Open Gardens

I am speaking at Blogtalk 2008 at the invitation of Dr John Breslin whose team does some pioneering work on the semantic web. This talk is the first of my ‘research/PhD’ talks – so dont heckle me if I make mistakes – however I am truly passionate about this topic and its taken me some time to come to the exact area I want to focus(My PhD is at ucl under the supervision of Dr Miguel Rio )

Overall I am interested in privacy and reputation systems. The specific area of work I am looking into is as follow(and is also the topic of my talk at Cork/Blogtalk conference). I am using Google opensocial APIs for this talk(and also a paper based on the same talk which will be submitted at this conference)

The topic is as follow

Privacy and revocation: two sides of the same coin – A new privacy model for the social web using a dual social networking and a network layer model

Conventional privacy models lean towards a closed, digital fortress. These can take many forms – linkedin introductions, signed applications, third party trust endorsers etc etc. However, these methods don’t fit the current open web ecosystem and more importantly a future web based ecosystem where there is a tendency to give up privacy especially by the younger generation.

Social networks are increasingly going to be the primary form of interface to the Web for many of us. For many teens, that’s already the case with facebook. Unlike the Open Web, the social network has some form of structure (profiles, messages etc etc). This structure can be used to create a model of ‘Innocent until proven guilty’ as opposed to the existing digital fortress ecosystem based on (‘guilty until proven innocent’)

In this session, we examine the proposition that – privacy and revocation go side by side i.e. ‘I will be open to contact but in return – I choose to exercise the right to terminate that contact instantly if I need to’ (maximum privilege and instant revocation). In other words, strengthen the revocation – not the moat bridge .. Let people cross freely at the moat but always have the revocation engine as a defence mechanism

We will take a social network (social graph) and also a network levelperspective(certificate revocation, Identity etc)

Admittedly, any revocation engine may not work in context of the whole web but it may well work within the context of a social networkcoupled with network layer functions like Identity, certificate management function. Already, the spam features of Gmail work in a similar way(except Google does the revocation implicitly on our behalf).

The same mechanism can work within the context of any social network – mobile, P2P etc. In fact, revocation models already exist in networks like Qualcomm – however note that I am speaking of revocation by the individual and not by the provider)

This talk examines the impact of revocation and revocation engines as a privacy and security mechanism within the social network. We use examples from Google Open Social APIs to implement the model of maximum privilege and instant revocation.

Notes:

a) At a network level, revocation is concerned with certificate management and it’s implications

b) I will lay out some ideas – but I cannot cover all the aspects. So, any comments/feedback welcome since these ideas are being developed.

c) Google Open social APIs will be used to illustrate

d) Note that the locus of control rests with the user. I am advocating a model where the user has control(not an external provider like an Operator)

e) What can be revoked? – Both the application and the individual. To revoke applications – we need a lot more information about networks, application ids, application components, application wrappers etc

f) To revoke individuals – we need information about Identity, weak identity, certificates, their social network, degree of trust

g) Ultimately we need a page rank like algorithm(a trust matrix) along with a mechanism to revoke both applications and people. This spans many domains

h) I also intend to ultimately focus on P2P(peer live)

i) Other components like a learning system, PKI, Global incident handling (threat broadcast) are also a part of this concept

If you are interested in this topic, see books like this one

Trust, Complexity and Control: Confidence in a Convergent World (Hardcover) by Piotr Cofta (highly recommended) and / or email me at

ajit.jaokar at futuretext.com and meet me at Blogtalk

Tweet This Post