N1005 IBM Research: security

Delivering financial services via blockchain

<br /><div class="MsoNormal" style="margin-bottom: .0001pt; margin-bottom: 0in;"><b style="mso-bidi-font-weight: normal;"><span style="font-family: "helvneue light for ibm" , sans-serif; font-size: 13.0pt; line-height: 107%;"></span></b></div><div class="MsoNormal" style="margin-bottom: .0001pt; margin-bottom: 0in;"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjmsJBS4N40sZKVAlRwmHkaawmslOpv_VsUIa6usmbNbcubFNAm9FML8QfUNCMDClCGRZiI-InOOZyXyhe9tNKNQlv1kJ7i3LmLfbBEfW4WwM5ULO32ETarTMJP_G-EuXqv94hdFUMHiTz0/s1600/rgopinath.jpg" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" height="200" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjmsJBS4N40sZKVAlRwmHkaawmslOpv_VsUIa6usmbNbcubFNAm9FML8QfUNCMDClCGRZiI-InOOZyXyhe9tNKNQlv1kJ7i3LmLfbBEfW4WwM5ULO32ETarTMJP_G-EuXqv94hdFUMHiTz0/s200/rgopinath.jpg" width="200" /></a></div><i style="mso-bidi-font-style: normal;"><span style="font-family: "helvneue light for ibm" , sans-serif; font-size: 13.0pt; line-height: 107%;">Editor’s note: This article is by Ramesh Gopinath, vice president of Blockchain, IBM Research</span></i></div><div class="MsoNormal" style="margin-bottom: .0001pt; margin-bottom: 0in;"><br /></div><div class="MsoNormal" style="margin-bottom: .0001pt; margin-bottom: 0in;"><span style="font-family: "helvneue light for ibm" , sans-serif; font-size: 13.0pt; line-height: 107%;">Have you recently bought a house, or sold shares in a company, or maybe sent money overseas? If so, I suspect that the experience has left you wondering why these simple transactions take so much time and cost so much money. In each case, what looks like a simple financial transaction takes place over many days via a complex web of interactions between many parties. For example, let’s say that I want to send some money to my mom in India. The way it works today, the money passes through several overseas banks, linked together by so-called “correspondence banking” arrangements, before it shows up in her account. This process takes days, with fees pile up along the way. Such circuitous, expensive and often risky financial transactions are what my team at IBM Research, and our partners at the Linux Foundation want to flip on its head with <a href="http://www.ibm.com/blogs/think/2016/03/16/how-businesses-and-governments-can-capitalize-on-blockchain/" target="_blank">blockchain</a><span style="font-family: "helvneue light for ibm" , sans-serif;">.</span></span><br /><a name="more"></a><span style="font-family: "helvneue light for ibm" , sans-serif; font-size: 13.0pt; line-height: 107%;"></span></div><div class="MsoNormal" style="margin-bottom: .0001pt; margin-bottom: 0in;"><br /></div><div class="MsoNormal" style="margin-bottom: .0001pt; margin-bottom: 0in;"><span style="font-family: "helvneue light for ibm" , sans-serif; font-size: 13.0pt; line-height: 107%;">Blockchain is an emerging platform for transaction services that will fundamentally change the way we do business in many industries. <span style="mso-bidi-font-weight: bold;">Blockchain</span> technology has the potential to radically transform multi-party business networks, enabling significantly <span style="mso-bidi-font-weight: bold;">faster, less expensive,</span> <span style="mso-bidi-font-weight: bold;">lower risk</span> transactions and <span style="mso-bidi-font-weight: bold;">innovative new business models. </span></span></div><div class="MsoNormal" style="margin-bottom: .0001pt; margin-bottom: 0in;"><br /></div><div class="MsoNormal" style="margin-bottom: .0001pt; margin-bottom: 0in;"><span style="font-family: "helvneue light for ibm" , sans-serif; font-size: 13.0pt; line-height: 107%;">Blockchain is an append-only, shared ledger of digitally signed and encrypted transactions that is replicated across a peer network of nodes. Cryptography is used to ensure that participants have visibility only into information in the ledger that they are authorized to see. The copies of the ledger across the peer nodes are kept in sync by running a coordination protocol called the “consensus” algorithm. Transactions once committed onto the ledger can never be changed since no node can unilaterally change its copy