Secure Data Preservers for Web Services

The authors examine a novel proposal wherein a user who hands off her data to a web service has complete choice over the code and policies that constrain access to her data. Such an approach is possible if the web service does not require raw access to the user's data to implement its functionality; access to a carefully chosen interface to the data suffices. Their data preserver framework re-architects such web services around the notion of a preserver, an object that encapsulates the user's data with code and policies chosen by the user.