM Workshops).

[33]  Bobby Bhattacharjee,et al.  Persona: an online social network with user-defined privacy , 2009, SIGCOMM '09.

[34]  Helmut Hlavacs,et al.  A socially aware caching mechanism for encounter networks , 2012, Telecommun. Syst..

[35]  Rossano Schifanella,et al.  Tempering Kademlia with a Robust Identity Based System , 2008, 2008 Eighth International Conference on Peer-to-Peer Computing.

[36]  Rajesh Sharma,et al.  GoDisco: Selective Gossip Based Dissemination of Information in Social Community Based Overlays , 2011, ICDCN.

[37]  Christian Grothoff,et al.  Autonomous NAT Traversal , 2010, 2010 IEEE Tenth International Conference on Peer-to-Peer Computing (P2P).

[38]  Johan A. Pouwelse,et al.  A Gossip-Based Distributed Social Networking System , 2009, 2009 18th IEEE International Workshops on Enabling Technologies: Infrastructures for Collaborative Enterprises.

[39]  Johannes Gehrke,et al.  Gossip-based computation of aggregate information , 2003, 44th Annual IEEE Symposium on Foundations of Computer Science, 2003. Proceedings..

[40]  Yi Lu,et al.  Partitioning social networks for time-dependent queries , 2011, SNS '11.

[41]  Krishna P. Gummadi,et al.  An analysis of social network-based Sybil defenses , 2010, SIGCOMM 2010.

[42]  Kristen LeFevre,et al.  Privacy wizards for social networking sites , 2010, WWW '10.

[43]  George Danezis.  Inferring privacy policies for social networking services , 2009, AISec '09.

[44]  Saikat Guha,et al.  NOYB: privacy in online social networks , 2008, WOSN '08.

[45]  Christian Callegari,et al.  A Real-Time Algorithm for Skype Traffic Detection and Classification , 2009, NEW2AN.

[46]  Nick Mathewson,et al.  Tor: The Second-Generation Onion Router , 2004, USENIX Security Symposium.

[47]  Peng Wang,et al.  Robust Accounting in Decentralized P2P Storage Systems , 2006, 26th IEEE International Conference on Distributed Computing Systems (ICDCS'06).

[48]  Aleksandar Kuzmanovic,et al.  Denial-of-service resilience in peer-to-peer file sharing systems , 2005, SIGMETRICS '05.

[49]  Anne-Marie Kermarrec,et al.  The Gossple Anonymous Social Network , 2010, Middleware.

[50]  Claudio Soriente,et al.  Hummingbird: Privacy at the Time of Twitter , 2012, 2012 IEEE Symposium on Security and Privacy.

[51]  Li Xiao,et al.  Distributed caching and adaptive search in multilayer P2P networks , 2004, 24th International Conference on Distributed Computing Systems, 2004. Proceedings..

[52]  Zhiyong Xu,et al.  SBARC: A supernode based peer-to-peer file sharing system , 2003, Proceedings of the Eighth IEEE Symposium on Computers and Communications. ISCC 2003.

[53]  Sonja Buchegger,et al.  PeerSoN: P2P social networking: early experiences and insights , 2009, SNS '09.

[54]  Eyal Kushilevitz,et al.  Private information retrieval , 1995, Proceedings of IEEE 36th Annual Foundations of Computer Science.

[55]  M. Frans Kaashoek,et al.  Whanau: A Sybil-proof Distributed Hash Table , 2010, NSDI.

[56]  Krishna P. Gummadi,et al.  Analyzing facebook privacy settings: user expectations vs. reality , 2011, IMC '11.

[57]  Sem C. Borst,et al.  Distributed Caching Algorithms for Content Distribution Networks , 2010, 2010 Proceedings IEEE INFOCOM.