Enhancing Privacy in Cookieless Web Advertising : A Comparative Study of Multi-Party Computation and Trusted Execution Environment Solutions for Private Attribution Reporting

Sammanfattning: The end of third-party cookies has driven the advertising market to seek new solutions. Third-party cookies were widely used to track users’ online activities across websites. However, the growing concern for privacy has led web browsers to put an end to this practice. In this thesis, we explore two potential solutions for private attribution reporting - Multi-Party Computation (MPC) and Trusted Execution Environment (TEE). Attribution reporting is used by advertisers to measure the effectiveness of a marketing campaign. The underlying process requires identifying which advertisement led to a conversion. To test and compare these two technologies, we used the Interoperable Private Attribution (IPA) research prototype developed by Benjamin Case et al. for MPC, and developed our own models for TEE using Intel-SGX. Our TEE models have two distinct approaches: the first model uses EdgelessDB, a SQL database stored inside a secure enclave, which offers a high level of abstraction and flexibility for advertisers. The second model employs Gramine, a library that enables the compilation and execution of code inside a secure enclave. In this solution, the code is written in C and the input data is stored in an encrypted file. We compared the time performance and the security of these models. According to our results, the Gramine model is faster than the other models. Additionally, the security provided by IntelSGX, although dependent on a high level of trust in Intel services, is better than the security offered by an MPC protocol. Based on our tests, TEE is a better solution for attribution reporting. Nevertheless, MPC is a rapidly evolving technology, and new algorithms have been developed our tests. Further testing with a new implementation of MPC could be a potential avenue for future work.