About online social network security

According to Wikipedia's descriptions about Security service, the conventional security services include Authentication, Access control, Data confidentiality, Data integrity and Non-repudiation.

On the other hand, in the context of OSNs there are three main security objectives: Privacy(which encompasses user profile privacy, communication privacy, message confidentiality and information disclosure), Integrity and Availability.

So as we can see, the privacy of OSNs seems to be more strict due to the more requirements. To ensure communication privacy, authentication must be done first. Information disclosure needs the access control finegrained to the level of each manageable user. Most significantly, all information of users including their participation in the OSN should be hidden in the system in order to ensure a real privacy, which is not mentioned in the conventional security services. Remember the database disclosure of an IT community called CSDN? A large amount of user profiles were available throughout the world soon because CSDN stored them in plaintext in database. This kind of privacy problem is a nightmare in famous OSN.


In terms of integrity, only ensuring data integrity is not enough in OSN. Some problems like bogus accounts or cloned accounts may occur. To solve the problem, OSN has to find ways to ensure the real identity of each registered member. For example, in Renren.com if one claims to be a student of CUHK, then he/she have to prove it by either logging in the website with CUHK's IP address or scaning the student id card for administator's verification.


When it comes to availability, besides availability of data access, message exchange among members has to be available as well. In OSN, as a basic feature, availability has to include robustness against censorship. In this way OSNs are able to ensure user's profile and data published is always available. Using the case of Renren.com again, if any user wants to stop the account, all of his/her data like journals or photos will remain on the server, waiting for possible reuse in the future.