of the ledger; i.e., participants cannot rewrite history or deny past transactions. </span></div><div class="MsoNormal" style="margin-bottom: .0001pt; margin-bottom: 0in;"><br /></div><div class="MsoNormal" style="margin-bottom: .0001pt; margin-bottom: 0in;"><span style="font-family: "helvneue light for ibm" , sans-serif; font-size: 13.0pt; line-height: 107%;">Going back to my earlier money transfer example, if both my bank and my mother’s bank kept their accounts on the blockchain, then one could have an instantaneous, low-cost transaction that just involves the two banks and yet is invisible to all other participants who have access to the blockchain<span style="font-family: "helvneue light for ibm" , sans-serif;">.</span></span><br /><br /><div class="separator" style="clear: both; text-align: center;"><iframe allowfullscreen="" class="YOUTUBE-iframe-video" data-thumbnail-src="https://i.ytimg.com/vi/F0P7NM7d-ps/0.jpg" frameborder="0" height="315" src="https://www.youtube.com/embed/F0P7NM7d-ps?feature=player_embedded" width="560"></iframe></div><br /></div><div class="MsoNormal" style="margin-bottom: .0001pt; margin-bottom: 0in;"><span style="font-family: "helvneue light for ibm" , sans-serif; font-size: 13.0pt; line-height: 107%;">Another interesting capability of the blockchain is that you can attach business logic to the transactions. This so-called “smart contracts” capability allows one to model and automate business processes. To see how this can be useful let’s take an example of international trade: a US retailer wants to buy a Chinese toy manufacturer’s teddy bears. The latter wants to get paid before shipping the teddy bears. The former wants to pay after inspecting the received teddy bears. Today, banks step in as trust intermediaries to close this gap. Banks vouch for the retailer by extending a line of credit – a letter-of-credit – based on which the manufacturer ships the goods, and the payment happens when the goods are received. </span></div><div class="MsoNormal" style="margin-bottom: .0001pt; margin-bottom: 0in;"><br /></div><div class="MsoNormal" style="margin-bottom: .0001pt; margin-bottom: 0in;"><span style="font-family: "helvneue light for ibm" , sans-serif; font-size: 13.0pt; line-height: 107%;">The entire end-to-end trade process involves many participants: the exporter, the importer, the exporter’s bank, the importer’s bank, shipping companies, and customs officials, as well as complex, often manual interactions involving many documents, making everything expensive and time consuming. With blockchain, the business logic of the process can be coded as a smart contract and executed automatically, leading to reduced cost, increased speed and reduced risk in international trade. </span></div><div class="MsoNormal" style="margin-bottom: .0001pt; margin-bottom: 0in;"><br /></div><div class="MsoNormal" style="margin-bottom: .0001pt; margin-bottom: 0in;"><b style="mso-bidi-font-weight: normal;"><span style="font-family: "helvneue light for ibm" , sans-serif; font-size: 13.0pt; line-height: 107%;">44,000 lines of code and counting</span></b></div><div class="MsoNormal" style="background: white; margin-bottom: .0001pt; margin-bottom: 0in; mso-line-height-alt: 11.5pt; vertical-align: baseline;"><br /></div><div class="MsoNormal" style="background: white; margin-bottom: .0001pt; margin-bottom: 0in; mso-line-height-alt: 11.5pt; vertical-align: baseline;"><span style="font-family: "helvneue light for ibm" , sans-serif; font-size: 13.0pt; line-height: 107%;">Much has been made of the 44,000 lines of code IBM has put toward the Linux Foundation’s <a href="http://www.ibm.com/blogs/think/2016/02/16/reinventing-securities-trading-with-blockchain/">Hyperledger Project</a>. My team has been developing several key algorithms, with many more on its way, for this project. For example, we have developed a new consensus algorithm, called Sieve, tailored to specific blockchain use cases. Cryptographers at our labs in Almaden and Zurich have implemented an identity management service built with the latest in cryptography. A key capability of this service is user transactional privacy (anonymity and unlinkability of transactions). We have also implemented </span><span style="font-family: "helvneue light for ibm" , sans-serif; font-size: 13.0pt; line-height: 107%;">fine-grained privacy and confidentiality control that allows authors of smart contracts to precisely specify both who can view them and who can execute them.