Bidirectional Privacy Preservation in Web Services

In web-based services, users are often required to submit personal data, which may be shared with third parties. Although privacy regulations mandate the disclosure of intended recipients in privacy policies, this does not fully alleviate users’ privacy concerns. The presence of a privacy policy does not ensure compliance, since users must assess the trustworthiness of all parties involved in data sharing. On the other hand, service providers want to minimize the costs associated with preserving user privacy. Indeed, service providers may have their own privacy preservation requirements, such as hiding the identities of third-party suppliers. We present a novel framework designed to tackle the dual challenges of bidirectional privacy preservation and cost-effectiveness. Our framework safeguards the privacy of service users, providers, and various layers of intermediaries in data-sharing environments, while also reducing the costs incurred by service providers related to data privacy. This combination makes our solution a practical choice for web services. We have implemented our solution and conducted a performance analysis to demonstrate its viability. Additionally, we prove its privacy and security within a Universal Composability (UC) framework.