[Paper Review] VAMS: Verifiable Auditing of Access to Confidential Data

Alexander Hicks, Vasilios Mavroudis+3 more|arXiv (Cornell University)|May 12, 2018

Privacy-Preserving Technologies in Data78 references3 citations

TL;DR

VAMS is a verifiable auditing system that enables transparent, privacy-preserving audits of access to confidential data through tamper-evident logging, user-specific log tagging, and MultiBallot—a novel extension of ThreeBallot for publicly verifiable statistics with low privacy loss. Evaluation shows both Hyperledger Fabric and Trillian implementations are practical for real-world use cases like healthcare and law enforcement data access.

ABSTRACT

We propose VAMS, a system that enables transparency for audits of access to data requests without compromising the privacy of parties in the system. VAMS supports audits on an aggregate level and an individual level, by relying on three mechanisms. A tamper-evident log provides integrity for the log entries that are audited. A tagging scheme allows users to query log entries that relate to them, without allowing others to do so. MultiBallot, a novel extension of the ThreeBallot voting scheme, is used to generate a synthetic dataset that can be used to publicly verify published statistics with a low expected privacy loss. We evaluate two implementations of VAMS, and show that both the log and the ability to verify published statistics are practical for realistic use cases such as access to healthcare records and law enforcement access to communications records.

Motivation & Objective

• To address the lack of transparency and trust in audits of access to sensitive data, such as healthcare records and communications metadata.
• To ensure audit integrity without compromising the privacy of individuals or the justification for data access.
• To enable both aggregate-level and individual-level audits that are publicly verifiable and tamper-evident.
• To support continuous, reusable access to data for auditing without depleting privacy budgets, unlike differential privacy approaches.
• To provide a lightweight, extensible overlay system that integrates with existing data workflows without replacing core components.

Proposed method

• Utilizes a tamper-evident log to ensure the integrity of audit records, preventing unauthorized modification.
• Employs a log entry tagging scheme that allows users to privately retrieve entries relevant to them without exposing other entries.
• Introduces MultiBallot, a novel adaptation of the ThreeBallot voting scheme, to generate a synthetic dataset for public verification of published statistics.
• Employs a rule-based mechanism in MultiBallot to allow public verification of aggregate statistics while minimizing expected privacy loss.
• Supports both Hyperledger Fabric and Trillian as underlying log implementations to evaluate scalability and functionality.
• Designs the system as a lightweight overlay that can be integrated with existing data access workflows without requiring changes to core systems.

Experimental results

Research questions

• RQ1 How can access to confidential data be audited transparently while preserving the privacy of individuals and the justification for access?
• RQ2 Can a system provide publicly verifiable aggregate statistics on data access without revealing sensitive information beyond what is intentionally disclosed?
• RQ3 How can individual users verify that their own data access requests are correctly logged and audited?
• RQ4 What mechanisms can ensure the integrity of audit logs without relying on trusted third parties?
• RQ5 Can a system support repeated, unconstrained use of data for auditing without depleting privacy budgets, unlike differential privacy?

Key findings

• VAMS successfully enables both aggregate and individual-level audits that are publicly verifiable, ensuring transparency without compromising privacy.
• The tamper-evident log mechanism ensures that any modification to audit entries is detectable, preserving audit integrity.
• The log entry tagging scheme allows users to efficiently and privately retrieve entries related to their own data access requests.
• MultiBallot enables public verification of published statistics with only a small expected privacy loss, making it suitable for real-world use.
• Evaluations on Hyperledger Fabric and Trillian demonstrate that VAMS is scalable and efficient enough for practical deployment in healthcare and law enforcement contexts.
• Unlike differential privacy schemes, VAMS does not deplete a privacy budget, allowing unlimited reuse of data for auditing without compromising utility or privacy.