{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,2,14]],"date-time":"2026-02-14T04:19:18Z","timestamp":1771042758831,"version":"3.50.1"},"reference-count":40,"publisher":"Association for Computing Machinery (ACM)","issue":"1","license":[{"start":{"date-parts":[[2009,10,1]],"date-time":"2009-10-01T00:00:00Z","timestamp":1254355200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"DOI":"10.13039\/501100003407","name":"Ministero dell'Istruzione, dell'Universit\u00e0 e della Ricerca","doi-asserted-by":"publisher","award":["PRIN-2007F9437X_004"],"award-info":[{"award-number":["PRIN-2007F9437X_004"]}],"id":[{"id":"10.13039\/501100003407","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Trans. Inf. Syst. Secur."],"published-print":{"date-parts":[[2009,10]]},"abstract":"<jats:p>In this article, we propose an access control mechanism for Web-based social networks, which adopts a rule-based approach for specifying access policies on the resources owned by network participants, and where authorized users are denoted in terms of the type, depth, and trust level of the relationships existing between nodes in the network. Different from traditional access control systems, our mechanism makes use of a semidecentralized architecture, where access control enforcement is carried out client-side. Access to a resource is granted when the requestor is able to demonstrate being authorized to do that by providing a proof. In the article, besides illustrating the main notions on which our access control model relies, we present all the protocols underlying our system and a performance study of the implemented prototype.<\/jats:p>","DOI":"10.1145\/1609956.1609962","type":"journal-article","created":{"date-parts":[[2009,11,4]],"date-time":"2009-11-04T18:28:31Z","timestamp":1257359311000},"page":"1-38","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":191,"title":["Enforcing access control in Web-based social networks"],"prefix":"10.1145","volume":"13","author":[{"given":"Barbara","family":"Carminati","sequence":"first","affiliation":[{"name":"DICOM, Universit\u00e0 degli Studi dell'Insubria, Varese, Italy"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Elena","family":"Ferrari","sequence":"additional","affiliation":[{"name":"DICOM, Universit\u00e0 degli Studi dell'Insubria, Varese, Italy"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Andrea","family":"Perego","sequence":"additional","affiliation":[{"name":"DICOM, Universit\u00e0 degli Studi dell'Insubria, Varese, Italy"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2009,11,6]]},"reference":[{"key":"e_1_2_2_1_1","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2005.99"},{"key":"e_1_2_2_2_1","doi-asserted-by":"publisher","DOI":"10.1145\/1321211.1321251"},{"key":"e_1_2_2_3_1","doi-asserted-by":"publisher","DOI":"10.1145\/1066677.1067036"},{"key":"e_1_2_2_4_1","doi-asserted-by":"publisher","DOI":"10.1017\/S1471068407003213"},{"key":"e_1_2_2_5_1","unstructured":"Berteau S. 2007. Facebook's misrepresentation of Beacon's threat to privacy: Tracking users who opt out or are not logged in. CA Security Advisor Research Blog. http:\/\/community.ca.com\/blogs\/securityadvisor\/archive\/2007\/11\/29\/facebook-s-isrepresentation-ofbeacon-s-threat-to-privacy-tracking-users-who-opt-out-or-are-not-logged-in.aspx.  Berteau S. 2007. Facebook's misrepresentation of Beacon's threat to privacy: Tracking users who opt out or are not logged in. CA Security Advisor Research Blog. http:\/\/community.ca.com\/blogs\/securityadvisor\/archive\/2007\/11\/29\/facebook-s-isrepresentation-ofbeacon-s-threat-to-privacy-tracking-users-who-opt-out-or-are-not-logged-in.aspx."},{"key":"e_1_2_2_6_1","volume-title":"Proceedings of the European Symposium on Research in Computer Security (ESORICS'94)","author":"Beth T."