</span></div><div class="MsoNormal" style="background: white; margin-bottom: .0001pt; margin-bottom: 0in; mso-line-height-alt: 11.5pt; vertical-align: baseline;"><br /></div><div class="MsoNormal" style="margin-bottom: .0001pt; margin-bottom: 0in;"><span style="font-family: "helvneue light for ibm" , sans-serif; font-size: 13.0pt; line-height: 107%;">Let’s go back to those teddy bears. Using a blockchain, the manufacturer and retailer may only know that money and goods exchanged – but otherwise they only see digital signatures that customs and shipping met their agreements. Likewise, customs and shipping may not know how much the entire transaction cost. More importantly, none of the competitors of the manufacturer can infer from the blockchain about this trade. These “smart” contracts sit on the blockchain, with each participant only seeing and signing the part that pertains to their role.<span style="mso-spacerun: yes;">  </span></span></div><div class="MsoNormal" style="margin-bottom: .0001pt; margin-bottom: 0in;"><br /></div><div class="MsoNormal" style="margin-bottom: .0001pt; margin-bottom: 0in;"><b style="mso-bidi-font-weight: normal;"><span style="font-family: "helvneue light for ibm" , sans-serif; font-size: 13.0pt; line-height: 107%;">New services, new roles with blockchain</span></b></div><div class="MsoNormal" style="margin-bottom: .0001pt; margin-bottom: 0in;"><br /></div><div class="MsoNormal" style="margin-bottom: .0001pt; margin-bottom: 0in;"><span style="font-family: "helvneue light for ibm" , sans-serif; font-size: 13.0pt; line-height: 107%;">Blockchain technology is viewed by many businesses as both a threat and an opportunity. Without a doubt, blockchain will disintermediate some roles in the financial services sector. For example, the days of overseas payments going through long chains of intermediaries are nearly over. At the same time there is a huge opportunity to reimagine businesses using the shared ledger and smart contract capabilities of the blockchain, leading to new services. Back to the international trade example: once the state of the trade is captured on the blockchain, it opens up a whole world of new possibilities. IoT-enabled events could trigger fractional payments depending on the location of the goods in transit. For instance, when the teddy bears are half way to their destination, 50 percent of the payment is made.</span></div><div class="MsoNormal" style="margin-bottom: .0001pt; margin-bottom: 0in;"><br /></div><div class="MsoNormal" style="margin-bottom: .0001pt; margin-bottom: 0in;"><span style="font-family: "helvneue light for ibm" , sans-serif; font-size: 13.0pt; line-height: 107%;">And as I mentioned, the immense data from ledgers that can’t change or be deleted is a great source of opportunity to apply cognitive computing. I’m looking forward to the new roles that could emerge. One thing is for certain, whether sending money to a relative in another country, or moving goods internationally, blockchain will make things faster, cheaper and more transparent – which is a good thing. </span></div><div class="MsoNormal" style="margin-bottom: .0001pt; margin-bottom: 0in;"><br /></div><div class="MsoNormal" style="margin-bottom: .0001pt; margin-bottom: 0in;"><i><span style="font-family: "helvneue light for ibm" , sans-serif; font-size: 13.0pt; line-height: 107%;">IBM Research is hosting a blockchain workshop in Chicago. If you’d like to learn more </span></i><span style="font-family: "helvneue light for ibm" , sans-serif; font-size: 13.0pt; line-height: 107%;"><a href="http://www.zurich.ibm.com/dccl/"><i>visit this Web site.</i></a><span class="MsoHyperlink"></span></span></div><div class="MsoNormal" style="margin-bottom: .0001pt; margin-bottom: 0in;"><br /></div>

blockchain finance security Delivering financial services via blockchain

Editor’s note: This article is by Ramesh Gopinath, vice president of Blockchain, IBM Research Have you recently bought a house, or sold shar...

