As the degree to which we rely on networked information systems like social networks, IoT-enabled homes and sensor-instrumented workplaces, and cloud-backed data services increases, our agency to control our own data becomes ever more reduced. In this project, we sought to understand the context surrounding individuals? perceived losses of privacy in the context of networked and data-centric systems, and to develop user-centric mechanisms for them to control the ways in which their personal data is made accessible to these types of systems.  We considered these questions in the context of a number of domains.

The declarative nature of SQL has traditionally been a major strength: users can simply state what information they are interested in, and the database management system determines the best plan for retrieving it. However, as query optimizers typically chose the fastest plans for execution, in distributed database scenarios this can result in situations where (i) sensitive aspects of a user?s query are leaked unknowingly to lesser-trusted servers violating querier privacy constraints, and/or (ii) sensitive data from one server flows through multiple others servers in violation of data-owner policies.  To address these types of issues, we have developed query optimization approaches that treat user privacy constraints and data owner access constraints as first-class citizens.  The result is that our optimizers produce query evaluation plans that are optimal in terms of execution time, while also upholding privacy and security constraints imposed by stakeholders.  This process was further refined by the development of query interfaces that support interactive exploration of data flows so that non-expert users can understand what their privacy concerns might be.

In the context of streaming data management systems, data from multiple sources (e.g., fitness trackers, IoT appliances, monitoring systems, etc.) flows constantly through largely static queries that are typically deployed to cloud infrastructures to meet reliability and elasticity goals.  While useful, this comes at the cost of exposing sensitive user data to potentially untrusted infrastructure.  We aimed to enable the users providing data to streaming data management systems to specify controls on who could access their data (e.g., their clinician, but not the cloud infrastructure used for data processing) while still enabling in-network processing to take advantage of the economies of scale offered by cloud infrastructures.  Our initial solutions used computation-enabling encryption techniques to allow certain operations to occur in-network without directly revealing information.  Unfortunately, this approach comes with runtime constraints, enables inferences of data distribution, and does not completely support the query languages used by streaming data systems.  We then leveraged commodity trusted execution environments to both improve performance and extend support for the full expressive power of streaming query languages.  This allows users to specify rich controls over the uses of their data, even when processed on infrastructure whose configuration remains opaque to the user.

Similar to the above, cloud storage infrastructures have become a ubiquitous feature of today?s computational landscape.  These platforms allow for seamless data sharing across a user?s devices, and across groups of users.  However, these systems involve the exposure of private user data to back-end infrastructure that is often not understood by the user.  In addition, compromise or misconfiguration of these services can expose user data to unauthorized individuals, as is evidenced by frequent high-profile data breaches.  A naive solution to this problem is to use purely cryptographic and traditional key distribution mechanisms to prevent unauthorized disclosure of data at rest.  An analysis conducted by our team uncovered massive overheads entailed by this approach in the event that policies are dynamic.  To counter this, we developed a novel approach to using client-side trusted execution environments to enable flexible and efficient enforcement of user-specified access control policies without requiring server-side support.  This approach allows the use of unmodified, commodity storage platforms to store and distribute users? data without exposing the unencrypted data to these platforms.

A final area of exploration during this award was with respect to the increasing extent to which users are monitored by sensing infrastructures within the context of smart homes, connected workplaces, and mobile device instrumentation.  To this end, we carried out formative studies to explore the ways in which user sentiments towards sensing varied as a function of sensing modality, sensing goal, and data dissemination.  We developed design recommendations that balance the utility of these sorts of systems with user comfort, and created prototypes to demonstrate the efficacy of our approaches.  

A common theme throughout this work has been that system functionality need not come at the cost of user privacy, and that balancing these two goals can be achieved without excessive overheads or cumbersome interfaces.  We have the tools and techniques at our disposal to enable rich user control over data without impeding service providers, and it is worth reconciling these goals.

Last Modified: 05/13/2020
Modified by: Adam J Lee