},{"key":"e_1_2_2_7_1","doi-asserted-by":"crossref","unstructured":"Blaze M. Feigenbaum J. Ioannidis J. and Keromytis A. D. 1999. The KeyNote trust management system version 2. IETF RFC 2704 Internet Engineering Task Force. http:\/\/www.ietf.org\/rfc\/rfc2704.txt.  Blaze M. Feigenbaum J. Ioannidis J. and Keromytis A. D. 1999. The KeyNote trust management system version 2. IETF RFC 2704 Internet Engineering Task Force. http:\/\/www.ietf.org\/rfc\/rfc2704.txt.","DOI":"10.17487\/rfc2704"},{"key":"e_1_2_2_8_1","volume-title":"Proceedings of the 2nd International Conference on Financial Cryptography (FC'98)","author":"Blaze M."},{"key":"e_1_2_2_9_1","unstructured":"Brickley D. and Miller L. 2007. FOAF vocabulary specification 0.91. Namespace Document. http:\/\/xmlns.com\/foaf\/0.1.  Brickley D. and Miller L. 2007. FOAF vocabulary specification 0.91. Namespace Document. http:\/\/xmlns.com\/foaf\/0.1."},{"key":"e_1_2_2_10_1","unstructured":"Canadian Privacy Commission. 2007. Social Networking and Privacy. http:\/\/www.privcom.gc.ca\/information\/social\/index_e.asp.  Canadian Privacy Commission. 2007. Social Networking and Privacy. http:\/\/www.privcom.gc.ca\/information\/social\/index_e.asp."},{"key":"e_1_2_2_11_1","doi-asserted-by":"publisher","DOI":"10.1108\/17440080810919468"},{"key":"e_1_2_2_12_1","doi-asserted-by":"publisher","DOI":"10.1007\/11915072_80"},{"key":"e_1_2_2_13_1","unstructured":"Chen L. 2006. Facebook's feeds cause privacy concerns. The Amherst Student. http:\/\/halogen.note.amherst.edu\/~astudent\/2006--2007\/issue02\/news\/01.html.  Chen L. 2006. Facebook's feeds cause privacy concerns. The Amherst Student. http:\/\/halogen.note.amherst.edu\/~astudent\/2006--2007\/issue02\/news\/01.html."},{"key":"e_1_2_2_14_1","volume-title":"Proceedings of the Identity, Reference, and the Web Workshop (IRW'06)","author":"Choi H.-C.","year":"2006"},{"key":"e_1_2_2_15_1","unstructured":"Cwm. 2006. Cwm--A General Purpose Data Processor for the Semantic Web. http:\/\/www.w3.org\/2000\/10\/swap\/doc\/cwm.html.  Cwm. 2006. Cwm--A General Purpose Data Processor for the Semantic Web. http:\/\/www.w3.org\/2000\/10\/swap\/doc\/cwm.html."},{"key":"e_1_2_2_16_1","volume-title":"RELATIONSHIP: A vocabulary for describing relationships between people. Namespace Document","author":"Davis I.","year":"2005"},{"key":"e_1_2_2_17_1","doi-asserted-by":"publisher","DOI":"10.1109\/HICSS.2005.299"},{"key":"e_1_2_2_18_1","doi-asserted-by":"crossref","unstructured":"Ellison C. M. Frantz B. Lampson B. Rivest R. L. Thomas B. M. and Yl\u00f6nen T. 1999. SPKI certificate theory. IETF RFC 2693 Internet Engineering Task Force. http:\/\/www.ietf.org\/rfc\/rfc2693.txt.  Ellison C. M. Frantz B. Lampson B. Rivest R. L. Thomas B. M. and Yl\u00f6nen T. 1999. SPKI certificate theory. IETF RFC 2693 Internet Engineering Task Force. http:\/\/www.ietf.org\/rfc\/rfc2693.txt.","DOI":"10.17487\/rfc2693"},{"key":"e_1_2_2_19_1","unstructured":"EPIC. 2008a. Facebook Privacy Page. http:\/\/epic.org\/privacy\/facebook\/.  EPIC. 2008a. Facebook Privacy Page. http:\/\/epic.org\/privacy\/facebook\/."},{"key":"e_1_2_2_20_1","unstructured":"EPIC. 2008b. Social Networking Privacy. http:\/\/epic.org\/privacy\/socialnet\/default.html.  EPIC. 2008b. Social Networking Privacy. http:\/\/epic.org\/privacy\/socialnet\/default.html."},{"key":"e_1_2_2_21_1","unstructured":"Federal Trade Commission. 2007. Social Networking Sites: A Parent's Guide. http:\/\/www.ftc.gov\/bcp\/edu\/pubs\/consumer\/tech\/tec13.shtm.  Federal Trade Commission. 2007. Social Networking Sites: A Parent's Guide. http:\/\/www.ftc.gov\/bcp\/edu\/pubs\/consumer\/tech\/tec13.shtm."},{"key":"e_1_2_2_22_1","unstructured":"Ferrari E. and Thuraisingham B. 2000. Secure database systems. In Advanced Database Technology and Design M. Piattini and O. Diaz Eds. Artech House Norwood MA 353--403.  