Blind Custodians: A Database Service Architecture That Supports Privacy Without Encryption

Abstract. We describe an architecture for a database service that does not assume that the service provider can be trusted. Unlike other ar-chitectures that address this problem, this architecture, which we call blind custodians, does not rely on encryption. Instead, it offers confi-dentiality by means of information dissociation: The server only stores “fragments ” of information that are considered safe (i.e., each fragment does not violate privacy), while the client stores the associations be-tween the fragments that are necessary to reconstruct the information. We argue that this architecture allows satisfactory confidentiality, while offering two important advantages: (1) It does not restrict the types of queries that can be submitted by clients (as encryption-based methods invariably do), and (2) it requires only light processing at the client, assigning the bulk of the processing to the server (as befits a true ser-vice). Moreover, the architecture permits flexible control over the level of confidentiality that should be maintained (at the cost of additional overhead).