ProProtect3: An Approach for Protecting User Profile Data from Disclosure, Tampering, and Improper Use in the Context of WebID

  • Stefan WildEmail author
  • Fabian Wiedemann
  • Sebastian Heil
  • Alexey Tschudnowsky
  • Martin Gaedke
Part of the Lecture Notes in Computer Science book series (LNCS, volume 8990)


WebID is a new identification approach of the W3C. It enables managing profile data associated to persons and services at self-defined places in the cloud. By relying on RDF vocabularies like FOAF for describing user profile data, WebID contributes to the Semantic Web vision. While access to user profiles can be controlled with existing security mechanisms, they are not designed to protect sensitive data within user profiles from unwanted retrieval, malicious manipulation, and improper use. This article analyzes the risks that affect the knowledge stored in WebID-based user profiles. It therefore describes potential attack scenarios and outlines the challenges a solution must deal with. To tackle the problem of insufficient protection, we propose ProProtect3. This approach enables identity owners (1) to create customized filters for sensitive data, (2) to verify the profile data integrity, and (3) to restrict the rights of delegatees. For evaluating the ProProtect3 approach, we integrate it into a WebID identity provider.


Protection Linked data Identity WebID Social web Privacy Security Integrity Authentication Delegation Semantic web 



Parts of this work were supported and funded by the European Commission (project OMELETTE, contract 257635).

The authors thank Markus Ast, Falko Braune, Dominik Pretzsch and Michel Rienäcker for their first experimental results on JavaScript-based WebID certificate creation and integrity protection, which have been partially used in this work.


