Security and Privacy for Emerging ICT Platforms

信息和通信技术（ICT）平台构成了我们在线互动的基础。存储和处理我们数据的云服务器以及我们用来与它们通信的网络处理了大量有关我们生活各个方面的信息。2018年5月，蒙特利尔银行和CIBC数万名客户的数据遭到大规模盗窃和滥用，2018年9月，近5000万Facebook用户的数据遭到大规模盗窃和滥用（仅举两个例子），这一点已经非常明显了。许多），这些平台的安全性和隐私往往缺乏。如果没有技术改进来增强网络和存储安全性并提供定制功能而不暴露私人用户信息，个人和敏感数据的收集仍然盛行，违规行为继续对用户和公司造成严重破坏。当今的信通技术平台使用基本的加密技术来保护存储和传输中的数据，但不保护元数据。这使得用户容易受到收集位置和浏览历史等私人信息的攻击，并且使通信容易受到流量分析和审查。 此外，虽然私有数据可能在存储中被加密，但在公司或云服务将其用于分析目的或向用户提供定制功能之前，需要对其进行解密。我们与加拿大皇家银行（RBC）网络安全研究实验室的合作伙伴合作，将目光从当前的部署转向新兴一代ICT平台。 我们的工作将使RBC客户，无论是在国内还是在国外旅行，都能安全和私密地访问RBC服务，而不会将数据或元数据泄露给可能敌对或竞争的政府或互联网提供商。 我们还将通过安全的计算技术为RBC客户提供个性化服务，这些技术不需要RBC收集或存储客户的私人信息，至少不需要以未加密的形式，从而消除了这些信息在数据泄露中意外泄露的可能性。

Information and communication technology (ICT) platforms form the basis of our interactions online. The cloud servers that store and process our data and the networks we use to communicate with them handle a large amount of information about all aspects of our lives. As has been all too apparent with news about large-scale theft and abuse of data from tens of thousands of Bank of Montreal and CIBC customers in May 2018 and nearly 50 million Facebook users in September 2018 (as two examples among a great many), the security and privacy of these platforms is often lacking. Without technological improvements that enhance network and storage security and provide customized functionality without exposing private user information, collection of personal and sensitive data remains rife and breaches continue to wreak havoc on users and companies alike. Today's ICT platforms use basic encryption techniques to protect data in storage and in transit, but do not protect metadata. This leaves users vulnerable to the collection of private information such as location and browsing history, and it leaves communications vulnerable to traffic analysis and censorship. Furthermore, although private data may be encrypted in storage, it needs to be decrypted before the company or cloud service can use it for analysis purposes or to provide customized functionality to users.Working with our partners at the Royal Bank of Canada (RBC)'s Cybersecurity Research Lab, we look beyond current deployments to the emerging generation of ICT platforms. Our work will allow RBC customers, whether at home or travelling abroad, to securely and privately access RBC services without leaking data or metadata to possibly hostile or competing governments or Internet providers. We will also create the ability to offer personalized services to RBC customers through secure computation techniques that do not require RBC to ever collect or store customers' private information, at least not in unencrypted form, thus eliminating the possibility of that information being inadvertently leaked in a data breach.