  We consider user-private information retrieval (UPIR), an interesting
alternative to private information retrieval (PIR) introduced by Domingo-Ferrer
et al. In UPIR, the database knows which records have been retrieved, but does
not know the identity of the query issuer. The goal of UPIR is to disguise user
profiles from the database. Domingo-Ferrer et al.\ focus on using a
peer-to-peer community to construct a UPIR scheme, which we term P2P UPIR. In
this paper, we establish a strengthened model for P2P UPIR and clarify the
privacy goals of such schemes using standard terminology from the field of
privacy research. In particular, we argue that any solution providing privacy
against the database should attempt to minimize any corresponding loss of
privacy against other users. We give an analysis of existing schemes, including
a new attack by the database. Finally, we introduce and analyze two new
protocols. Whereas previous work focuses on a special type of combinatorial
design known as a configuration, our protocols make use of more general
designs. This allows for flexibility in protocol set-up, allowing for a choice
between having a dynamic scheme (in which users are permitted to enter and
leave the system), or providing increased privacy against other users.
