RTBAC: Bridging the Gap Between Static Roles and Dynamic Trust in Social Privacy

TL;DR

In the world of Online Social Networks (OSN), being a "Friend" doesn't always mean you are trusted. The RTBAC (Role and Trust Based Access Control) model moves beyond the binary "all-or-nothing" permission structure. By analyzing account age, mutual friends, and behavioral ratios, it calculates a real-time User Trust Value (UTV). If you're a family member but your account looks like a bot, you might only see a blurred version of a profile picture instead of the high-res original.

The Problem: The "Friend" Fallacy

Current privacy settings on platforms like Facebook or LinkedIn rely heavily on RBAC (Role-Based Access Control). If you assign someone the role of "Close Friend," they get the keys to the kingdom. However, this fails to account for:

1. Stale Connections: Someone you friended 10 years ago but haven't interacted with since.
2. Social Engineering: Adversaries or bots that successfully trick a user into a high-permission role.
3. Lack of Nuance: There is no middle ground between "Public" and "Private."

Methodology: The Anatomy of Trust

The RTBAC model posits that a final access decision $B(U,P)$ should be a function of both the Role Permission and a Minimal Trust Value (MTV).

1. The Trust Equation

Trust is split into two specialized vectors:

• User Credibility ($u$): Focuses on the account's reputation. Metrics include Total Friends (TF), Age of User Account (AUA), and Followers/Followees Ratio (FFR).
• Connection Strength ($c$): Focuses on the dyadic relationship. Metrics include Friendship Duration (FD), Mutual Friends (MF), and Resemblance Attributes (RA) (e.g., shared workplace or school).

Figure 1: Comparison of users with the same role but different trust levels.

2. The Implementation of Partial Access

One of the paper’s most innovative contributions is Image Anonymization. Instead of blocking an image, the system provides a "partial instance." High-trust users see the clear original; low-trust users (or those with lower roles) see a blurred version. This effectively thwarts automated facial recognition harvesters while maintaining a level of social utility.

Experiments & Results

The authors didn't just propose a theory; they validated it using a survey of 282 users to weigh the importance of different behavioral attributes.

• Weighting Factors: The study found that Mutual Friends (weight 5.93) and Total Friends (weight 5.37) are perceived as the strongest indicators of trust.
• Real-world Validation: When applied to a dataset of 162 users, the model successfully flagged users who had bypassed the "Ego-user's" manual filters but posed a statistical privacy risk.

Table 1: Quantitative analysis of UTV vs MTV for different users.

Critical Insight: Why This Matters

The shift from identity-based access to behavior-based trust is critical for the next generation of the web. RTBAC acknowledges that social connections are dynamic—trust grows and decays over time.

Limitations & Future Work

• Computation Overhead: Calculating UTV for every relationship in real-time on a billion-user scale requires significant backend optimization.
• Adversarial Adaptation: As trust models become public, sophisticated bots may attempt to "farm" account age and mutual friends to game the UTV score.

Conclusion (Takeaway)

RTBAC provides a robust framework for making OSN privacy more "human." By moving away from rigid roles and toward a tiered visibility system (like image blurring), we can create social environments that are both open and inherently secure against data harvesters.