Negotiated privacy

  • Authors:
  • Stanisław Jarecki;Patrick Lincoln;Vitaly Shmatikov

  • Affiliations:
  • Computer Science Department, Stanford University, Stanford, CA;SRI International, Menlo Park, CA;SRI International, Menlo Park, CA

  • Venue:
  • ISSS'02 Proceedings of the 2002 Mext-NSF-JSPS international conference on Software security: theories and systems
  • Year:
  • 2002

Quantified Score

Hi-index 0.00

Visualization

Abstract

Exponential growth in digital information gathering, storage, and processing capabilities inexorably leads to conflict between well-intentioned government or commercial datamining, and fundamental privacy interests of individuals and organizations. This paper proposes a mechanism that provides cryptographic fetters on the mining of personal data, enabling efficient mining of previously-negotiated properties, but preventing any other uses of the protected personal data. Our approach does not rely on complete trust in the analysts to use the data appropriately, nor does it rely on incorruptible escrow agents. Instead, we propose conditional data escrow where the data generators, not the analysts, hold the keys to the data, but analysts can verify that the prenegotiated queries are enabled. Our solution relies on verifiable, anonymous, and deterministic commitments which play the role of tags that mark encrypted entries in the analyst's database. The database owner cannot learn anything from the encrypted entries, or even verify his guess of the plaintext on which these entries are based. On the other hand, the verifiable and deterministic property ensures that the entries are marked with consistent tags, so that the database manager learns when the number of entries required to enable some query reaches the prenegotiated threshold.