Priamos: Reclaiming Social Privacy Through Autonomous, Context-Aware Identity Facets

TL;DR

In the real world, we wear different "masks"—we share different information with our bosses, our parents, and our close friends. Online Social Networks (OSNs), however, often force us into a single, flat identity. Priamos is an architectural breakthrough that decouples your personal data from platforms like Facebook. It manages your identity autonomously and uses "Context-Aware" logic to ensure that only the right people see the right data at the right time.

Positioning: This work represents a significant shift from "Platform-Centric" access control to "User-Centric" autonomous identity management, bridging the gap between theoretical decentralized OSNs and today's centralized giants.

The Core Friction: Context Collapse

The authors identify two fatal flaws in current OSN privacy:

1. Provider Exploitation: OSN providers have total access to your data, leading to a monopoly on personal information.
2. Context Collapse: In the real world, privacy is "Contextual Integrity." OSNs break this by making information permanent, searchable, and visible to an indiscriminate "friend" list.

Existing solutions like Diaspora failed because they required everyone to switch platforms. Priamos takes a different route: Stay on the platform, but bring your own lock and key.

Methodology: The Priamos Architecture

The Priamos system consists of a central Identity Management System (IdMS) and a Browser Plugin for your contacts.

1. URL-Based Identities

Instead of typing your email into a Facebook profile, you provide a Base64-encoded URL generated by Priamos. To an OSN provider, this is just a string of gibberish. To a contact with the Priamos plugin, it is a dynamic pointer to your actual data.

2. Context-Aware Access Control (The "Brain")

The heart of the paper is the context model. Drawing from Zimmermann’s work, the authors focus on three critical dimensions to restrict access:

• Temporal Constraints: Setting an "expiry date" on data (e.g., your current location is only visible for 2 hours).
• Quantitative Constraints: Limiting the number of views (e.g., a contact can only see your phone number 3 times) to prevent stalking.
• Social Constraints (Tie Strength): Assigning a trust value (0.0 to 1.0) to contacts. You might require a trust of 0.8 to see your relationship status, while a trust of 0.2 is enough for your name.

Figure 1: The high-level architecture showing the decoupling of the Identity Provider from the Social Network.

How It Works: The Workflow

1. User Side: You define attributes in Priamos and set access rules (e.g., "Only 'Close Friends' group can see my mobile number").
2. Integration: You place the Priamos-generated link on your Facebook profile.
3. Contact Side: When a friend visits your profile, their browser plugin detects the URL and performs an OAuth-based authentication with your Priamos server.
4. Enforcement: The server checks the friend's context (Is their trust level high enough? Is the link still valid?). If yes, it returns the real data, which the plugin injects into the webpage seamlessly.

Figure 2: The automated process of detecting identity URLs and injecting attribute values.

Experimental Insights

The research team implemented a prototype using Java EE 6 and RESTful services. They successfully demonstrated "Audience Segregation" where two different users visiting the same Facebook profile saw different levels of detail based on their trust scores.

The Logging & Awareness component provided a visual graph of data flow, helping users understand who has accessed what—addressing the "out of sight, out of mind" problem typical of online privacy.

Figure 3: Graphical views helping users track contact relationships and attribute disclosure.

Critical Perspective & Future Outlook

Strengths:

• OSN Agnostic: It works on any website because it operates at the browser/DOM level.
• Physical Intuition: It maps real-world social dynamics (trust, time-sensitive secrets) into a technical RBAC (Role-Based Access Control) model.

Limitations:

• Adoption Barrier: Asking your contacts to install a browser plugin is a "high transaction cost" that might limit use to very close circles.
• Data Scrapers: While it stops the provider, a malicious contact could still manually copy the data once it is revealed.

The Takeaway: Priamos proves that privacy isn't just about "encryption"—it's about agency. By putting the user back in charge of the "Context," we can enjoy the social web without becoming permanent entries in a provider's database.