Article Summaries

Citation

(2008), "Article Summaries", Library Hi Tech News, Vol. 25 No. 10. https://doi.org/10.1108/lhtn.2008.23925jae.001

Article Summaries

Article Type: Professional Literature From: Library Hi Tech News, Volume 25, Issue 10.

Access control and privacy in web-based social networks

Barbara Carminati and Elena Ferrari, in International Journal of Web Information Systems, v. 4 (2008) issue 4, pp. 395-415

Web-based social networks (WBSN) such as MySpace and Bebo, providing people with the ability to publish resources (e.g. blogs, photos, video and audio files) and record relationships between each other, are among the key expressions of the Web 2.0 phenomenon, aimed at enhancing creativity, information sharing and collaboration among users. Adopted by groups of friends, organisational colleagues, society members, etc. for a wide range of purposes including business, learning, entertainment and dating. However, this ability to record and share personal information means that WBSN users find themselves exposed to a variety of potential threats to their privacy. Some of these threats originate from WBSN providers themselves. For example, over 700,000 users complained in 2006 after Facebook began exploiting stored user information for a personalised New Feed feature, alerting users whenever an item of news appeared about one of their online friends. Later, in 2007, similar complaints arose over the garnering data on users' activities on Facebook partner websites, which were then communicated without consent to users' friends. The urgent need for security and privacy-enhancing services tailored to WBSNs is evident, with a particular focus on access control.

WBSNs use database management systems to facilitate the storage of information on user-specified relationships, which is then at least partially accessible to members. And different WBSNs permit different types of relationship to be recorded. Some support just the basic “friend” relationship, extendable to “friend of a friend”, while others allow a range of refinements like “colleague”, “classmate”, “business partner”, etc. occasionally grouped into categories like “family”, “online buddy” or “professional contact”. Others still allow users to state the level of trust accorded to each relationship, as shown in Figure 1.

Figure 1

Traditional operating or database management systems adopt access control mechanisms to regulate the usage and dissemination of resources (or objects), ensuring that they are disclosed only to users (or subjects) with system-defined authorisation for particular purposes (or access modes), for example: read only, write, execute. These mechanisms are in turn governed by access control policies which can be either discretionary (i.e. access granted based on identity of subject), mandatory (i.e. authorisation to access based on security classification match between subject and object), role-based (i.e. access levels relate to subject's role within an organisation rather than identity), or based on subject's characteristics (e.g. age, nationality, gender).

However, for WBSNs, the approaches outlined above remain inadequate, meaning new, more suitable mechanisms and policy languages need to be devised. This is because WBSN members generally wish to share resources with others who have indirect, as well as direct, relationships with them. For instance (using the simple WBSN figure above), Alice wishes to share her resources only with her friends Bruce and Carl, with their friends or colleagues, David, Eric and Frank, and friends of their friends, such as Greg. A discretionary access policy will only work for her if she knows in advance exactly who all the friends of her friends' friends are. She would also, of course, need a policy management system complex enough to cope dynamically with changes over time.

From the above, it is clear that a WBSNs need to allow access by specifying authorised members on the basis, not of who they are, but of the web relationships they must have. It is likely that the type of web relationship (e.g. friendOf, colleagueOf) is also a factor. Another parameter relevant to access control, in addition to relationship depth, is that of trust (marked in figure on scale of 0-1), meaning the extent to which the resource-owner is confident that the other member will not disclose sensitive information to a third party. Indeed, one can imagine occasions when trust level may be more important than proximty or distance, or a combination of the two.

Furthermore, the robustness of a WBSN's access control relies on the trustworthiness of the mechanisms and the entity hosting it. A naïve solution is for all members to delegate oversight to the [WB]SN manager system (SNMS). In a decentralised WBSN environment, however, such centralisation could lead to bottlenecks. It also depends, as noted above in relation to Facebook, on a consensus between the SNMS and WBSN members on what constitutes appropriate use of stored personal data.

