Enhancing Privacy Through Unlinkable Data Sharing with User-in-the-Loop Access Control

In our information-driven society, the volume of data generated by individuals has grown significantly. Protecting the privacy of individuals is becoming more challenging, as this data can reveal detailed insights into personal preferences and behavior. To address this challenge, we introduce a user-centric, privacy-preserving data-sharing solution that leverages a central data storage service, hereafter referred to as the data intermediary. By integrating local differential privacy with user-in-the-Ioop access control, our system enables data providers to securely and unlinkably store their data at the intermediary. Data consumers can localize and request data via the intermediary. The data providers are included in access decisions without disclosing their identity nor by enabling the linking of their data. We evaluated our approach using theoretical analysis and simulations. Our findings indicate that our system achieves c-privacy and safeguards data providers against external and internal attackers, malicious data consumers, and an honest-but-curious intermediary. Moreover, our method reduces the message overhead for data discovery in our system by more than half compared to existing approaches.