Challenges in Making E-Privacy Real Larry Korba Institute for Information Technology National Research Council of Canada Panel Presentation, 6 th Annual CACR Security and Privacy Workshop November 3-4, 2005

Overview Background –NRC-IIT Privacy-related technologies –What we have done… –Some Challenges today. Some approaches NRC-IIT takes Conclusions

NRC – IIT – IS NRC –$850 million, Every Province, 20 Inst. & Programs –Scientific Research one of 7 Mandates. NRC – IIT –4 Cities, 9 Groups – Diverse Areas in IT –Information Security IT Security Research since 1996 Privacy Technology: 2000

Research Privacy Technology NRC has a broad mandate IT is a large area –IIT is small Next - Privacy research –IIT –Research Challenges

Possible Privacy Tech: Current Research Dynamic privacy & Security policy negotiation Security Intelligence –Computer Supported Collaborative Work –Inappropriate Insider Activity Trustworthy HCI for Security Applications –Biometry Protocol for Ad Hoc Wireless Privacy (Red highlighted research featured in this talk with descriptions of our prototype technology demonstrations)

security policy negotiation EASE: Environmentally-Aware Security Enforcement In a web service world… –User’s privacy only as good as the security of her platform Client Attacks: Trojan, worms, keystroke monitors, viruses This work… –Extends security policies from server to client platforms –Enforces security compliance at client Secure operating environment Corporate Policy Application use Copyright Works well with legacy systems

Secure Environment security policy negotiation EASE Client-Server Demo Available Application Server Client A Client B Client C Senses context of user operation, extends server security policy to client. Manages Authentication, Authorization, forces trojan/virus scan, prevents inappropriate applications from being installed, kills inappropriate processes Activities, (linking with security intelligence) prevents inappropriate user behavior

security policy negotiation EASE Screenshot from prototype

Ad Hoc Wireless Privacy Secure. Private, Wireless Ad Hoc Messaging Anonymous Dynamic Source Routing protocol Enable Private communications through multiple parties A Z B C D E

Challenges: Privacy Technology Research Knowledge-related –What’s required –What is what –What people are doing –Why Enforcement-Related –Users, Protocols, Mechanisms –Privacy with security

Challenges: Privacy Research in Canada Little privacy research in Canada Low receptor capacity Security Funding –Many (getting) involved, across Canada Privacy Research Funding –NSERC, CFI –(Mike is working on this)

Scientific/Technical Knowledge But How to make it Real? Foundational Research Prototype 1 Unknown Prototype 2 Books, Papers, Reports Outreach, Influence Research Collaborations Technology Push Industry OGD, Etc. Support/Focus Technology Pull Engineering, Marketing Users Product

Summary NRC-IIT Research –Some of Ours –Some Challenges Research to Impact Challenge –Research Focus –Technology Uptake Improved with industry, user involvement Tripod model helps –Influence: Support Broader Research Base Bell Collaboration –Lead-In to Mike…

Thank You