Data Privacy Day Webinar: Protecting Personal Information Can Be Easy

3:14 AM N1000 0

<div style="box-sizing: border-box; color: #222222; direction: ltr; font-family: 'Helvetica Neue', Helvetica, Helvetica, Arial, sans-serif; line-height: 1.6; margin-bottom: 25px; padding: 0px;"><br /><i><span style="font-family: "helvneue light for ibm" , sans-serif; font-size: 13.0pt; line-height: 107%;">Editor’s Note: This article is by <a href="https://twitter.com/@jancamenisch">Dr. Jan Camenisch</a>, cryptographer, IBM Research</span></i></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj7dDjewe87X8lnV3Iba1uXlEwtcpMtTDDoQbUYIxFzdkOiEZGSUkkVwxHWtaEZsQc4rQDhwqJmtqbA4-ndfY9YYX9BYGUvhAOULX02rrYcXsnk8a4QkrjfPsMnIkxC8s-zQzAIcz2DdUk/s1600/EUz5hXR3_400x400.jpg" imageanchor="1" style="clear: right; float: right; margin-bottom: 1em; margin-left: 1em;"><span style="font-size: large;"><img border="0" height="200" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj7dDjewe87X8lnV3Iba1uXlEwtcpMtTDDoQbUYIxFzdkOiEZGSUkkVwxHWtaEZsQc4rQDhwqJmtqbA4-ndfY9YYX9BYGUvhAOULX02rrYcXsnk8a4QkrjfPsMnIkxC8s-zQzAIcz2DdUk/s200/EUz5hXR3_400x400.jpg" width="200" /></span></a></div><div style="box-sizing: border-box; color: #222222; direction: ltr; font-family: 'Helvetica Neue', Helvetica, Helvetica, Arial, sans-serif; line-height: 1.6; margin-bottom: 25px; padding: 0px;"><span style="font-family: "helvneue light for ibm" , sans-serif; font-size: 13.0pt; line-height: 107%;">Your personal identity data was worth several hundred dollars on the black market 10 years ago. Today, it’s worth pocket change. Why? Because it’s easier to steal this information than ever before.</span><br /><br /><span style="font-family: "helvneue light for ibm" , sans-serif; font-size: 13.0pt; line-height: 107%;">As more pieces of our lives go online, we regularly have to authenticate ourselves for service providers, including social media tools and e-commerce sites. Today, identity <a href="https://securityintelligence.com/no-authentication-without-trust/">authentication</a> is realized by mirroring the paper-based processes in the electronic realm, but this often exposes an excessive amount of personal information. For example, when you show your driver’s license to prove your age, you also unintentionally share your address.</span></div><div style="box-sizing: border-box; color: #222222; direction: ltr; font-family: 'Helvetica Neue', Helvetica, Helvetica, Arial, sans-serif; line-height: 1.6; margin-bottom: 25px; padding: 0px;"></div><a name="more"></a> <b><span style="font-family: "helvneue light for ibm" , sans-serif; font-size: 13.0pt; line-height: 107%;">Protecting Personal Information in the Paper Age</span></b><span style="font-family: "helvneue light for ibm" , sans-serif; font-size: 13.0pt; line-height: 107%;"></span><span style="font-family: "helvneue light for ibm" , sans-serif; font-size: 13.0pt; line-height: 107%;"> </span><br /><br /><span style="font-family: "helvneue light for ibm" , sans-serif; font-size: 13.0pt; line-height: 107%;">Because electronic information is much harder to control and protect than information on paper, this praxis erodes our privacy and puts us at risk. Indeed, the flow of information in today’s electronic networks is virtually impossible to follow and assess. Thus, it is important that data is always protected and kept secret and that disclosure is minimized whenever possible.</span><br /><br /><table cellpadding="0" cellspacing="0" class="tr-caption-container" style="float: left; margin-right: 1em; text-align: left;"><tbody><tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh-xQoZhk5Swk2Zq_cLDcpvFSP95wgR-B4Q70F-INlRzEGLl4yb_9yduk-2cGrF8I3WNYrCsP1YBaATEz6PEZ81XcdbtcZVWSW4CIp4Cw89O8PJIL9ZhrinOZ3kQPGJkY1rr_4p2Np-rxA/s1600/webinar.jpg" imageanchor="1" style="clear: right; margin-bottom: 1em; margin-left: auto; margin-right: auto;"><span style="font-size: large;"><img border="0" height="180" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh-xQoZhk5Swk2Zq_cLDcpvFSP95wgR-B4Q70F-INlRzEGLl4yb_9yduk-2cGrF8I3WNYrCsP1YBaATEz6PEZ81XcdbtcZVWSW4CIp4Cw89O8PJIL9ZhrinOZ3kQPGJkY1rr_4p2Np-rxA/s320/webinar.jpg" width="320" /></span></a></td></tr><tr><td class="tr-caption" style="text-align: center;"><span style="font-size: small;">Join: <a href="http://www.ibm.biz/identitymixerwebinar" target="_blank">live webinar</a><a href="http://www.ibm.biz/identitymixerwebinar"></a></span></td></tr></tbody></table> <span style="font-family: "helvneue light for ibm" , sans-serif; font-size: 13.0pt; line-height: 107%;">Consider <a href="https://youtu.be/gKK1PxGu6Fo?list=PL8C5495E23CD99286">this fictional transaction</a>: Alice, a movie buff, wants to stream the classic film “Alice in Wonderland” from BestMovies, an online movie service. Before it will stream the movie, BestMovies requires proof that Alice satisfies the necessary access control rules, i.e., that Alice has bought a subscription and is older than 12 years of age.