Protecting personal data from untrusted web-based data services

Abstract

Our society places a heavy emphasis on security and the privacy of personal data. Personal data at the hands of a malicious entity could spell disastrous consequences for the data's owner. There is a whole slew of attacks on the Internet aimed at procuring and misusing personal information for profit.1, 2 And so, recently, there has been a huge thrust towards developing technologies that protect personal data from being misused.3, 4 Governments across the world are passing laws to protect personal information.5 Outsourcing personal information to web-based data services (WDS) is a common recent trend. These services have become very popular, but they require us to trust the service provider and may be vulnerable to both outsider and insider attacks. Ravi Chandra Jammalamadaka of eBay and Sharad Mehrotra and Nalini Venkatasubramanian of the University of California, Irvine, present the design and initial implementation of DataProtector, security middleware that acts as a transparent middleman between browser and web server and enforces security requirements at the level of HTTP requests.