  1. 1.
    Akhawe, D., Li, F., He, W., et al.: Data-Confined HTML5 Applications. Technical Report, Electrical Engineering and Computer Sciences, UCB (2013)Google Scholar
  2. 2.
    Bai, G., Lei, J., Meng, G., et al.: AuthScan: Automatic extraction of web authentication protocols from implementations. In: Proceedings of 20th Annual Network & Distributed System Security Symposium (2013)Google Scholar
  3. 3.
    Bamberg, W., et al.: Persona - Protocol Overview (2013). Accessed 24 March 2014
  4. 4.
    Barker, E., Barker, W., Burr, W., et al.: NIST Special Publication 800–57: Recommendation for Key Management - Part 1: General (Revision 3). Technical Report, National Institute of Standards and Technology (2012)Google Scholar
  5. 5.
    Bonneau, J., Anderson, J., Anderson, R., Stajano, F.: Eight friends are enough: Social graph approximation via public listings. In: Proceedings of the 2nd ACM EuroSys Workshop on Social Network Systems, pp. 13–18 (2009)Google Scholar
  6. 6.
    Brickley, D., Miller, L.: FOAF Vocabulary Specification 0.99 (2014). Accessed 24 March 2014
  7. 7.
    Carroll, J.J.: Signing RDF graphs. In: Fensel, D., Sycara, K., Mylopoulos, J. (eds.) ISWC 2003. LNCS, vol. 2870, pp. 369–384. Springer, Heidelberg (2003) CrossRefGoogle Scholar
  8. 8.
    Chudnovskyy, O., Wild, S., Gebhardt, H., Gaedke, M.: Data portability using Webcomposition/Data grid service. Int. J. Adv. Internet Technol. 4(3 and 4), 123–132 (2012)Google Scholar
  9. 9.
    Cooper, D.: Internet X.509 Public key infrastructure certificate and certificate revocation list (CRL) profile (2008). Accessed 10 August 2013
  10. 10.
    Dhamija, R., Dusseault, L.: The seven flaws of identity management: Usability and security challenges. IEEE Secur. Priv. 6(2), 24–29 (2008)CrossRefGoogle Scholar
  11. 11.
    Dierks, T.: The Transport Layer Security (TLS) Protocol Version 1.2 (2008). Accessed 10 August 2013
  12. 12.
    El Maliki, T., Seigneur, J.M.: A survey of user-centric identity management technologies. In: International Conference on Emerging Security Information, Systems, and Technologies. SecureWare 2007, pp. 12–17. IEEE (2007)Google Scholar
  13. 13.
    Ellison, C., Schneier, B.: Ten risks of PKI: What you’re not being told about public key infrastructure. Comput. Secur. 16(1), 1–7 (2000)Google Scholar
  14. 14.
    European Commission: ICT - Work Programme 2013. EC (2012)Google Scholar
  15. 15.
    Fitzpatrick, B., Recordon, D., Hardt, D., Hoyt, J.: OpenID Authentication 2.0 - Final (2007). Accessed 10 August 2013
  16. 16.
    Florencio, D., Herley, C.: A large-scale study of web password habits. In: Proceedings of the 16th International Conference on World Wide Web, pp. 657–666. ACM Press (2007)Google Scholar
  17. 17.
    Gellman, B., Poitras, L.: U.S., British Intelligence Mining Data from Nine U.S. Internet Companies in Broad Secret Program. The Washington Post, 6 June 2013Google Scholar
  18. 18.
    Hackett, M., Hawkey, K.: Security, privacy and usability requirements for federated identity. In: Workshop on Web 2.0 Security & Privacy (2012)Google Scholar
  19. 19.
    Hardt, D.: The OAuth 2.0 Authorization Framework (2012). Accessed 24 March 2014
  20. 20.
    Hardt, D., Bufu, J., Hoyt, J.: OpenID Attribute Exchange 1.0 - Final (2007). Accessed 24 March 2014
  21. 21.
    Harris, S., Seaborne, A.: SPARQL 1.1 Query Language (2013). Accessed 24 March 2014
  22. 22.
    Heitmann, B., Kim, J.G., Passant, A., et al.: An architecture for privacy-enabled user profile portability on the Web of Data. In: Proceedings of the 1st International Workshop on Information Heterogeneity and Fusion in Recommender Systems, HetRec 2010, pp. 16–23. ACM (2010)Google Scholar
  23. 23.
    Hollenbach, J., et al.: Using RDF metadata to enable access control on the social semantic web. In: Proceedings of the Workshop on Collaborative Construction, Management and Linking of Structured Knowledge (2009)Google Scholar
  24. 24.
    Jøsang, A., Zomai, M.A., Suriadi, S.: Usability and privacy in identity management architectures. In: Proceedings of the Fifth Australasian Symposium on ACSW Frontiers, vol. 68, pp. 143–152. Australian Computer Society (2007)Google Scholar
  25. 25.
    Josefsson, S.: The Base16, Base32, and Base64 Data Encodings (2006). Accessed 24 March 2014
  26. 26.
    Kasten, A., Scherp, A.: Iterative signing of RDF(S) graphs, named graphs, and OWL graphs: Formalization and application. Arbeitsberichte aus dem Fachbereich Informatik 3, 3–28 (2013)Google Scholar
  27. 27.
    Maler, E., Reed, D.: The venn of identity: Options and issues in federated identity management. IEEE Secur. Priv. 6(2), 16–23 (2008)CrossRefGoogle Scholar
  28. 28.
    Manola, F., Miller, E.: RDF Primer (2004). Accessed 29 January 2014
  29. 29.
    Pérez, J., Arenas, M., Gutierrez, C.: Semantics and complexity of SPARQL. ACM Trans. Database Syst. 34(3), 1–45 (2009)CrossRefGoogle Scholar
  30. 30.
    Rivest, R.L., et al.: A method for obtaining digital signatures and public-key cryptosystems. Commun. ACM 21(2), 120–126 (1978)CrossRefzbMATHMathSciNetGoogle Scholar
  31. 31.
    Savitz, E., Medrano, R.: Welcome To The API Economy - Forbes (2012). Accessed 24 March 2014
  32. 32.
    Sayers, C., Karp, A.H.: Computing the Digest of an RDF Graph. Mobile and Media Systems Laboratory, HP Laboratories, Palo Alto (2004) Google Scholar
  33. 33.
    Seaborne, A.: SPARQL 1.1 Property Paths (2010). Accessed 24 March 2014
  34. 34.
    Sporny, M., Inkster, T., Story, H., et al.: WebID 1.0: Web Identification and Discovery (2011). Accessed 10 Feb 2014
  35. 35.
    The Nielsen Company: Social Media Report 2012 (2012). Accessed 9 March 2014
  36. 36.
    Tomaszuk, D., Gaedke, M., Gebhardt, H.: WebID+ACO: A distributed identification mechanism for social web. In: Proceedings of the Federated Social Web Europe (2011)Google Scholar
  37. 37.
    Toorani, M., Beheshti, A.: LPKI-a lightweight public key infrastructure for the mobile environments. In: 11th IEEE Singapore International Conference on Communication Systems, 2008, ICCS 2008, pp. 162–166. IEEE (2008)Google Scholar
  38. 38.
    Tramp, S., Frischmuth, P., Ermilov, T., Shekarpour, S., Auer, S.: An architecture of a distributed semantic social network. Semant. Web 5(1), 77–95 (2012)Google Scholar
  39. 39.
    Tramp, S., Story, H., Sambra, A., et al.: Extending the WebID protocol with access delegation. In: Proceedings of the Third International Workshop on Consuming Linked Data (COLD2012) (2012)Google Scholar
  40. 40.
    Tummarello, G., Morbidoni, C., Puliti, P., Piazza, F.: Signing individual fragments of an RDF graph. In: Special Interest Tracks and Posters of the 14th International Conference on WWW, pp. 1020–1021. ACM (2005)Google Scholar
  41. 41.
    Wild, S., Ast, M., Gaedke, M.: Towards a context-aware WebID certificate creation taking individual conditions and trust needs into account. In: Proceedings of the 15th International Conference on Information Integration and Web-based Applications & Services, pp. 532–541. ACM (2013a)Google Scholar
  42. 42.
    Wild, S., Chudnovskyy, O., Heil, S., Gaedke, M.: Customized views on profiles in webid-based distributed social networks. In: Daniel, F., Dolog, P., Li, Q. (eds.) ICWE 2013. LNCS, vol. 7977, pp. 498–501. Springer, Heidelberg (2013) CrossRefGoogle Scholar
  43. 43.
    Wild, S., Chudnovskyy, O., Heil, S., Gaedke, M.: Protecting user profile data in WebID-based social networks through fine-grained filtering. In: Sheng, Q.Z., Kjeldskov, J. (eds.) ICWE Workshops 2013. LNCS, vol. 8295, pp. 269–280. Springer, Heidelberg (2013) CrossRefGoogle Scholar
  44. 44.
    Wild, S., Gaedke, M.: WebComposition/EMS: A value-driven approach to evolution. In: Rossi, G., Iturrioz, J. (eds.) ICWE 2009 Doctoral Consortium, pp. 39–43. Onekin Research Group (2009)Google Scholar
  45. 45.
    Yeung, C.M.A., Liccardi, I., Lu, K., et al.: Decentralization: The future of online social networking. In: W3C Workshop on the Future of Social Networking Position Papers, vol. 2, pp. 2–7 (2009)Google Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2015

Authors and Affiliations

  • Stefan Wild
    • 1
    Email author
  • Fabian Wiedemann
    • 1
  • Sebastian Heil
    • 1
  • Alexey Tschudnowsky
    • 1
  • Martin Gaedke
    • 1
  1. 1.Technische Universität ChemnitzChemnitzGermany

Personalised recommendations