</span><br /><br /><span style="font-family: "helvneue light for ibm" , sans-serif; font-size: 13.0pt; line-height: 107%;">In the paper-based world, the clerk at BestMovies would tell Alice what proof is required, and Alice would present her BestMovies subscription card and her driver’s license or some other government-issued ID. The clerk would verify the two documents for authenticity and specifically check Alice’s birthdate. While the clerk would see all of her information, he would most likely forget shortly thereafter, assuming he views hundreds of similar documents per day. Thus, Alice’s privacy and information security is retained.</span><br /><br /><b><span style="font-family: "helvneue light for ibm" , sans-serif; font-size: 13.0pt; line-height: 107%;">Moving Toward Digital Solutions</span></b><br /><div class="MsoNormal"><br /></div> <div align="right"> <table align="right" border="1" cellpadding="0" cellspacing="0" class="MsoTableGrid" style="border-collapse: collapse; border: none; margin-left: 6.75pt; margin-right: 6.75pt; mso-border-alt: solid white .5pt; mso-border-insideh-themecolor: background1; mso-border-insideh: .5pt solid white; mso-border-insidev-themecolor: background1; mso-border-insidev: .5pt solid white; mso-border-themecolor: background1; mso-padding-alt: 0in 5.4pt 0in 5.4pt; mso-table-anchor-horizontal: column; mso-table-anchor-vertical: paragraph; mso-table-left: right; mso-table-lspace: 9.0pt; mso-table-overlap: never; mso-table-rspace: 9.0pt; mso-table-top: .05pt; mso-yfti-tbllook: 1184;"> <tbody><tr style="mso-yfti-firstrow: yes; mso-yfti-irow: 0; mso-yfti-lastrow: yes;">  <td style="border: solid white 1.0pt; mso-border-alt: solid white .5pt; mso-border-themecolor: background1; mso-border-themecolor: background1; padding: 0in 5.4pt 0in 5.4pt; width: 2.25in;" valign="top" width="216">  <div class="MsoNormal" style="mso-element-anchor-horizontal: column; mso-element-anchor-vertical: paragraph; mso-element-frame-hspace: 9.0pt; mso-element-left: right; mso-element-top: .05pt; mso-element-wrap: around; mso-element: frame; mso-height-rule: exactly;"><span style="font-family: "HelvNeue Light for IBM",sans-serif; font-size: 13.0pt; line-height: 107%;"><b><a href="http://ibm.co/1PBAAiU">It’s Time to Radically Overhaul Approaches to   Data Privacy</a></b> </span></div><div class="MsoNormal" style="mso-element-anchor-horizontal: column; mso-element-anchor-vertical: paragraph; mso-element-frame-hspace: 9.0pt; mso-element-left: right; mso-element-top: .05pt; mso-element-wrap: around; mso-element: frame; mso-height-rule: exactly;"><br /></div><div class="MsoNormal" style="mso-element-anchor-horizontal: column; mso-element-anchor-vertical: paragraph; mso-element-frame-hspace: 9.0pt; mso-element-left: right; mso-element-top: .05pt; mso-element-wrap: around; mso-element: frame; mso-height-rule: exactly;"><span style="font-family: "HelvNeue Light for IBM",sans-serif; font-size: 13.0pt; line-height: 107%;">– IBM Research’s Sima Nadler on the IBM Think blog.</span></div></td> </tr></tbody></table></div><div class="MsoNormal"><span style="font-family: "HelvNeue Light for IBM",sans-serif; font-size: 13.0pt; line-height: 107%;">The same doesn’t hold true in the digital world. Like Neil Armstrong’s footprints on the lunar surface, the information will not be forgotten, but rather stored — most likely in the cloud, which is often poor protected.