Embed Size (px)
DESCRIPTION
Technical Aspects of Privacy . Prof. Dr. Michael Waidner Director, Fraunhofer SIT and CASED Professor, TU Darmstadt, CSc /CASED/Security in IT. Conference on Security of eGovernment Brussels, European Parliament, February 19, 2013. Other services. Five Technical Privacy Challenges. - PowerPoint PPT Presentation
Citation preview
© Fr
aunh
ofer
-Ges
ellsc
haft
2013
Technical Aspects of Privacy Prof. Dr. Michael Waidner Director, Fraunhofer SIT and CASEDProfessor, TU Darmstadt, CSc/CASED/Security in IT
Conference on Security of eGovernmentBrussels, European Parliament, February 19, 2013
Page 2
© Fr
aunh
ofer
-Ges
ellsc
haft
2013
Outline
1. Five Technical Privacy Challenges
2. Four Examples of Crypto for Privacy
3. Recommendations
Page 3
© Fr
aunh
ofer
-Ges
ellsc
haft
2013
Five Technical Privacy Challenges
Network
Service
Other users
4. ContextContext violation
1. Data Minimization
Avoidable digital traces vis-à-vis
Service and vis-à-vis Network
2. PurposePurpose violation
Other services
3. Control Lack of
knowledge Incorrect data Unauthorized
data Persistency5. Anonymous
aggregated and inferred data(Re-)identification, continuum of personal date – anonymous data
User
http://www.sit.cased.de/fileadmin/user_upload/Group_SIT/Publications/120227a_GhSW_12.pdf
Page 4
© Fr
aunh
ofer
-Ges
ellsc
haft
2013
Outline
1. Five Technical Privacy Challenges
2. Four Examples of Crypto for Privacy
3. Recommendations
Page 5
© Fr
aunh
ofer
-Ges
ellsc
haft
2013
Crypto 1: Encryption for Confidentiality and Erasure
Ready, widely deployed(but not always used and understood correctly)
Data encrypted on disk/tapeDeleting key = Erasing data
User ServiceBackup
http://www.sit.fraunhofer.de/en/fields-of-expertise/projects/omnicloud.html
Page 6
© Fr
aunh
ofer
-Ges
ellsc
haft
2013
Crypto 2: Privacy-preserving Attribute-Based Credentials (ABC) Issuer
User RelyingParty
IBM Identity Mixer (Damgård ... Camenisch, Lysyanskaya 2001)Microsoft UProve (Chaum ... Brands 1999)
Efficient Mature (>10 years) Smartcard-ready Limited commercial
availability
Ready for commercial use
Page 7
© Fr
aunh
ofer
-Ges
ellsc
haft
2013
Crypto 3: Crypto + HW for Privacy-preserving Computations
ObliviAd (Backes, Kate, Maffei, Pecina, 2013)
Ready for prototyping
Page 8
© Fr
aunh
ofer
-Ges
ellsc
haft
2013
Crypto 4: Extending Control “Into the Cloud”
enc(data)
enc(F(data))
Computes enc(F(data)) without the ability to decrypt enc(data).
Most recent breakthrough: Fully Homomorphic Encryption (Gentry, 2008)
Ready for small and special casesNeeds more research
Page 9
© Fr
aunh
ofer
-Ges
ellsc
haft
2013
Outline
1. Five Technical Privacy Challenges
2. Four Examples of Crypto for Privacy
3. Recommendations
Page 10
© Fr
aunh
ofer
-Ges
ellsc
haft
2013
Proposed EU Regulation is an Important Step Forward
1. Demonstrate positive impact on innovation and prosperity Inventory of business ideas and capabilities supporting
privacy2. Mandate and enable informed consent Automation: Privacy Agents Transparency: personal data management,
automated analysis and nutrition labels, incident disclosure
Fair and demonstrably justified preauthorization
3. Eroding difference between personal & anonymized data Consider final impact on individual
4. Privacy by Design needs specificity Use cases, ref architectures,
design tools
http://www.zeit.de/digital/datenschutz/2013-02/stellungnahme-datenschutz-professoren/komplettansicht
Page 11
© Fr
aunh
ofer
-Ges
ellsc
haft
2013
Many Open Questions in Need of Research and Development
Network
Service
Other users
4. ContextContext violation
1. Data Minimization
Avoidable digital traces vis-à-vis Service and vis-à-vis Network
2. PurposePurpose violation
Other services
3. Control Lack of
knowledge Incorrect data Unauthorized
data Persistency5. Anonymous
aggregated and inferred data(Re-)identification, continuum of personal date – anonymous data
User
Page 12
© Fr
aunh
ofer
-Ges
ellsc
haft
2013
Fraunhofer Institute for Secure Information Technology (SIT)Rheinstrasse 7564295 Darmstadtwww.sit.fraunhofer.de
Technical University of DarmstadtDepartment of Computer Science (FB20),Chair for Security in IT (FG SIT)Mornewegstrasse 3064289 Darmstadtwww.sit.tu-darmstadt.de
Prof. Dr. Michael [email protected]
