CryptAnalytics: Secure Analytics as Business Services
David Pointcheval
ERC Proof of Concept no 966570
Summary
Big data and data lakes are gold mines for data scientists with tons of applications to finance, medicine, economics, etc. But most of these data are quite sensitive and cannot be widely distributed or even just used without strong protection. One is thus facing the huge dilemma of having to make the choice between highly valuable analytics and privacy. The ERC AdG CryptoCloud project has designed several primitives perfectly well-suited to such situations. They are quite powerful but also highly technical for appropriate deployment at scale. The European start-up Cosmian has been interested in our tools, and we have already started a fruitful collaboration.The main goal of the ERC PoC CryptAnalytics project is to develop a unified platform that will allow dealing with many situations, for secure analytics as business services. This will accelerate the development of Cosmian, giving a major competitive advantage on the fast emerging market of data analytics, with strong privacy guarantees by design. Companies are realizing the incredible value of privacy-preserving analytics. As a result, the number of business use-cases is exploding, but each application is a new challenge in itself, with new kinds of evaluations, new privacy concerns, and different amounts of data.
Members
Principal Investigator
- David Pointcheval
Members
- Théophile Brézot (June 2021 - June 2022)
- Robert Schaedlich (December 2021 - September 2022)
Communications
Publications
2022
- Publisher Version
- Full Version
- Related Material
- Presentation Slides
Implementations
- Decentralized Multi-Client Functional Encryption for Inner Product (GitHub DMCFE)
CryptoCloud: Privacy for the Cloud
David Pointcheval
ERC Advanced Grant no 339563
Summary
Many companies have already started the migration to the Cloud and many individuals share their personal informations on social networks. While some of the data are public information, many of them are personal and even quite sensitive. Unfortunately, the current access mode is purely right-based: the provider first authenticates the client, and grants him access, or not, according to his rights in the access-control list. Therefore, the provider itself not only has total access to the data, but also knows which data are accessed, by whom, and how: privacy, which includes secrecy of data (confidentiality), identities (anonymity), and requests (obliviousness), should be enforced. Moreover, while high availability can easily be controlled, and thus any defect can immediately be detected, failures in privacy protection can remain hidden for a long time. The industry of the Cloud introduces a new implicit trust requirement: nobody has any idea at all of where and how his data are stored and manipulated, but everybody should blindly trust the providers. The providers will definitely do their best, but this is not enough. Privacy-compliant procedures cannot be left to the responsibility of the provider: however strong the trustfulness of the provider may be, any system or human vulnerability can be exploited against privacy.This presents too huge a threat to tolerate.
The distribution of the data and the secrecy of the actions must be given back to the users. It requires promoting privacy as a global security notion.
A new generation of secure multi-party computation protocols is required to protect everybody in an appropriate way, with privacy and efficiency: interactive protocols will be the core approach to provide privacy in practical systems, in contrast with the current trends in cryptography with fully homomorphic encryption and other advanced encryption techniques, that are quite interesting but essentially theoretical. Recent implicit interactive proofs of knowledge will be a starting point. But stronger properties are first expected for improving privacy. They will be integrated into new ad-hoc broadcast systems, in order to distribute the management among several parties, and eventually remove any trust requirements.
Privacy for the Cloud will have a huge societal impact since it will revolutionize the trust model: users will be able to make safe use of outsourced storage, namely for personal, financial and medical data, without having to worry about failures or attacks of the server. It will also have a strong economic impact, conferring a competitive advantage on Cloud providers implementing these tools.
Members
Principal Investigator
- David Pointcheval
Permanent Members
- Michel Abdalla*
- Georg Fuchsbauer*
- Hoeteck Wee*
Students
- Fabrice Ben Hamouda*
- Raphael Bost*
- Florian Bourse
- Mario Cornejo*
- Jérémy Chotard
- Geoffroy Couteau
- Pierre-Alain Dupont*
- Chloé Hébant
- Anca Nitulescu
- Olivier Sanders*
- Quentin Santos*
Post-Docs
- Pooya Farshim
- Julia Hesse
- Thomas Peters
Publications
2020
- Publisher Version
- Full Version
- Related Material
- Presentation Slides
2019
- Publisher Version
- Full Version
- Related Material
- Presentation Slides
2018
- Publisher Version
- Full Version
- Related Material
- Presentation Slides
2017
- Publisher Version
- Full Version
- Related Material
- Presentation Slides
2016
- Publisher Version
- Full Version
- Related Material
- Presentation Slides
2015
- Publisher Version
- Full Version
- Related Material
- Presentation Slides
2014
- Publisher Version
- Full Version
- Related Material
- Presentation Slides
Reports
2018
- Publisher Version
- Full Version
- Related Material
- Presentation Slides
2016
- Publisher Version
- Full Version
- Related Material
- Presentation Slides
Resume: David Pointcheval
Education
- Habilitation à Diriger des Recherches (HDR), University of Paris 7 - Denis Diderot, 2002
Title: Public-key encryption and provable security - PhD in Computer Science, University of Caen, 1996
Superviser: Jacques Stern
Title: Proofs of knowledge and their security proofs - Ecole Normale Supérieure (ENS), Paris, 1991-1996
Employment
- "Directeur de Recherche" CNRS (equiv. to full professor at university) at ENS, since 2007
- "Chargé de Recherche" CNRS (equiv. to assistant professor at university) at ENS, 1998-2007
- Teaching Assistant, University of Caen, 1996-1998
Responsibilities
- Chair of the Computer Science Department at ENS, since 2017
- Deputy Head of the Computer Science Department at ENS, from 2011 to 2017
- Head of the Crypto Team at ENS, since 2005
This team has been a joint research group with ENS, CNRS and INRIA, since 2007
Last update: January 18th, 2021