IT 17 023 Examensarbete 45 hp Juni 2017 Mobile Social Network Platform Lei Sun Institutionen för informationsteknologi Department of Information Technology Abstract Mobile Social Network Platform Lei Sun Teknisk- naturvetenskaplig fakultet UTH-enheten The SWiN project is an abbreviation for Social Wireless Network Secure Identification project and it primarily focuses on the security issues of social networks Besöksadress: on mobile platforms. This master thesis is a part of the SWiN project from SICS Ångströmlaboratoriet Lägerhyddsvägen 1 (Swedish Institute of Computer Science) in cooperation with Ericsson and Sony. Hus 4, Plan 0 In this thesis project, we have designed and implemented a social networking Postadress: prototype called FriendFinder. This prototype integrates different security solutions Box 536 751 21 Uppsala such as SAML and GBA to test the performance of them.
Telefon: 018 – 471 30 03 Telefax: 018 – 471 30 00 Hemsida: http://www.se/student Handledare: Ludwig Seitz Ämnesgranskare: Justin Pearson Examinator: Mats Daniels IT 17 023 Tryckt av: Reprocentralen ITC Contents Acknowledgements. 7 List of Abbreviations .1 Introduction of SWiN Project .2 Motivation of My Thesis .3 Scope of Thesis .4 Development Process Model .2 Location‐based Social Networks .1 Introduction of GBA.2 Elements of GBA .3 Work Flow of GBA .1 Introduction of SAML. 17 Chapter 3 Methods and Techniques Required.1 Social Networking Module .4 Local Database Design .1 Introduction of MWSB.2 MWSB Enabler Architecture.3 Procedures of MWSB .4 Implement MWSB on FriendFinder Application. 50 Chapter 5 Conclusion and Future Work.
64 6 Acknowledgements I would like to thank my supervisor Ludwig Seitz for guiding my thesis study. I want to thank Christian Gehrmann for the support. In addition, I want to say thanks to my thesis reviewer Olle Eriksson and Justin Pearson for their guidance. Thanks to Oscar Ohlsson from Ericsson for help with GBA.
Finally, I would like to thank everyone who offered me help during my thesis project. 7 List of Abbreviations GAA Generic Authentication Architecture GBA Generic Bootstrapping Architecture B‐TID Bootstrapping Transaction Identifier IMPU IP Multimedia Public Identity HLR Home Location Register HSS Home Subscriber Server MSNP Mobile Social Networking Provider MWSB Mobile Web Security Bootstrap NAF Network Application Function PKI Public Key Infrastructure 8 Chapter 1 Introduction The chapter describes the current state of the SWiN project as well as outlines the motivation and scope of this thesis.1 Introduction of SWiN Project The SWiN project is an abbreviation for Social Wireless Network Secure Identification project. SWiN primarily focuses on the security issues of social networks on mobile platforms. This master thesis is a part of the SWiN project from SICS (Swedish Institute of Computer Science) in cooperation with Ericsson and Sony.
From the end of the 1990s, the rapid increase of social networking services has had a profound effect on communication. Virtual socializing has become a major trend to keep in touch with friends, family, and even strangers. No matter where people are they can access social networks via their mobile phones. When people turn on their computers, the first thing that they do might be browsing social networking websites.
It is no surprise that social networks play a very important role in our daily life. In recent years, the social network is moving into mobile domain due to the rapid development of smartphones. Social networking providers start to offer new functions by incorporating mobile features. For example, due to the availability of GPS in smart mobile phones, social networks based on geographic location are becoming popular.
For example, users can check into place and share their location with other users. It is also possible to search for bars or restaurants nearby. These exciting features provide a new kind of user experience; they also result in a higher risk of leaking privacy. Most users would probably not like strangers to know where they are and what they are doing.
Consequently, how to protect integrity and confidentiality of personal data from illegal data collection becomes an important factor to improve the quality of social networking services [14]. Social networks adapted to mobile platform increases the possibility of leaking users’ private data in mobile phones. On the other hand, it also provides an alternative to protect personal data by integrating security features from the mobile phone. The SWiN project addresses the question of how to improve existing and upcoming mobile security technologies such as USIM, ISIM, GBA in order to enhance the mobile user’s security experience [1].
Besides this, it also proposes effective security solutions that guarantee confidentiality of the communication between clients without social networking provider interaction. For example, when users create a group and communicate directly with each other over NFC or Bluetooth, the communication among group members should be confidential and protected from leakage to unauthorized users. 9 So far, the project mainly concentrates on three issues and puts forward three related solutions. The first one is how the server authenticates users which is an essential requirement for secure service.
The second one is how to preserve the privacy and personal integrity of the user in a mobile social network. The last one is to improve the Android security which is originally only based on a simple access control model. But this thesis only pays attention to the former two issues. Regarding the last one refer to Qing Huang’s thesis [2].2 Motivation of My Thesis Theoretical security solutions for mobile social networks have been proposed in the previous research of the SWiN project [1].
