CAREER: Tools for building online services that hide metadata

在线服务跟踪用户并分析他们的行为，以改进他们的产品并将他们的服务货币化。尽管收集用户信息有好处，但数据泄露和内部攻击会带来灾难性的后果。例如，阿什利·麦迪逊泄露事件突显了社交图谱泄露的危险(以及它对用户关系的影响)。事实上，元数据(谁、什么、何时等)可能是敏感的，但对某些信息(例如，用户观看了哪些电影、哪些消息被“赞”或社交图)视而不见的构建服务会带来重大的技术和财务挑战。该项目以提供商为中心来隐藏元数据，并将公司视为致力于保护用户信息的合作伙伴，而不是对手，前提是必要的机制在成本、功能和假设方面是合理的。根据公司的需求，该项目设计了算法、工具和基础设施，以帮助服务在不访问或收集特定元数据(例如，社交图)的情况下继续工作，从而限制数据泄露和内部攻击的危害。该项目通过提高广泛适用的加密原语的效率来改进它们；使用访问控制和责任功能对其进行扩展，使隐私与功能不冲突；支持改进服务所需的私人用户反馈(例如，培训垃圾邮件过滤器)；并使源代码的发布成为可选的。该项目还设计了首个去中心化、可验证的广告交换平台，允许用户在不侵犯隐私的情况下接收定向广告。该平台将补充其他收入来源，以确保元数据私有在线服务的可持续性。最后，这个项目的主题涵盖了关键和及时的社会问题，如隐私、公平及其对企业财务稳定的影响。这些概念将通过一个新的深入的顶峰课程、年度研讨会以及现有系统和安全课程中的专门章节转移到课堂上。该奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

Online services track users and analyze their behavior to improve their products and monetize their services. Despite the benefits of collecting user information, data breaches and insider attacks have disastrous consequences. For example, the Ashley Madison breach highlights the danger of a leaked social graph (and what it implies about users’ relationships). Indeed, metadata (who, what, when, etc.) can be sensitive, but building services that are oblivious to certain information (e.g., which movies users watch, which messages are “liked”, or the social graph) poses significant technical and financial challenges. This project takes a provider-centric view to hiding metadata and sees companies not as adversaries, but as partners committed to safeguarding users’ information, provided that the necessary mechanisms are reasonable in terms of costs, features, and assumptions. Grounded by the needs of companies, this project designs algorithms, tools, and infrastructure to help services continue to work without accessing or collecting certain metadata (e.g., the social graph), limiting the harm of data breaches and insider attacks.This project improves widely applicable cryptographic primitives by making them more efficient; extends them with access control and accountability features so privacy is not at odds with functionality; supports private user feedback necessary to improve services (e.g., train spam filters); and makes the release of source code optional. This project also designs the first decentralized and verifiable ad exchange platform that allows users to receive targeted ads without violating their privacy. This platform will supplement other revenue sources to ensure the sustainability of metadata-private online services. Finally, the topics of this project cover critical and timely social issues such as privacy, fairness, and their impact on the financial stability of businesses. These concepts will be transitioned to the classroom through a new in-depth capstone course, yearly workshops, and dedicated chapters in existing systems and security courses.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.