An analysis of 11 WBSNs showed that most implement only basic protection, whereby members can specify if resources are: (a) public; (b) private or (c) only accessible to direct neighbours. One allows access by relationship type (i.e. classmate, colleague). Some support a “friend of friend” option, and fewer still allow contacts to 4th, or even to nth, degree. Only three implement some level of access control based on trust. While these have the advantage of being relatively straightforward, their drawback is that they may still limit access either too little or too much.

One proposal to overcome these weaknesses is a policy drawn up from access rules consisting of a set of access conditions, which authorise members in terms of a combination of parameters: relationship type, depth and trust. For example, using the above WBSN figure, supposing Alice wants to share a particular resource with her friends and their friends only (i.e. maximum depth of 2), and with a trust level greater than or equal to 0.8 then, to enforce these requirements, the access conditions could be expressed as “(A, friendOf, 2, 0.8)”. So, while Carl can access the resource, Frank, who meets the “friend of a friend” condition, cannot because his trust level is too low (i.e. 0.8 × 0.8 = 0.64). Alice protects another resource with the condition “(A, friendOf, 6, 0.6)”; and this time Frank can access it by demonstrating that he has both an unbroken “friendOf” web relationship with Alice and the required trust level. For his request to access to be successful, Frank must present proof. This is achieved by each relationship being encoded with a certificate generated by both parties to it. These certificates are public, stored by a central node (CN) on the WBSN, and linked on each request to form a certificate path. Members can check whether the certificate path returned by one CN is correct by checking against other certificate servers.

In such circumstances, WBSNs can be a rich source for data-mining in marketing, psychology or sociology. To minimise concerns over individual privacy, researchers have developed anonymised graphs, replacing names with numbers. However, such basic anonymisation is open to attack from anyone (including David himself) who knows, for example, that David (in the figure above) have five web relationships. To ensure greater security, on being created, each certificate is encrypted, thus preventing Greg from discovering that, in addition to his known direct relationships with David, Eric and Frank, he also has an indirect “friendOf” relationship with Alice, which he can exploit to access her resources. One can further imagine instances when David might not want his work colleagues, Bruce and Eric, to discover by a roundabout route that he is a member of particular group (e.g. when job hunting).

To conclude, web relationships are clearly far more complex than the most common WBSNs allow for. The gauging of trust seems, in principle to offer a more advanced solution to the present weakenesses in access control and privacy, and to prevent attacks. However, much research remains to be done in devising models which accurately reflect the semantics of trust.

Information technology and systems in China's circular economy: implications for sustainability

Joseph Sarkis and Hanmin Zhu, in Journal of Systems and Information Technology, v. 10 (2008) issue 3 pp. 202-17

The ICT industry in China, which comprises product manufacture, software R&D, internet and other telecommunication services, is currently ranked highest nationally in terms of its output and contribution to the country's economic growth. In the ten years since 1996, the sector grew from representing just over 2 per cent of GDP to 7.5 per cent, equivalent to US$208 billion. Surpassing Japan, globally it is now second in size only to the USA.

However, this growth has not been free of environmental deteriation. The Chinese government intends to confront this challenge with regulatory plans and policies under a banner called the “circular economy” (CE); and this framework (see Figure 2) targets not just the ICT sector but Chinese industry as a whole.

Figure 2

Although 2006 figures show that personal computer ownership per capita in China remains very low, 4.1 per cent compared to 75 per cent of households in Germany and Japan, in the scale of the industries manufacturing mobile phones, laptops, digital cameras and other ICT goods for export which are the prime source of the country's e-waste. In 2004 China finally overtook the USA in the value of such exports, US$180 billion compared to US$149 billion, respectively. However, taking these two countries' share in the world trade in ICT, both imports and exports combined, in ten years China's has expanded almost tenfold, from US$35 to US$329 billion between 1996 and 2006, compared to a rise from US$230 to US$375 billion in the USA over the same period.

