Socialized Policy Administration
Zeqing Guo,Weili Han,Liangxing Liu,Wenyuan Xu,Minyue Ni,Yunlei Zhao,Xiaoyang Sean Wang
DOI: https://doi.org/10.1016/j.cose.2017.03.005
IF: 5.105
2017-01-01
Computers & Security
Abstract:With the rapid development of mobile applications and online social networks, users often encounter a frustrating challenge to set privacy and security policies (i.e., permission requests) of various applications correctly. For instance, in an Android system, it is hard for users, even programmers, to identify malicious permission requests (policies) when they install a third-party application. To simplify the task of policy management, in this paper, we propose a novel policy administration method where the policy settings from users' friends will be used as a key recommendation to guide policy administration, and the security of friends' privacy will be protected. We propose to let a user invite his or her friends to help with policy setting in applications, and we call such a method socialized policy administration (SPA for short). We designed two types of SPA: basic SPA and composite SPA. Both types of SPA are equipped with a privacy preserving mechanism that enables users' friends to help users without leaking the friends' preferences. In our prototype based on Telegram, i.e., one of the most popular instant messaging applications, we utilize partially homomorphic encryption cryptosystems to implement our framework. Based on the performance evaluation, SPA is able to configure almost all types of policies of current popular Android applications with a modest performance overhead.