Presentation from Cloud Computing Demystified

1. 1

2. Secure Multiparty Computation or: How I learned to stop worrying and love the cloud Jakob I. Pagter Alexandra Instituttet A/S

4. Non-profit

5. Owned by members

6. Apx. 50 companies and public institutions

7. Apx. 100 employees and growing fast

8. www.alexandra.dkBusiness development Interactive Spaces Security New Ways of Working Software Pervasive Positioning Computer Graphics Pervasive Healthcare

9. What is… Secure Multiparty Computation (SMC) Cloud Computing Cheap (economies of scale/pay-by-the-drink) Elastic Innovation catalyst Maybe more secure…? Working on encrypted data 30 years old news Not science fiction Slow Simplifying security policies

10. (Some) attack vectors in the cloud Outsiders Platform/provider Insiders Neighbours

11. Rasing the confidentiality bar

12. Shallow Cloud Confidentiality Loss of strong confidentiality Loss of cloud benefits web server.. Computation: decrypted! ?! Storage: encrypted Local computation

13. Deep Cloud Confidentiality web server.. Computation: encrypted! Storage: encrypted

14. SMC and Deep Confidentiality Pros Cons Strong confidentiality – all the way Secure Simple Efficient Performance Special purpose computations only Introduces overhead (cost) Find setups where these are properly balanced! (not necessarily easy…)

17. Collusion

20. daily peak in heavy computations (due to SMC)

21. elasticity ensures

22. that induced cost overhead is minimal

23. We can handle performance requirements

24. deep confidentiality => secure, simple, efficientThe right balance!

25. SMC Example: private DB “joins” Insurance company National health register Desirable outcome

26. SMC Example: private information retrieval Blood sample Result encrypted and shared Analysis Query result QUERY Only the patient knows query and result RESULT Anonymous computation

27. SMC Example: storage (not really SMC, but hey…) http://allmydata.org/source/tahoe/trunk/docs/about.html

28. SMC: Work-in-progress Ongoing research CACE COBE CFEM www.cfem.dk Public kick-off October 13-15

30. Eksempel: auktionpåfølsomme data CSP-2 web-server (CSP-1) DB DB SMC DB CSP-3 Java-applet Krypteret bud DB CSP-4 byder budafgivning beregning på krypterede data!

32. Eksemplerpåtrusler Oktober 2007/salesforce.com Spearphishing mod ansat Kundedata udleveret Adgang til kundedata, bla. fra en række banker http://voices.washingtonpost.com/securityfix/2007/11/salesforcecom_acknowledges_dat.html November 2009/ACM CCS: Angreb på Amazon AWS Placere deres system på udvalgt hardware Aflure fortrolige data via hypervisor. Amazon har rettet det problem