The InterPlanetary File System (IPFS) is a peer-to-peer network for storing data in a distributed file system, hosting over 190,000 peers spanning 152 countries. Despite its prominence, the privacy properties that IPFS offers to peers are severely limited. Any query within the network leaks the queried content to other peers. We address IPFS’ privacy leakage across three functionalities (peer routing, provider advertisements, and content retrieval), ultimately empowering peers to privately navigate and retrieve content in the network. Our work highlights and addresses novel challenges inherent to integrating PIR into distributed systems. We present our new, private protocols and demonstrate that they incur reasonably low communication and computation overheads. We also provide a systematic comparison of state-of-art PIR protocols in the context of distributed systems.

Censorship circumvention tools enable clients to access endpoints in a network despite the presence of a censor. Censors use a variety of techniques to identify content they wish to block, including filtering traffic patterns that are characteristic of proxy or circumvention protocols and actively probing potential proxy servers. Circumvention practitioners have developed fully encrypted protocols (FEPs), intended to have traffic that appears indistinguishable from random. A FEP is typically composed of a key exchange protocol to establish shared secret keys, and then a secure channel protocol to encrypt application data; both must avoid revealing to observers that an obfuscated protocol is in use.

Private data collection systems such as Prio ensure data privacy by distributing trust among a set of mutually trusted parties, to allow for aggregate data collection without disclosing any single client's data in the clear. While systems like Prio are undergoing widespread interest and adoption, these systems lack efficient mechanisms to provide differential privacy guarantees. In this work, we present a lightweight method that we call DPrio to augment Prio and related systems with differential privacy assurances while ensuring higher data utility than existing noise generation protocols. We compare our results against four related constructions in the literature, and identify how DPrio achieves improved data utility relative to the assumed number of dishonest clients and servers, with only minimal (and batchable) server communication overhead. We present several case studies and discuss considerations for real-world implementations.

Key-value data is a naturally occurring data type that has not been thoroughly investigated in the local trust model. Existing local differentially private (LDP) solutions for computing statistics over key-value data suffer from the inherent accuracy limitations of each user adding their own noise. Multi-party computation (MPC) maintains better accuracy than LDP and similarly does not require a trusted central party. However, naively applying MPC to key-value data results in prohibitively expensive computation costs. In this work, we present selective multi-party computation, a novel approach to distributed computation that leverages DP leakage to efficiently and accurately compute statistics over key-value data. By providing each party with a view of a random subset of the data, we can capture subtractive noise. We prove that our protocol satisfies pure DP and is provably secure in the combined DP/MPC model. Our empirical evaluation demonstrates that we can compute statistics over 10,000 keys in 20 seconds and can scale up to 30 servers while obtaining results for a single key in under a second.