There is now a need for a social networking application that can integrate and test the proposed security solutions. The application needs support for common social networking features. In the first part of the thesis, we will implement a social networking application that fulfills these requirements. The application will be called FriendFinder.
It will contain a service provider and a client. The client will be running on the Android operating system. In the second part of the thesis, we will integrate and evaluate the security solutions proposed by the SWiN project. This application is not intended for commercial use.
Therefore, it aims to provide basic social networking functionalities before pretty user interface and advanced features. The application will still be highly extensible and well documented.3 Scope of Thesis The scope of the thesis primarily consists of: Study the SWiN project’s background and understand the security problems it addresses and the solutions it proposes. Design and implement a social networking client in Android with typical social networking features. Design and implement a social networking server.
Integrate and validate the security mechanisms from the SWiN project in the social networking client/server.4 Development Process Model We adopted a sequential design process, the waterfall model, to develop this software. For each stage, we made a concrete plan with time schedule to ensure that we were able to complete the software with high quality on time. The details of the process are described below. Requirements The first essential stage was to set the requirements of the software.
In order to draw up a reasonable and comprehensive requirement specification, background investigation was our main task in the first month. We concentrated on understanding the background of the SWiN project and figuring out the issues that the SWiN project has addressed and solutions it has introduced. Because the system is used as a demonstrator for validating security solutions, it is designed to provide enough social networking scenarios that are needed for testing security strategies. In this stage, we have conceived all use cases and finished a strict requirement specification.
Design The following month, we started designing the system architecture and created a system model in UML (Unified Modeling Language). Implementation The Implementation took us approximately 4 months. It was divided into two parts: the server and the client. The main task in this stage was to implement the code in each side and to follow the previous design.
Moreover, both the client and server were shipped with the security solutions from SICS and Ericsson Lab. Verification During the implementation phase, we debugged the system in parallel. For each functional increment, our supervisor tested the system and gave us feedback. At this stage, the system was moved from development environment into the real environment to test if it satisfied the demands.
We moved the finished software from emulator into mobile phone to test it in reality. Maintenance After implementation and verification, the last task was to write related documentation and fixed newly found defects. At the same time, we also started to write the report of thesis.5 Thesis Organization Chapter 1 is the introduction of this thesis which includes background and motivation. Chapter 2 covers more details of the SWiN project.
Chapter 3 describes the methods and techniques which were used in implementation and the reasons why we decided to use them. Chapter 4 illustrates the details of the implementation. I was mostly responsible for the client part so my statement will focus on the client side. Chapter 5, the last chapter of this report, makes a conclusion of the whole thesis work and proposes future work.
12 Chapter 2 Background This chapter introduces the background of FriendFinder which contains its design concept, initial intention and security mechanisms from the SWiN project.1 FriendFinder We implemented a social networking application called FriendFinder which is regarded as a test platform for security solutions. The main feature in FriendFinder is like the name suggests to find the location of your friends. This category of service is called location‐based social networking service. It allows users to send messages and share their location by connecting with a server or direct communication such as WIFI, NFC or Bluetooth.2 Location‐based Social Networks In the beginning, location‐aware mobile applications allowed mobile phone users to view the current location of their friends.
This kind of location‐based service merely shared the location among friends. It didn’t provide any functionality for users to interact with the environment. An example of an application from this time is Google Latitude, where a user's cell phone location was displayed on Google Maps. Other users can see the location instantaneously.
In order to preserve privacy, a user can specify a group of people that are allowed to see the location. It is also possible to turn off the service completely. Moreover, a user also can control the accuracy of what each of the other users are authorized to see [15]. The next generation of location‐based social networking services expands this idea and allows users to interact with their environment through mobile devices.
Foursquare is a location‐based social networking website for mobile devices. Users "check in" at venues using a mobile website, text messaging or a device‐specific application by selecting from a list of venues the application locates nearby [4]. Then they could recommend restaurants, pubs, and other places around “check in” venues or check the recommended places by other users. The second generation of location‐based service discloses more sensitive user data, not only the location.
It might also reveal a user’s habits, customs, characteristics, personalities and such kind of information. With bringing new fantastic functionalities, it also has increased security requirements. The data could be manipulated to reconstruct a real person’s life easily. A mobile social 13 network user has to worry about being overseen or stalked by an adversary.
Apart from this concern, an adversary can impersonate the user by falsifying or stealing private data from social networking providers. Another similar attack is “man‐in‐the‐middle”. It is possible when the system lacks mutual authentication so that an attacker can impersonate each endpoint. The entire conversation is controlled by attacker and it is rather easy to gain the private information from victims.
The FriendFinder application supports direct communication which enables information exchange between clients by using short‐range wireless technology such as Bluetooth or WIFI. For example, a user could establish a group and send invitation to friends by Bluetooth or WIFI. Then they can share locations among members in this group. In this scenario, the attacks mentioned before such as “man‐in‐the‐middle” and spoofing are also existed.