Post 4
Security service is a service, provided by a layer of communicating open systems, which ensures adequate security of the systems or of data transfers as defined by ITU-T X.800 Recommendation. Security service (telecommunication) is the security architecture for the interconnection of open systems. (Wikipedia’s descriptions about Security service (telecommunication) URL: http://en.wikipedia.org/wiki/Security_service_%28telecommunication%29)
The following are considered to be the conventional security objectives / security services.
Authentication services provide for the authentication of a communicating peer entity and the source of data.
Access control service provides protection against unauthorized use of resources accessible via OSI. These may be OSI or non-OSI resources accessed via OSI protocols. This protection service may be applied to various types of access to a resource (e.g., the use of a communications resource; the reading, the writing, or the deletion of an information resource; the execution of a processing resource) or to all accesses to a resource.
Data confidentiality services provide for the protection of data from unauthorized disclosure such as connection confidentiality, selective field confidentiality and traffic flow confidentiality.
Data integrity services counter active threats and may take one of these forms such as connection integrity with recovery, connection integrity without recovery, selective field connection integrity, connectionless integrity and selective field connectionless integrity
Non-repudiation service may take one or both of two forms. The two forms are non-repudiation with proof of origin and non-repudiation with proof of delivery.
(Above refer to OSI Security Services General description of Wikipedia’s descriptions about Security service (telecommunication) URL: http://en.wikipedia.org/wiki/Security_service_%28telecommunication%29)
Three main security objectives are identified in the context of OSNs, they are privacy, integrity and availability.
Privacy in OSNs encompasses user profile privacy, communication privacy, message confidentiality and Information disclosure. In principle, privacy calls for the possibility to hide any information about any user, even to the extent of hiding their participation in the OSN in the first place. Moreover privacy has to be met by default; all information on all users and their actions has to be hidden from any other party internal or external to the system, unless explicitly disclosed by the users themselves. Requiring explicit disclosure leads to the need for access control.
As part of integrity, the user’s identity and data must be protected against unauthorized modification and tampering.
Availability of user profiles is consequently required as a basic feature, even though considering recreational use. In OSNs, this availability specifically has to include robustness against censorship, and the seizure or hijacking of names and other key words. Apart from availability of data access, availability has to be ensured along with message exchange among members.
(Above according to slide 6-10 of week10)
The differences I think between the social network security objectives and that of conventional online networks are below.
1. Authentication
The authentication of conventional online networks just need username and passwords, sometimes even without E-mail address, but when we register on social network web, we are often asked to provide E-mail, real name, ID NO., education information and employment information and send Verification code via our own mobile phone.
2. Resources Exchange
In conventional online networks, it protects against unauthorized use of resources accessible via OSI. But In OSNs, this availability specifically has to include robustness against censorship, and the seizure or hijacking of names and other key words. Apart from availability of data access, availability has to be ensured along with message exchange among members.
3. User’s identity and data
Because the authentication of social network includes some user’s profile, so as part of integrity, the user’s identity and data must be protected against unauthorized modification and tampering. It for conventional online networks is not a must.
4. Data confidentiality
Data confidentiality services of conventional online networks provide for the protection of data from unauthorized disclosure. But for social networks, the range is much wider, it encompasses user profile privacy, communication privacy, message confidentiality and Information disclosure.
From all of above, it shows the social network needs the higher security level, because it contains more privacy information.








