ProProtect3: An Approach for Protecting User Profile Data from Disclosure, Tampering, and Improper Use in the Context of WebID
Dr.-Ing. Stefan Wild
Dipl.-Inf. Fabian Wiedemann
Dr.-Ing. Sebastian Heil
Dr.-Ing. Alexey Tschudnowsky
Prof. Dr.-Ing. Martin Gaedke
Transactions on Large-Scale Data- and Knowledge-Centered Systems XIX
WebID is a new identification approach of the W3C. It enables managing profile data associated to persons and services at self-defined places in the cloud. By relying on RDF vocabularies like FOAF for describing user profile data, WebID contributes to the Semantic Web vision. While access to user profiles can be controlled with existing security mechanisms, they are not designed to protect sensitive data within user profiles from unwanted retrieval, malicious manipulation, and improper use. This article analyzes the risks that affect the knowledge stored in WebID-based user profiles. It therefore describes potential attack scenarios and outlines the challenges a solution must deal with. To tackle the problem of insufficient protection, we propose ProProtect3. This approach enables identity owners (1) to create customized filters for sensitive data, (2) to verify the profile data integrity, and (3) to restrict the rights of delegatees. For evaluating the ProProtect3 approach, we integrate it into a WebID identity provider.
Wild, Stefan; Wiedemann, Fabian; Heil, Sebastian; Tschudnowsky, Alexey; Gaedke, Martin: ProProtect3: An Approach for Protecting User Profile Data from Disclosure, Tampering, and Improper Use in the Context of WebID. Transactions on Large-Scale Data- and Knowledge-Centered Systems XIX, pp. 87-127, 2015.