Towards efficient and accurate privacy preserving web search
Towards efficient and accurate privacy preserving web search
复制标题
实现高效、准确的隐私保护网络搜索
DOI：
10.1145/2676733.2676734
复制
发表时间：
2014
期刊：
影响因子：
--
通讯作者：
H. Kosch
中科院分区：
文献类型：
--
作者：
Albin Petit;Sonia Ben Mokhtar;L. Brunie;H. Kosch
查询网络搜索引擎是在线用户迄今为止最频繁执行的活动，因此他们可能会在其中泄露大量个人信息。因此，保护网络请求者的隐私变得越来越重要。这通常是通过使用保证请求者与其查询之间不可链接的系统来完成的。实现这一目标的最有效的解决方案是使用匿名通信协议（例如洋葱路由[10]）。然而，根据[14]，匿名可能无法抵御机器学习攻击。因此，对手可以将查询链接到她的请求者的公开资料。其他方法（例如，[8,17]）通过生成噪声（例如，创建隐蔽查询或添加额外的关键字）来保证用户兴趣的不可识别性。然而，这些解决方案会使网络过载并降低结果的准确性。我们在本文中提出了结合这两种方法的第一个贡献。它允许用户执行私人网络搜索，以抵抗机器学习攻击，同时稍微降低结果的相关性。我们的三阶段架构包含：（1）一个隐私代理，它依赖于两个非共谋的服务器来向搜索引擎隐藏请求者的身份； (2) 可链接性评估，用于分析请求与请求者身份重新关联的风险； (3) 混淆器，用于保护已通过可链接性评估标记为可链接的查询。
Querying Web search engines is by far the most frequent activity performed by online users and consequently the one in which they are likely to reveal a significant amount of personal information. Protecting the privacy of Web requesters is thus becoming increasingly important. This is often done by using systems that guarantee unlinkability between the requester and her query. The most effective solution to reach this objective is the use of anonymous communication protocols (e.g., onion routing [10]). However, according to [14], anonymity might not resist to machine learning attacks. Thus, an adversary could link a query to her requester's public profile. Other approaches (e.g., [8,17]) guarantee unidentifiability of the user interests by generating noise (e.g., creating covert queries or adding extra keywords). However, these solutions overload the network and decrease the accuracy of the results. We present in this paper the first contribution that combines both approaches. It allows a user to perform a private Web search resistant to machine learning attacks while slightly decreasing the relevance of the results. Our three stage architecture contains: (1) a Privacy Proxy that relies on two non-colluding servers to hide the requester identity from the search engine; (2) a Linkability Assessment that analyses the risk that a request is reassociated with the identity of the requester; (3) an Obfuscator that protects the queries which have been flagged linkable by the linkability assessment.