</span></div><span style="font-family: "HelvNeue Light for IBM",sans-serif; font-size: 13.0pt; line-height: 107%; mso-ansi-language: EN-US; mso-bidi-font-family: "Times New Roman"; mso-bidi-language: AR-SA; mso-fareast-font-family: Calibri; mso-fareast-language: EN-US;">Unfortunately, this native transposition is exactly what is typically done: The identity providers issue a credential to the users containing their attributes. When authenticating with the credential, the user has no choice but to transmit the full set of credentials to the provider no matter what data is being requested. Apart from revealing more information than often necessary, users can be tracked across different service providers because of the uniqueness of their certificates. Some popular examples of such technologies that follow this approach include X.509 client certificates as well as existing government eID solutions.</span><div class="MsoNormal"><br /></div><div class="MsoNormal"><span style="font-family: "helvneue light for ibm" , sans-serif; font-size: 13.0pt; line-height: 107%;">The second approach requires the <a href="https://securityintelligence.com/to-err-is-human-why-your-users-identity-is-your-securitys-weakest-link/">identity provider</a> to be online and involved in all of its users’ authentication transactions. While the issuer can certify only those attributes that are explicitly required (which is good for privacy), there’s a privacy bottleneck in the system that can track all its users’ transactions. From a security point of view, this approach is not ideal: The identity provider needs to be highly available but also highly protected from cybercriminals, which are contradicting requirements.</span></div><div class="MsoNormal"><br /></div><div class="MsoNormal"><span style="font-family: "helvneue light for ibm" , sans-serif; font-size: 13.0pt; line-height: 107%;">Neither of these approaches is completely satisfactory from a privacy and security point of view because they both require users to reveal more information than necessary. To solve this, the team at IBM Research – Zurich developed Identity Mixer. Identity Mixer uses advanced, provably secure cryptographic algorithms to authenticate users while providing only the minimally necessary information, without revealing any collateral and unintended data, to simultaneously achieve both privacy and security.</span></div><div class="MsoNormal"><br /></div><div class="MsoNormal"><b><span style="font-family: "helvneue light for ibm" , sans-serif; font-size: 13.0pt; line-height: 107%;">How Identity Mixer Works</span></b></div><div class="MsoNormal"><br /></div><div class="MsoNormal"><span style="font-family: "helvneue light for ibm" , sans-serif; font-size: 13.0pt; line-height: 107%;">In its simplest form, Identity Mixer works similar to traditional attribute-based credentials with a few crucial differences. Each user has a single secret key but can have multiple public keys that correspond to it. In a way, this secret key is the user’s secret identity, and users can derive as many public identities from it as necessary. For example, Alice could use one identity for BestMovies and another to pay her taxes online. Each transaction gets a different public key, leaving no privacy breadcrumbs.</span></div><br /><span style="font-family: "helvneue light for ibm" , sans-serif; font-size: 13.0pt; line-height: 107%;">Alice can get an attributed certified credential such as an eID, a driver’s license or a membership card by sending one of her public keys to the issuer of the desired credential. The issuer will then sign that public key along with Alice’s attributes, which vouches for and sends the resulting credential back to Alice. Alice stores the received credential in her digital wallet, which can run on her mobile phone, computer, another preferred device or via a cloud-based wallet. This process is conceptually identical to one of the X.509 attribute certificates, except Identity Mixer uses different cryptographic algorithms.</span><br /><div class="MsoNormal"><span style="font-family: "helvneue light for ibm" , sans-serif; font-size: 13.0pt; line-height: 107%;"></span></div><div class="MsoNormal"></div><div class="MsoNormal"></div><div class="MsoNormal"></div><div class="MsoNormal"><br /></div><div class="MsoNormal"><span style="font-family: "helvneue light for ibm" , sans-serif; font-size: 13.0pt; line-height: 107%;">When Alice is requested to authenticate to a service — let’s say she wants to stream “Alice in Wonderland” from BestMovies again — the service provider will send her a presentation policy stating the information needed to proceed. In the example, the presentation policy would state BestMovies requires Alice to prove that she’s older than 12 according to government-issued credentials and that she possesses a valid subscription credential from BestMovies. This is the second difference to traditional approaches, where users are typically asked to identify themselves in order for the service provider to evaluate whether the user satisfies the <a href="http://www.ibm.com/software/products/en/access-mgr-web?ce=ISM0484&ct=SWG&cmp=IBMSocial&cm=h&cr=Security&ccy=US">access control</a> policy.