鲁棒、隐私保护、透明且可审计的端上黑名单机制
Robust, privacy-preserving, transparent, and auditable on-device blocklisting
AI总结：
本文提出两种端上黑名单协议，结合隐私集合交集、密码学哈希、签名与 Merkle 包含证明，实现隐私保护、鲁棒、透明且可审计的有害对象判断，为端上保护提供关键第一步。
摘要：
随着端到端加密的加速普及，我们有机会以符合新隐私期望的方式重新设计安全和反滥用机制。本文提出了两种端上黑名单新协议，允许客户端根据所谓远程执行者掌握的威胁信息，以隐私保护和可信的方式判断对象（如 URL、文档、图像等）是否有害。我们的协议结合了多种技术：利用隐私集合交集促进隐私，利用密码学哈希确保对误报的鲁棒性，利用密码学签名提高透明度，并利用 Merkle 包含证明确保一致性和可审计性。我们对两种协议——一种时间高效，另一种空间高效——进行了基准测试，以展示其在电子邮件、消息传递、存储等应用中的实用性。我们还强调了剩余的挑战，例如日志记录或报告中存在的隐私与审查之间的矛盾。我们认为，这项工作是推动多方利益相关者就如何最好地提供端上保护进行复杂讨论的关键第一步。
英文摘要：
With the accelerated adoption of end-to-end encryption, there is an opportunity to re-architect security and anti-abuse primitives in a manner that preserves new privacy expectations. In this paper, we consider two novel protocols for on-device blocklisting that allow a client to determine whether an object (e.g., URL, document, image, etc.) is harmful based on threat information possessed by a so-called remote enforcer in a way that is both privacy-preserving and trustworthy. Our protocols leverage a unique combination of private set intersection to promote privacy, cryptographic hashes to ensure resilience to false positives, cryptographic signatures to improve transparency, and Merkle inclusion proofs to ensure consistency and auditability. We benchmark our protocols -- one that is time-efficient, and the other space-efficient -- to demonstrate their practical use for applications such as email, messaging, storage, and other applications. We also highlight remaining challenges, such as privacy and censorship tensions that exist with logging or reporting. We consider our work to be a critical first step towards enabling complex, multi-stakeholder discussions on how best to provide on-device protections.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
