Relationship-Based Access Control for Online Social Networks: Beyond User-to-User Relationships

TLDR

User‑to‑user relationship‑based access control dominates OSN authorization, yet many user activities cannot be governed solely by such relationships. This work introduces a relationship‑based access control model that extends beyond U2U links to include user‑to‑resource and resource‑to‑resource relationships and also governs users’ administrative actions. The model defines authorization policies through patterns of relationship paths with hop‑count limits, offers a policy language that allows hop‑count skipping of resource‑related links for greater expressiveness, and provides simple conflict‑resolution rules.

Abstract

User-to-user (U2U) relationship-based access control has become the most prevalent approach for modeling access control in online social networks (OSNs), where authorization is typically made by tracking the existence of a U2U relationship of particular type and/or depth between the accessing user and the resource owner. However, today's OSN applications allow various user activities that cannot be controlled by using U2U relationships alone. In this paper, we develop a relationship-based access control model for OSNs that incorporates not only U2U relationships but also user-to-resource (U2R) and resource-to-resource (R2R) relationships. Furthermore, while most access control proposals for OSNs only focus on controlling users' normal usage activities, our model also captures controls on users' administrative activities. Authorization policies are defined in terms of patterns of relationship paths on social graph and the hop count limits of these path. The proposed policy specification language features hop count skipping of resource-related relationships, allowing more flexibility and expressive power. We also provide simple specifications of conflict resolution policies to resolve possible conflicts among authorization policies.