</span> </div><div class="MsoNormal"><br /></div><div class="MsoNormal"><span style="font-family: "helvneue light for ibm" , sans-serif; font-size: 13.0pt; line-height: 107%;">Now, having received the presentation policy, Alice’s digital wallet will offer her a choice of which credentials she can use to satisfy it, or the wallet will point out which credentials she is missing. After Alice has selected the necessary credentials, her wallet will use a cryptographic algorithm to transform her credentials into a presentation token, which she can then send to BestMovies, the verifier<i>.</i></span></div><br /><span style="font-family: "helvneue light for ibm" , sans-serif; font-size: 13.0pt; line-height: 107%;">This transformation is the third and probably most important difference to the traditional approaches. The presentation token consists only of the information that Alice needs and is willing to reveal instead of the full set of attributes contained in her credentials. Thus, the presentation token would just contain the attributes “User is older than 12 according to a credential issued by the government” and “User possesses a subscription credential by BestMovies with a nonexpired validity date.” The presentation token validates with the public verification key. Then the verifier can check the validity of the token using the issuer’s verification key with the cryptographic verification algorithm and learn only the information about Alice that was specified in the presentation policy — nothing more.</span> <br /><div class="MsoNormal"><br /></div><div class="MsoNormal"><span style="font-family: "helvneue light for ibm" , sans-serif; font-size: 13.0pt; line-height: 107%;">Want to give <a href="http://idemixdemo.mybluemix.net/">Identity Mixer</a> a spin? You only need a Web browser to test the ultimate tool for both privacy protection and security.</span></div><div class="MsoNormal"><br /></div><div class="MsoNormal"><b><span style="font-family: "helvneue light for ibm" , sans-serif; font-size: 13.0pt; line-height: 107%;">For More Information</span></b></div><div class="MsoNormal"><br /></div><div class="MsoNormal"><span style="font-family: "helvneue light for ibm" , sans-serif; font-size: 13.0pt; line-height: 107%;">Identity Mixer offers many more extended features than the ones explained above, including exclusive pseudonyms, multicredential tokens and designated inspectors. Learn more about the privacy-preserving characteristics and data-minimizing strategies implemented on <a href="http://www.zurich.ibm.com/idemix/features.html?ce=ISM0484&ct=SWG&cmp=IBMSocial&cm=h&cr=Security&ccy=US">Identity Mixer’s website</a>.</span></div><br /><span style="font-family: "helvneue light for ibm" , sans-serif; font-size: 13.0pt; line-height: 107%;">You can also discover some of the developments happening in the world of identity and authentication by checking out groups such as <a href="http://www.au2eu.eu/">Authentication and Authorisation for Entrusted Unions (AU2EU)</a> and <a href="https://abc4trust.eu/">Attribute-based Credentials for Trust (ABC4Trust)</a>, both of which are changing the way organizations manage authentication and access.</span><br /><br /><span style="font-family: "helvneue light for ibm" , sans-serif; font-size: 13.0pt; line-height: 107%;">Finally, join us on Data Privacy Day, 28 January 2016 for a live <a href="http://www.research.ibm.com/labs/zurich/idemix/webinar.html">demonstration webinar</a> of IBM Identity Mixer.</span><br /><br /><span style="font-size: large;"><iframe allowfullscreen="" frameborder="0" height="315" src="https://www.youtube.com/embed/gKK1PxGu6Fo" width="560"></iframe></span>

bluemix identity mixer privacy security Data Privacy Day Webinar: Protecting Personal Information Can Be Easy

Editor’s Note: This article is by Dr. Jan Camenisch , cryptographer, IBM Research Your personal identity data was worth several hundred doll...

Would you know if your car was being hacked?

