CISO at Voya Financial

Data security is paramount in cybersecurity. If we could somehow protect all sensitive data then the cyber risk from a data breach, unauthorized access, or an exfiltration event would reduce tremendously - much to the liking of security professionals like myself. This article will speak to the current state of data protection, review some common techniques and offer a vision into the future state with some promising implementations.

Data breaches occur almost daily, yet with some promising solutions on the horizon, we can make this future state a current one. It is the responsibility of security technologists to start enabling the work and adoption required to improve data security

Current state:

The current state has served us well so far. Currently there are three primary paradigms of logical and physical data protection for both structured and unstructured data –data obfuscation (masking), digital rights management of data, and data encryption.

1 .Data Obfuscation –

This data protection method is generally used to mask or obfuscate sensitive data either at rest and/or in motion. Data obfuscation can be computationally intense, although a lot depends on strength of the masking algorithm. E.g. computing times required for SHA-256 and SHA-512 are higher than (the now broken) SHA-1 and MD-5. Data obfuscation is only useful for certain use cases where the original sensitive data is not required in plaintext (e.g. passwords) once it has been obfuscated, because generally speaking obfuscation is done using a one-way hash.

2. Digital Right Management (DRM) –

 This data protection method provides the capability to digitally manage access and rights at a granular level on the said data to be protected. It is the newest and the most practical way to provide protection to sensitive data. DRM uses data encryption to protect the said data along with creative key management and authentication techniques

3. Data Encryption –

This data protection method is the primary method to provide physical and logical level protection to sensitive (structured and unstructured) data while at rest and/or while in motion. The encryption methods comprise of both symmetric and asymmetric encryption techniques depending upon the data protection use case. While data encryption has many benefits, it comes with its own problems and limitations, including but not limited to:

• Computation cycles, which are needed to encrypt the data, are very high and require extensive processing power leading to higher costs.

 • Computation time: Due to the heavy computing cycle need, data encryption can also take a good deal of time, asymmetric encryption taking more time than symmetric encryption.

• Usage: Using current encryption paradigms the encrypted data has to be decrypted before it can used. This creates a problem as eventually the data is available in the clear (even though for a short period in memory or on disk etc.) and can lead to unauthorized access.

• Key Protection: The cryptographic key used to encrypt the data has to be protected, and also needs to be provided for decryption, leading to additional costs and the risk of key exfiltrat

Future State:

The future state is on the horizon. We expect many improvements in the next three to five years as production ready implementations become more available.

 A key issue in the current data encryption paradigm is that data has to be decrypted prior to performing mathematical computation or using it for data processing purposes. The next generation of encryption technologies is trying to fix this problem by developing encryption techniques that enables data computation on encrypted data. This paradigm will also help with the post quantum computing data security scenarios.

 Currently there are two primary next-generation encryption techniques, Fully Homomorphic Encryption (FHE) and Multi part compute (MPC). These techniques have delivered promising results in performing data computation while the data is still encrypted. This paper takes a deeper look at the FHE techniques

Encryption Basics

In the world of computation, data encryption is the technique which provides the capability to encode (encrypt) and decode (decrypt) plaintext data using a key. Generally speaking, mathematical algorithms are used to perform the encryption (encoding) and decryption (decoding) of data. When plaintext data is encrypted the resulting data is called Ciphertext.

 To put this into simple equations (let’s leave asymmetric encryption out for the sake of simplicity) – ciphertext = Fnencrypt (key,data);

 data = Fndecrypt (key,ciphertext);

Fully Homomorphic Encryption (FHE)

 FHE allows computations to be carried out directly on encrypted data yielding a ciphertext containing the encrypted output. These computations generate a result consistent with computations on unencrypted data or plaintext. Previous generations of FHE technologies suffered from extremely slow performance and only supported a limited number of mathematical operations. However, significant progress has been made in the current (3rd) generation capabilities.

 Let’s look at this on an introductory level, beginning with a very basic explanation of how FHE works using the example below. i. Financial institution (X) wants to share some personally identifiable information (PII) with an external thirdparty service data processing provider (Y) which requires some mathematical computation

ii. X sends encrypted data to Y (but does not provide a decryption key for the said data)

 iii. Y performs data processing on the encrypted data

iv. Y returns the encrypted data results back to X v. X decrypts the encrypted data result to read the processed data.

 Company X was able to maintain the confidentiality and integrity of its data, while still successfully obtaining the data processing results required in a highly secure manner, as the data decryption key never left its premises.

 Theoretically speaking the computation works as follows:

 C1 = FHEencrypt(D1)

; C2 = FHEencrypt(D2);

D1+D2 = FHEdecrypt(C1+C2);

 D1*D2 = FHEdecrypt(C1*C2); T

The second generation of FHE offers some promising implementations, namely CKKS and BFV (which has been used in Microsoft’s SEAL implementation), and the Paillier cryptosystem. T

he third generation of FHE offers two promising implementations of particular interest, namely FHEW (fully homomorphic encryption with Bootstrapping), and TFHE (Fast fully homomorphic encryption)

 Also Microsoft has reported major improvements in performance of homomorphic encryption with the use of artificial intelligence (AI) CryptoNets based optical recognition systems. This deep-learning neural network uses the homomorphic encryption capabilities powered by Simple Encrypted Arithmetic Library (SEAL) – code for which Microsoft revealed last November. I

In closing

Data encryption-based data security paradigms are only as good as the safety of the keys used to encrypt the data. Even if the keys are stored securely, the data is available in plaintext in memory or on disk and is susceptible to exfiltration or unauthorized access through various sophisticated memory-based exploits, both in the application or server stack, or in the firmware itself.

 In the future, data processing will be done either directly on encrypted data (FHE) or by not sharing all the private data itself (MPC). This new paradigm will greatly reduce the cyber risk from data exfiltration, breaches and unauthorized access. Security technologists are at the forefront of emerging technologies in this arena, and considering the current state of the threat scene and emerging cyber risk, are our best line of data security defense.