Recent developments in networking and storage technology have led to the distribution of information over many different sources such as personal computers or corporate and public databases. As these information sources are often distributed and heterogeneous, effective tools for data collection and integration have been developed in parallel. These tools are employed e.g. in library search catalogues or in Internet search engines to facilitate information search over a wide range of different information sources.

The collection and analysis of distributed data is useful and uncritical as long as the sources are publicly available, i.e. the data holders explicitly want to provide their data such as in personal homepages or in product catalogues. There are, however, more sensitive application areas such as cancer research. Medical researchers collect and analyze primary care data for epidemiological characterizations and for the construction of predictive models. Primary care data is created and recorded when a physician diagnoses, treats and medicates a patient and is of course strictly confidential. Necessary security measures include granting access to authorized people only and keeping the communication confidential. But even if these measures are in place when patient information is passed from physicians to researchers, many questions have not yet been answered with regard to the patients' privacy.

• Should individual patient records be anonymized; and if yes, which information should be removed?

• Should the researcher be allowed to share confidential information; and if yes, which information with whom?

• If a published research report contains aggregated confidential values of several patients, does it still respect each individual's privacy?

• If a researcher or his environment cannot entirely be trusted, are there ways to provide useful patient data while preventing misuse?

There are many instances where conflicts of interest arise between the data holders and the users of the (possibly processed or modified) confidential data. We call these users "service users", where services also include the retrieval of the raw data as the simplest kind of service. In this case, the patients might agree on the benefits that a release of their data can have for curing their disease (if not for themselves, then for future generations), they have a natural interest in protecting their most confidential data from misuse (e.g., by the state, by their employer or by their insurance company). Principally, their aim is minimizing the risk of an invasion of their privacy by a third party. However, on the other hand the service users need confidential data at a maximal level of detail. Often the quality of the analysis improves with a more accurate and rich data set. Figure 1-1 sketches the contrasting aims of data holders and service users.

Figure 1-1: Different scope of data holders and service users

This thesis explores the borderline between the competing interests of data holders and service users. In particular, we investigate the technical opportunities to model and describe this borderline. Ideally, these techniques would allow each party to express their preferences and to settle the conflict with a solution that is satisfactory to both. Legal and organizational measures such as the one undertaken in [EU, 1995; EU, 2002] are important complements to technical measures, but are outside the scope of this work. For a detailed discussion, see [Ackerman, et al., 1999; Spiekermann, et al., 2001].

We will define a service-oriented framework to classify different types of privacy problems such as the cancer research case above. By service, we mean the storing or processing of confidential input data. In particular, we distinguish between a two-party case and a three-party case (see Figure 1-2).

The two-party case only involves the data holder and the service provider that uses and processes the input data to deliver the desired service result (see Figure 1-2 (a)). In the healthcare domain, a web-based service could be a personal health check based on input data such as age, gender, cholesterol, blood pressure and habits (e.g., smoking or sports activities). In this case, the data holder is the service user at the same time. The data holder may have the following concerns:

• The service provider forwards confidential data to an untrusted third party.

• The provider's database is subject to an external attack.

• The provider's staff is incompetent or bribed.

• Bankruptcy of the provider leads to uncertainty about data ownership.

We address these issues by presenting a new kind of service architecture. We make use of a specific class of encryption functions first introduced by [Rivest, et al., 1978] that allows the data holder to use a service without actually transferring plain input data to the service provider. We elaborate in which contexts the architecture may be employed and give a computational analysis for particular services.

Figure 1-2: Two important cases of interaction between data holder and service user

In the three-party case, the data holder is not necessarily the same person as the service user. To give an example, the data holders may be the patients whose primary care data is given to a service provider. This service provider must ensure the confidentiality of patient data e.g. by anonymizing single data sets or by removing data attributes that are particularly critical before giving it to the actual service users, the medical researchers (see Figure 1-2(b)). The main privacy concerns on behalf of the data holders are the following in this case:

• Their confidential health information can be inferred from the data that is given to the public service users.

• The service provider cannot be trusted.

• Their confidential data is forwarded to an untrusted third party.

We present a mediator-based architecture based on [Wiederhold, et al., 1996] that advocates these concerns on behalf of the data holder. We introduce an "audit & aggregate" methodology that protects the privacy of the data holders and, at the same time, maximizes the utility of the released data to prospective service users.

A commonality of the two- and the three-party-case is that the outcome of the service is directly related to the amount of private information provided by the data holders. The more accurate and rich the provided private information, the higher the quality of the provided service. Not all data holders are aware of this trade-off and for lack of knowledge tend to the extremes, i.e. provide no data or provide it all

According to [Ackerman et al., 1999], 17% of all online users are "privacy fundamentalists" who will not provide data to a web site even if privacy protection measures are in place. 27% are "marginally concerned" and generally willing to provide data to web sites without major concerns.

The specific contributions of this thesis are the following:

• Privacy classification of service architecturesWe present a classification of different service architectures with regard to privacy protection issues. For each class, we name examples of practical applications and explain the relevance by discussing preceding cases of real-world privacy violations.

• Design, analysis and implementation of an encryption-based service architecture in an untrusted two-party environmentWe analyze the foundations of trust in web-based services and point out cases where trust in the service provider is not enough e.g. for legal requirements. For these cases, we derive a new privacy-preserving architecture that is based on an adapted encryption algorithm. We map important database and arithmetic operations from plain data to encrypted data, and we present sample services that can be carried out within the framework. We evaluate our approach with regard to memory and performance requirements and we propose different implementation methods.

• Design, analysis and implementation of an aggregation-based service architecture in an untrusted three-party environmentBased on a privacy-compromising health report as a running example, we show how tight intervals for confidential data fields can be derived from non-critical aggregated data. We propose a new class of privacy mediators that settle the conflict between data holders and service users. A core component is the "audit & aggregate" methodology that detects and limits this kind of disclosure called interval inference.

• Quantification of the privacy trade-off and implications for electronic commerce and public policy
  We analyze several frameworks to quantify the trade-off between data holders and service users. We also discuss the implications of this trade-off for electronic commerce and public policy.

The rest of this thesis is structured as follows.

Chapter 2 gives a classification of privacy problems in service architectures. We introduce the terminology and point to relevant related work. We also name occurrences of privacy issues in real-world information systems.

Chapter 3 discusses the case of the 2-party service architecture. We introduce a service provided by an Application Service Provider (ASP) as a running example. We then propose a privacy-preserving architecture that allows a service user to carry out a limited number off services on encrypted data.

Chapter 4 is concerned with the 3-party case. We use a regional healthcare initiative that collects, analyzes and disseminates chronic disease data as a running example. We derive several privacy problems and introduce a model that captures the case where tight bounds can be inferred on confidential values. We propose two new methods that limit this kind of privacy breach. These methods are implemented and compared to competing methods.

In Chapter 5, we extensively discuss the trade-off idea and ways to quantify it. We also discuss implications for electronic and public policy. We conclude in Chapter 6 with a summary and an outlook on future research. A sketch of this structure is captured in Figure 1-3.

Excerpts of Chapter 3 have been published in [Boyens and Fischmann, 2003; Boyens and Günther, 2002; Boyens and Günther, 2003]. Parts of Chapter 4 have been published in [Boyens and Günther, 2004; Boyens, et al., 2004; Boyens and Padman, 2003].

Figure 1-3: Structure of the dissertation