Alongside this unparallelled increase in global economic terms has been the increase in solid waste. China now surpasses the USA as the largest producer of waste, and projections during the next 25 years show that growing from 190 million to over 480 million tons p.a. by 2030. While the e-waste element of this could prove a valuable source of valuable raw materials (e.g. computer chips, plastics and precious metals), if treated properly, and recycled or re-used, China's traditionally low occupational and environmental standards mean that toxic and carcinogenic substances from the ICT industry (e.g. lead, mercury, cadmium, PCBs) continue to cause pollution. Instead of the typically low-cost but ultimately non-sustainable manual labour approaches that still predominate, there is an urgent need to implement the more formal systems comparable to the EU's waste electronic and electrical equipment (WEEE) directative, as recommended within China's CE framework.

The importance of CE in shaping a strategy to reduce both demand for natural resources and ecological damage is championed at state ministerial level. China's government recognises that it cannot afford to imitate the resource-hungry model which fueled the industrial development of the West. For CE to achieve its objectives, three main aspects of a sustainable eco-economic system have been identified:

• •

  (1)  optimal economic growth;

• •

  (2)  good environment; and

• •

  (3)  harmony between humans and nature.

And technical innovation is seen as key, with significant ICT implications for management.

As an example of technical innovation, in the Yunnan Province a decision-support system integrates five large-scale databases focusing on population, geography, ecology, agriculture, tourism, transport, water and natural disaster prevention in order to assist resource management regionally. This includes managing the property rights implicit in emission trading schemes. The market-based “Management Methods for Controlling Pollution by Electronic Information Products” regulation also came into force in 2007, comparable to the EU's WEEE directive, using deposit-refund schemes to encourage countries exporting to, as well as industries within, China to take back ICT equipment for recycling or disposal. CE likewise provides financial incentives through taxation to motivate the manufacturers of ICT equipment to minimise their reliance on hazardous chemicals, at the same time developing ICT systems to audit and track their use.

Elsewhere, for example in the Yangtze and Pearl River deltas, ecological modernisation theory has been applied to stimulate the emergence of high-tech and national electronic information eco-industrial parks, harnessing “symbiotic synergies” in order to maximise the sharing of resources and use of by-products between organisations. Information systems are also now being used to support China's drive to more total quality environmental management certified by such standards as ISO:14000. Indeed, statistics from 2005 showed that China, with 12,683 certified locations, stood second only to Japan.

Evidence of the emergence of such systems and practices across China can be found in initiatives like “Webfill”, a web-based tool encouraging the building industry to exchange residual materials and construction waste for recycling or reuse between sites. Whereas there remains a chronic lack of reliable data on the quantity and cost of waste treatment to facilitate proper planning, some Chinese industries are now integrating GIS and radio frequency identification technology in products to track and manage their lifecycles and disposal. In addition, the new Decree on Environmental Information Disclosure, in force since May 2008, obliges enterprises and government agencies alike to submit data on hazardous substances, environmental plans, epidemiology reports, etc. for dissemination to the public through e-government channels.

Although it is clear that ultimate goal of CE has yet to be reached, nevertheless China's position, both as a rapidly developing economy and due to the significance of ICT in its economy at all levels, local, regional and national, means that has as much to offer the world in terms of experience of CE as it has yet to implement and to learn. So, while keeping an eye on the lessons taught by others, for example, the Hacklefors model successfully applied to small and medium-size enterprises in Sweden, China is also looking to share the knowledge acquired from its “grand experiment”. India, with the increasing maturity of its IT infrastructure, is one country with obvious parallels for the testing of the CE framework. But so too might be the Europe Union, with its broad spread of cultures, practices and stages of development.

Information systems and ecological sustainability

Adela J.W. Chen, Marie-Claude Boudreau and Richard T. Watson, in Journal of Systems and Information Technology, v. 10 (2008) issue 3, pp. 186-201

Value-centred interaction design methods

John Knight, in Journal of Information, Communication & Ethics in Society, v. 6 (2008) issue 4, pp. 334-48