Practical Privacy Enhancement of Web Services

Abstract

The rise of web services has made our lives more convenient, yet it has also raised significant privacy concerns. Users grant web service providers access to their personal data, as part of obtaining service. Service providers may track access patterns for web services (e.g. for frequently-browsed items). As a result, protecting users' personal information and their access patterns has become a critical privacy issue, which this thesis aims to address.

We acknowledge that enhancing user privacy has a cost for service providers, whether financial or in the form of reduced features, which could impede the adoption of Privacy-Enhancing Technologies. Our research seeks to reduce these costs while offering additional benefits to service providers. We believe that by providing such incentives, we can encourage service providers to adopt these solutions in practice.

We provide access pattern protection for both private and public database accesses. There is a well-established lower limit on the amount of work needed for protecting access patterns in private database contexts, which significantly slows down the access process. We demonstrate a way to reduce the latency while accessing private databases. When it comes to public databases, however, protecting client access patterns can increase server overhead significantly, but we also show how to reduce server overhead to unprecedented levels.

We also outline different ways of preserving the privacy of personal client data. Instead of relying solely on traditional cryptographic methods, we leverage the growing prevalence of trusted hardware in server environments. By utilizing this technology, we have developed effective solutions for protecting personal data, both in a single location and during the necessary sharing of the data.