PrivacyGuard: Enforcing Private Data Usage Control with Blockchain and Attested Off-chain Contract Execution

TL;DR

PrivacyGuard is a system that combines blockchain smart contracts and trusted execution environments to give individuals control over their private data, ensuring secure, auditable, and efficient data usage policies and analytics.

Contribution

The paper introduces PrivacyGuard, a novel system integrating off-chain TEE-based contract execution with blockchain to enhance privacy and efficiency in data usage control.

Findings

PrivacyGuard effectively enforces data usage policies.

Supports analytics on data from many owners.

Maintains privacy while providing auditability.

Abstract

The abundance and rich varieties of data are enabling many transformative applications of big data analytics that have profound societal impacts. However, there are also increasing concerns regarding the improper use of individual data owner's private data. In this paper, we propose PrivacyGuard, a system that leverages blockchain smart contract and trusted execution environment (TEE) to enable individual's control over the access and usage of their private data. Smart contracts are used to specify data usage policy, i.e., who can use what data under which conditions and what analytics to perform, while the distributed blockchain ledger is used to keep an irreversible and non-repudiable data usage record. To address the efficiency problem of on-chain contract execution and to prevent exposing private data on the publicly viewable blockchain, PrivacyGuard incorporates a novel TEE-based off-chain contract execution engine along with a protocol to securely commit the execution result onto blockchain. We have built and deployed a prototype of PrivacyGuard with Ethereum and Intel SGX. Our experiment result demonstrates that PrivacyGuard fulfills the promised privacy goal and supports analytics on data from a considerable number of data owners.