Keeping our data safe: the role of multiparty computation

“One of the most amazing things of our time” says Yehuda Lindell, professor of Cyber Security at the Bar-Ilan University in Israel, “is that we pay for services not using money, but giving away our valuable personal information, and in exchange for that we also receive 'personalised advertisements', which is something we don't even want”. The crucial aspect, for Prof Lindell, is that the personal data we so happily give away are a very precious and sensitive possession, one that we could regret losing. “There is a difference between privacy and security. If I am the subject of a security breach, for example having some money stolen from my credit card, I can easily block it and ask for a refund. I cannot do the same when my privacy is violated. Once my personal life is out there, I can never take it back. This is why it is so important to devise secure ways of sharing our data without endangering our privacy”.

Professor Lindell is the winner of two ERC grants as well as a Proof of Concept grant on the topic of cybersecurity. In particular, he worked on Multiparty Computation, often abbreviated as MPC, a specific cryptographic method to perform computation between different databases without having to reveal the data itself. He is among the founders of a cybersecurity company, "Unbound Tech", together with the ERC grantee Nigel Smart, Professor at the Department of Electrical Engineering of the University of Leuven.

When asked to describe what MPC is, Prof Smart uses an easy anecdote. Imagine having a dinner of investment bankers, very concerned about conserving their privacy. They decide that the one who is earning the most among them should pay for dinner, but they don't want the others to know how much money they are making. Multiparty computation algorithms would allow the bankers to perform the necessary calculation while maintaining secrecy about their actual salaries.

Present applications

There are a number of possible applications of this technology. Being able to store secrets in different locations, rather than in a single place, would make life much harder for a potential intruder. One of the most interesting examples concerns the cryptographic keys that are used, for instance, in securing our communications. If the key is fractionated and each piece is stored in a different container, the bad guy would need to violate all the keepers to obtain the original key. By using multiparty computation, legitimate users could still use relevant information to verify the legitimacy of the operation. Other applications might include research institutions working on sensitive data, such as hospitals collaborating on medical trials.

“Combining databases owned by different entities might be very useful, but it involves serious security issues.” says Claudio Orlandi, associate professor in the Crypto group at Aarhus University and winner of an ERC grant.

MPC can solve these security problems, but the price to pay is in terms of the time required to perform the computation. Despite the dramatic increase in the efficiency of the algorithms in the last decade, performing multiparty computation on a set of data can still be tens of times slower than doing a joint operation on unprotected data. For this reason, up to now, MPC is best suited to perform one-time statistics, and cannot directly be implemented in search engines or other system that require rapidity.

From pure research to commercial development

Multiparty computation is a very hot topic in research, and has already been translated into commercial applications. “The world of academia and the one of corporations have differences. In academia a researcher is interested in answering hard fundamental questions, which are likely to have a long-term impact, and which can be rather specific. A company has instead to address problems of its clients in the present, not necessarily hard but pressing. And the solution has to be general and flexible.” explain the researchers.

Prof Smart believes that “The ERC funding scheme is very good in providing researchers with large freedom of doing research and also the freedom to collaborate with other stakeholders, including private ones. This makes it much easier to get a grasp of what is needed in the market.” The Proof of Concept grant is an additional fund that is devised to bring academic results closer to applications. According to prof. Lindell “it was just what I needed to get the first working product prototype, and to do market research. These are essential steps one should complete before going to sponsors.”

Cybersecurity and society

The era of the teen-in-a-garage hacker is long past. Nowadays, the actors are completely different, and much more powerful. Countries and large corporations accumulate huge amount of data on citizens, not always with a legitimate purpose. Authoritarian regimes have larger capabilities to influence their opposition and to have a more pervasive grip on power. Fake news can be used by political parties to target specific groups to maximise their impact. Even legitimate companies, such as Facebook or Google, base their incomes on the data of their users, and are not always transparent on how these data are used and shared.

Our societies are becoming more and more aware of the importance of keeping our data safe, and the EU is working to better regulate the matter. “The GDPR is an important step in the direction of protecting our sensitive information”, says Prof Lindell, “especially because it dictates that someone has to be held responsible for the confidentiality of our data. It makes much less advantageous for a company to avoid precautions against leaks and intrusions, because there are consequences”. Funding public research on the matter is also very important. “Corporations are interested in making profit, and that’s their primary concern. The interests of our society are not necessarily aligned with the ones of large companies, and that’s where a public action becomes relevant.”

On the other hand, data protection can make it more difficult to investigate crimes, or to anticipate terror attacks. “Some policymakers see cryptography more as an obstacle than something vital for our democracies, because it helps bad guys hide”, remarks Prof Orlandi, “but anyone would agree that some information have to be kept private, such as the school your kids attend, or your medical history. As a minimum, we cannot allow anyone to have access to all our information.”

The field of cybersecurity advances extremely fast. The researchers agree that the last decade brought a much faster evolution that they would have predicted. To be effective, legislators have to be up-to-date with the last technological developments. “Sometimes legislators come a bit late to the matter”, says Prof Smart, “and they end up being ineffective or, worse, counterproductive. It is crucial that they collaborate closely with the experts in the field if we want a better protected society.”