Ferrari E. and Thuraisingham B. 2000. Secure database systems. In Advanced Database Technology and Design M. Piattini and O. Diaz Eds. Artech House Norwood MA 353--403."},{"key":"e_1_2_2_23_1","volume-title":"PGP: Pretty Good Privacy. O'Reilly&amp;Associates","author":"Garfinkel S.","year":"1996"},{"key":"e_1_2_2_24_1","unstructured":"Golbeck J. A. 2005. Computing and applying trust in Web-based social networks. Ph.D. thesis Graduate School of the University of Maryland College Park.   Golbeck J. A. 2005. Computing and applying trust in Web-based social networks. Ph.D. thesis Graduate School of the University of Maryland College Park."},{"key":"e_1_2_2_25_1","doi-asserted-by":"publisher","DOI":"10.1145\/1183463.1183470"},{"key":"e_1_2_2_26_1","volume-title":"Proceedings of the Web 2.0 Security&amp;Privacy Workshop (W2SP'07)","author":"Hart M.","year":"2007"},{"key":"e_1_2_2_27_1","unstructured":"Hogben G. 2007. Security issues and recommendations for online social networks. ENISA Position Paper 1 European Network and Information Security Agency. http:\/\/www.enisa.europa.eu\/doc\/pdf\/deliverables\/enisa_pp_social_networks.pdf.  Hogben G. 2007. Security issues and recommendations for online social networks. ENISA Position Paper 1 European Network and Information Security Agency. http:\/\/www.enisa.europa.eu\/doc\/pdf\/deliverables\/enisa_pp_social_networks.pdf."},{"key":"e_1_2_2_28_1","volume-title":"SWRL: A Semantic Web rule language combining OWL and RuleML. W3C Member Submission","author":"Horrocks I.","year":"2004"},{"key":"e_1_2_2_29_1","volume-title":"Proceedings of the Network and Distributed System Security Symposium (NDSS'99)","author":"J\u00f8sang A.","year":"1999"},{"key":"e_1_2_2_30_1","doi-asserted-by":"publisher","DOI":"10.5555\/1239776.1239778"},{"key":"e_1_2_2_31_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.dss.2005.05.019"},{"key":"e_1_2_2_32_1","doi-asserted-by":"publisher","DOI":"10.1145\/775152.775242"},{"key":"e_1_2_2_33_1","doi-asserted-by":"publisher","DOI":"10.1145\/335305.335325"},{"key":"e_1_2_2_34_1","doi-asserted-by":"publisher","DOI":"10.1007\/11836025_15"},{"key":"e_1_2_2_35_1","doi-asserted-by":"publisher","DOI":"10.1145\/1011767.1011794"},{"key":"e_1_2_2_36_1","volume-title":"Proceedings of the IEEE Symposium on Security and Privacy (SP'97)","author":"Reiter M. K."},{"key":"e_1_2_2_37_1","doi-asserted-by":"publisher","DOI":"10.1145\/359168.359176"},{"key":"e_1_2_2_38_1","volume-title":"Small Worlds: The Dynamics of Networks between Order and Randomness","author":"Watts D. J.","year":"2003"},{"key":"e_1_2_2_39_1","volume-title":"Web: Discretionary, rule-based access for the World Wide Web. In Web&amp","author":"Weitzner D. J.","year":"2006"},{"key":"e_1_2_2_40_1","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2004.1318566"}],"container-title":["ACM Transactions on Information and System Security"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/1609956.1609962","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/1609956.1609962","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T20:26:14Z","timestamp":1750278374000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/1609956.1609962"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2009,10]]},"references-count":40,"journal-issue":{"issue":"1","published-print":{"date-parts":[[2009,10]]}},"alternative-id":["10.1145\/1609956.1609962"],"URL":"https:\/\/doi.org\/10.1145\/1609956.1609962","relation":{},"ISSN":["1094-9224","1557-7406"],"issn-type":[{"value":"1094-9224","type":"print"},{"value":"1557-7406","type":"electronic"}],"subject":[],"published":{"date-parts":[[2009,10]]},"assertion":[{"value":"2007-03-01","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2008-08-01","order":1,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2009-11-06","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}