5:54 PM N1000 0

<br /><table cellpadding="0" cellspacing="0" class="tr-caption-container" style="float: left; margin-right: 1em; text-align: left;"><tbody><tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjoBilBMRj0vsduqNkFNrArOHaIrozSzQ7VOuVuE18ym2wYU__6XG4_-gHTmpkm_lv9rjZkwhGMDjhhxxgq5BdC3XttIQ5oU9-Sfx1FS4N7JRvXZR1MGYt9V1UDzIMmMcaTmofZovKVTcA/s1600/yairallouche.jpg" imageanchor="1" style="clear: left; margin-bottom: 1em; margin-left: auto; margin-right: auto;"><img border="0" height="240" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjoBilBMRj0vsduqNkFNrArOHaIrozSzQ7VOuVuE18ym2wYU__6XG4_-gHTmpkm_lv9rjZkwhGMDjhhxxgq5BdC3XttIQ5oU9-Sfx1FS4N7JRvXZR1MGYt9V1UDzIMmMcaTmofZovKVTcA/s320/yairallouche.jpg" width="320" /></a></td></tr><tr><td class="tr-caption" style="text-align: center;">Yair Allouche, IBM cybersecurity researcher</td></tr></tbody></table><div class="MsoNormal"><i><span style="font-family: "verdana" , "sans-serif"; font-size: 10.0pt; line-height: 115%;">Editor’s note: This <span style="font-family: "verdana" , "sans-serif";">article is</span> by Yair Allouche, researcher at IBM’s Cybersecurity Center of Excellence in Beer Sheva, Israel.</span></i></div><div class="MsoNormal"><br /></div><div class="MsoNormal"><span style="font-family: "verdana" , "sans-serif"; font-size: 10.0pt; line-height: 115%;">When my sister reluctantly upgraded to a smart phone, she was concerned that her location, contacts, personal calendar, and even banking information would be vulnerable to cybercrime. And she was right to be concerned. Most of us made the decision to give up a certain amount of security in exchange for the wondrous and practical applications that we can no longer live without. But how many of us are making that same conscious decision when we buy a new car? </span></div><div class="MsoNormal"></div><div class="MsoNormal"><br /><span style="font-family: "verdana" , "sans-serif"; font-size: 10.0pt; line-height: 115%;">IBM cybersecurity researchers in Israel are developing protection for connected cars<span style="font-family: "verdana" , "sans-serif";"> by</span> providing cloud-based intelligence to identify cyberattacks and suspicious activity that can endanger the car or its occupants. By offering car manufacturers a hybrid system that can collect, analyze, and cross-reference massive amounts of data from different vehicles, these researchers are bringing IBM’s security smarts from the data centers to the road<span style="font-family: "verdana" , "sans-serif";">.</span></span><br /><a name="more"></a></div><div class="MsoNormal"><br /><b><span style="font-family: "verdana" , "sans-serif"; font-size: 10.0pt; line-height: 115%;">What makes cars so vulnerable?</span></b></div><div class="MsoNormal"><br /><span style="font-family: "verdana" , "sans-serif"; font-size: 10.0pt; line-height: 115%;">Today hackers can get inside your smartphone and steal identities or personal information, access emails, or in extreme cases, hack into our banking apps. This in itself is pretty scary, but so i<span style="font-family: "verdana" , "sans-serif";">s the idea of</span> hackers t<span style="font-family: "verdana" , "sans-serif";">aking</span> over your car’s steering or braking systems. </span></div><div class="MsoNormal"><br /></div><div class="MsoNormal"><span style="font-family: "verdana" , "sans-serif"; font-size: 10.0pt; line-height: 115%;">Cars are now more digital than ever. And with <span style="font-family: "verdana" , "sans-serif";">more than</span> 100 distributed computer systems and 100 million lines of code in a typical car, there are plenty of components that need protection from hackers. Why do cars have 7 times more code than a Boeing 747? This comes primarily from the fact that today’s cars are assembled from different parts rather than manufactured from start to finish in one factory. As a result, the central door-locking mechanism could easily be the same component <span style="font-family: "verdana" , "sans-serif";">across several differ<span style="font-family: "verdana" , "sans-serif";">ent car manufacture<span style="font-family: "verdana" , "sans-serif";">rs</span></span></span>. This is problematic from the point of view of security because it means that any vulnerability breached in one car leaves the others open to hacking.</span></div><div class="MsoNormal"><br /></div><div class="MsoNormal"><span style="font-family: "verdana" , "sans-serif"; font-size: 10.0pt; line-height: 115%;">A <a href="http://blogs.barrons.com/focusonfunds/2015/09/08/americans-worry-about-falling-victim-to-cyberattacks-more-than-any-other-type-of-crime/" target="_blank">recent study</a> stated that <span style="font-family: "verdana" , "sans-serif";">by</span> 2018, 420 million automobiles will be connected, representing a huge growth over the 45 million connected vehicles in 2013.<i> </i>If the frequency of software threats for the auto industry is similar to that of PCs, the need for a sophisticated system that continuously remains updated becomes critical. By applying the expertise from the IT world to cars, IBM can offer a solution that never stops working and is always updated to deal with new types of attacks. </span></div><div class="MsoNormal"><br /></div><div class="MsoNormal"><b><span style="font-family: "verdana" , "sans-serif"; font-size: 10.0pt; line-height: 115%;">Int<span style="font-family: "verdana" , "sans-serif";">ra-<span style="font-family: "verdana" , "sans-serif";"> <span style="font-family: "verdana" , "sans-serif";">And Inter-<span style="font-family: "verdana" , "sans-serif";">Vehic<span style="font-family: "verdana" , "sans-serif";">le</span> