Future Safe Havens. Jon Crowcroft,

Transcription

1 Future Safe Haves Jo Crowcroft,

2 Private Data Ceter->Public Cloud ATI parters e.g. Farr/NHS Scotlad HSBC Motives for public cloud Scale out/cost save Higher Throughput aalytics Share access with more researchers <Yours goes here>

3 Ifrastructure Locatio Keep frieds&eemies ear: Legal/Regulatory Stuff (icl GDPR) Latecy/Availability etc Cotrol (physical access etc) Need to virtualise these (better) Crypt Data at rest Crypt data durig processig key maagemet etc Eclave SGX,Trust Zoe, AMD, CHERI

4 GDPR 2018 right to a explaaio

5 SGX opportuity Not the oly piece, of course Static/dyamic aalysis etc Uikerels & s/w verificatio Ca use SGX o Cotaier (SCONE) Platform basis, Hadoop, Flik, Spark Or applicatio basis

6 turig.ac.uk ATI w/ Itel, Dstl, Docker, Microsoft Hirig:- Compare what is i SGX Eter/leave cost, crypt memory o/h etc Hypervisor? Compare w/ cotaier o trustzoe, cheri, AMD etc Commo APIs for keys etc Virtualize? Pe test may side chael pb What if weak homomorphic crypto & diff priv?

7 Public Cloud->Databox (or HAT) Databox (ad hat) take opposite view Re-decetralize Keep aalytics/ml as a service Mix of distributed, priv pres ML+ Hierachy of 3 rd party aggregators, MPC HAT reverses directio of value Audit (distributed ledger) Get paid (moey (real or vurt)

8 Cotaier migratio&replica Replicate (to cloud eclave) for recovery (from fail,theft,loss) Migrate (to other persoal cloud) for low latecy Most ew data is apped oly so use distributed ledger (tamper proof logs see datakit i docker) Cosistecy of replicas e.g. use fpaxos

9 Distributed Aalytics Motives e.g. Move code to data Keep data close to ower/primary user Guaratee ca audit trail access Add yours here Challeges Depeds o ML techology of choice & goal PCA/Clusterig, radom forests Curve fittig (regressio etc) Model Iferecig e.g. Bayesia iferece Distrubuted differetial privacy tricky Hierarchical versus P2P?

10 Distributed Aalytics Hierarchy easiest Aggregatio poits/servers broker model leared so far Have to be trusted by subset of leaves Leaf ca choose to chage aggregator P2P just extesio of this to dyamic, faster choice Distributed/Parallel ML From data ceters Clusterig o tuples easy If idepedet

11 Future Proof for GDPR Privacy by Desig ad by Default HAT address all GDPR privacy requiremet from its desig priciple to its security solutio. HAT ecosystem data exchage is based o fully specified privacy terms - time specific, recipiet specific, miimum data poits specific with full itetio disclosed. Violatio agaist ay of such terms may result a ba from the Ecosystem. Coset by desig ad by default - the PCST PoC madates a specific, iformed ad freely give ad uambiguous itesio disclosure of data usage, for every sigle persoal data access istaces. HAT techology esures that a exchage is oly authorised ad kept valid by idividual s case specific coset Rights for Idividuals by desig ad by default ecapsulated persoal data cotaiers isolated for each idividual, allows a idividual is i full cotrol of its HAT, hece iheretly ows all of the followig: Right to Access Right to be iformed Right to rectificatio Right to restrict processig Right to object to market Right of data portability Right to be forgotte Right to object to automated decisio makig ad profilig Accoutability ad goverace - PCST CoP madates every ecosystem member to higher level of accoutability ad goverace practice. Record keepig HAT ecosystem automatically tracks data exchage, eve at a much more graular level tha GDPR requires / it documets the exchage parties, time of access, detailed hatcommuity.org data poits, itesio ad T&C, for every sigle11 trasactio.

12 Thigs we re ot coverig today Database (Farr/ATI work ow) Query plaig w/ privacy K-aoimity Weak homomorphic crypto etc Threat modelig Assumig implicitj Suffice it to say hypervisor vulerabilities exist So eed trusted stuff o utrusted platform o ew trusted stuff

13 Who Am I?