Grant: Collaborative Research and Development Grants

Information and communication technology (ICT) platforms form the basis of our interactions online. The cloud servers that store and process our data and the networks we use to communicate with them handle a large amount of information about all aspects of our lives. As has been all too apparent with news about large-scale theft and abuse of data from tens of thousands of Bank of Montreal and CIBC customers in May 2018 and nearly 50 million Facebook users in September 2018 (as two examples among a great many), the security and privacy of these platforms is often lacking. Without technological improvements that enhance network and storage security and provide customized functionality without exposing private user information, collection of personal and sensitive data remains rife and breaches continue to wreak havoc on users and companies alike. Today's ICT platforms use basic encryption techniques to protect data in storage and in transit, but do not protect metadata. This leaves users vulnerable to the collection of private information such as location and browsing history, and it leaves communications vulnerable to traffic analysis and censorship. Furthermore, although private data may be encrypted in storage, it needs to be decrypted before the company or cloud service can use it for analysis purposes or to provide customized functionality to users. Working with our partners at the Royal Bank of Canada (RBC)'s Cybersecurity Research Lab, we look beyond current deployments to the emerging generation of ICT platforms. Our work will allow RBC customers, whether at home or travelling abroad, to securely and privately access RBC services without leaking data or metadata to possibly hostile or competing governments or Internet providers. We will also create the ability to offer personalized services to RBC customers through secure computation techniques that do not require RBC to ever collect or store customers' private information, at least not in unencrypted form, thus eliminating the possibility of that information being inadvertently leaked in a data breach.