Security and Privacy for Emerging ICT Platforms

信息通信技术（ICT）平台构成了我们在线互动的基础。存储和处理我们数据的云服务器，以及我们用来与之通信的网络，处理着我们生活方方面面的大量信息。2018年5月，蒙特利尔银行（Bank of Montreal）和加拿大帝国商业银行（CIBC）数万名客户的数据被大规模盗窃和滥用，2018年9月，近5000万Facebook用户的数据被大规模盗窃和滥用（这是众多案例中的两个例子），这些平台的安全性和隐私性往往缺乏。如果没有技术改进来增强网络和存储安全性，并在不暴露私人用户信息的情况下提供定制功能，个人和敏感数据的收集仍然普遍存在，违规行为将继续对用户和公司造成严重破坏。今天的ICT平台使用基本的加密技术来保护存储和传输中的数据，但不保护元数据。这使得用户很容易受到诸如位置和浏览历史等私人信息收集的影响，也使得通信容易受到流量分析和审查的影响。此外，尽管私有数据可能在存储中加密，但在公司或云服务将其用于分析目的或为用户提供定制功能之前，需要对其进行解密。通过与加拿大皇家银行（RBC）网络安全研究实验室的合作伙伴合作，我们将目光从目前的部署转向新兴一代ICT平台。我们的工作将使加拿大皇家银行的客户，无论是在国内还是在国外旅行，都能安全、私密地访问加拿大皇家银行的服务，而不会将数据或元数据泄露给可能怀有敌意或竞争的政府或互联网提供商。我们还将创造通过安全计算技术为RBC客户提供个性化服务的能力，而不需要RBC收集或存储客户的私人信息，至少不会以未加密的形式，从而消除在数据泄露中无意中泄露信息的可能性。

Information and communication technology (ICT) platforms form the basis of our interactions online. The cloud servers that store and process our data and the networks we use to communicate with them handle a large amount of information about all aspects of our lives. As has been all too apparent with news about large-scale theft and abuse of data from tens of thousands of Bank of Montreal and CIBC customers in May 2018 and nearly 50 million Facebook users in September 2018 (as two examples among a great many), the security and privacy of these platforms is often lacking. Without technological improvements that enhance network and storage security and provide customized functionality without exposing private user information, collection of personal and sensitive data remains rife and breaches continue to wreak havoc on users and companies alike. Today's ICT platforms use basic encryption techniques to protect data in storage and in transit, but do not protect metadata. This leaves users vulnerable to the collection of private information such as location and browsing history, and it leaves communications vulnerable to traffic analysis and censorship. Furthermore, although private data may be encrypted in storage, it needs to be decrypted before the company or cloud service can use it for analysis purposes or to provide customized functionality to users.Working with our partners at the Royal Bank of Canada (RBC)'s Cybersecurity Research Lab, we look beyond current deployments to the emerging generation of ICT platforms. Our work will allow RBC customers, whether at home or travelling abroad, to securely and privately access RBC services without leaking data or metadata to possibly hostile or competing governments or Internet providers. We will also create the ability to offer personalized services to RBC customers through secure computation techniques that do not require RBC to ever collect or store customers' private information, at least not in unencrypted form, thus eliminating the possibility of that information being inadvertently leaked in a data breach.