Summary of group question

Group question：

How to reduce the risk of the user’s identity description in the social media base on access control?

Articles [1] and [2] talk about a very serious situation which is that there are many risks of identity theft when users log in their accounts of both network and physics. For the traditional access control system, a grate amount of users’ identity information has to be entered [1]. The process not only harms the users’ right to privacy [2], but also exposes millions of identity information on an unsafe network environment. Actually, for a new access control system, the users just provide some kinds of exclusive information which can be distinguished from others users [2]. This exclusive information also should be saved in different devices, and the system make sure the overall information cannot be collected by anyone [2].

In order to protect the users’ identity information, a new model of access control and some improve schemes which are base on Zero Knowledge Proof (ZKP) have been provided [3, 1]. The key technology, Zero Knowledge Proof (ZKP), ensure the users can be authenticated in an anonymous environment [1, 3]. The new model has some characters which different than the other traditional access control such as safer, more multiformity, more efficiency, and more flexibility [2, 1, 3].

At first, the access control mode uses some new cryptographic schemes to encipher the information which needs to be transferred [2] [3] . For the primer mode, a user could be anonymously authenticated when the user uses the same username to log in the different accounts. The process needs a third party which is a trusted authority [1]. The users and servers both offer a part of identity information to the third party to verify the users’ identity [1]. Although it can solve the problem of identity theft, it has to depend on the trusted authority. So, bases on the foundation, a modified model, which interactive comparison the users’ different part of information offered to different servers, is provided [1].

However, follow the development of technology, the number of users has improved to an unbeliever number. For example, the online social networks (OSNs) such as Facebook has a few hundred millions of users all around global at last 10 years [4]. If the first model, which is base on the interactive comparison, needs to dispose all of these users at the same time, the zero-knowledge proof techniques will have to run on the powerful computer [1]. At the same time, the first model focus on computer users, but nowadays many users use the mobile to connect with a network to log in their account of social media. On the other hand, the frequently replaced mobile network and unstable signal energy result in the mobile both make the users’ identity information more unsafe [3]. Moreover, the mobile device themselves also have many privacy and security risks [3]. As a result, the research introduces an identity management system (IDMs) which includes all the identity description which users access the server need to use [3]. Use this system not only can shorten the time that users log in should wait, but also can avoid the security hole which exists in the main server [3]. In addition, when the identity information is turning off and turning back, the system all encrypts them by different public keys and private keys [3]. After these security measures, even though the attacker attacks any one part of the system, the attacker just can leave the incomplete and encrypted users’ identity information which is some valueless and fail decrypted information [2, 3, 1].

In conclusion, in order to resolve the question of “How to reduce the risk of the user’s identity description in the social media base on access control?”, these researches do the below things. First, they analyze the reason why the users’ identity description has risks. The traditional verification needs to save and transfer much identity information on the network is the main reason. Then, we introduce the new access control model which is bases on Zero Knowledge Proof (ZKP). However, the model also has some insufficient. So, we put forward the modified model which focus on the interactive comparison. Furthermore, because there are more and more mobile users and the supersize of data in the new era, the identity management system is added to the model. According to these optimizing, the final access control model system can perfectly and fast accomplish the users verification and without exposing any valuable identity information.

References