Congratulations to David Cash and his collaborators (Thomas Ristenpart and Vitaly Shmatikov of Cornell Tech) for having their proposal
"SaTC: CORE: Medium: Collaborative: Cryptographic Data Protection in Modern Systems”, be recommended for funding.
Size: 1.2M (Rutgers amount: $400K)
Project Overview:
Continuing major breaches and security compromises of computer systems motivate a promising new approach to data protection: encrypt the data so that even if stolen, it will be useless to the attacker, yet reveal just enough information about the data so that commodity systems such as databases and Web servers can still operate on it. This so called "property-revealing encryption" (PRE) has already found its way to academic and commercial products that protect sensitive data in cloud services.This project is a comprehensive investigation of whether, when, and how can property-revealing encryption adequately protect sensitive data. It involves developing rigorous theoretical foundations for PRE, studying how PRE is used and misused in systems operating on sensitive data, and demonstrating how to use it safely and securely. This investigation is informed by close engagement with industry and understanding of the needs and requirements of protecting users' data.
This project comprises three research thrusts, spanning the range from theoretical foundations to security analysis to design and implementation of prototype systems. Together, they represent a holistic approach to achieving secure, practically deployable cryptographic data protection in modern systems.
The first thrust is developing cryptographic definitions and security models for property-revealing encryption (PRE) schemes, as well as developing a hierarchy of threat models and inference methods. This part of the project also involves assessing how meaningful these models are relative to realistic adversarial scenarios.
The second thrust is analyzing security of existing commercial and academic systems based on PRE. It focuses on developing a unified methodology for measuring and exploiting information leakage when PRE schemes are deployed on realistic data in actual distributed systems.
The third thrust is designing and implementing secure systems that use cryptographic data protection safely and securely, focusing on a small number of key applications that showcase essential PRE functionality.
