Preserving privacy in data outsourcing

Privacy requirements have an increasing impact on the realization of modern applications. Commercial and legal regulations demand that privacy guarantees be provided whenever sensitive information is stored, processed, or communicated to external parties. Current approaches encrypt sensitive data, thus reducing query execution efficiency and preventing selective information release. In this thesis, we present a comprehensive approach for protecting highly sensitive information when it is stored on systems that are not under the data owner's control. Our approach combines access control and encryption, enforcing access control via structured encryption. Our solution, coupled with efficient algorithms for key derivation and distribution, provides efficient and secure authorization management on outsourced data allowing the data owner to outsource not only the data but the security policy itself. To reduce the amount of data to be encrypted we also investigate data fragmentation as a possible way to protect privacy of data associations and provide fragmentation as a complementary means for protecting privacy: associations broken by fragmentation will be visible only to users authorized (by knowing the proper key) to join fragments. We finally investigate the problem of executing queries over possible data distributed at different servers and which must be controlled to ensure sensitive information and sensitive associations be visible only to parties authorized for that.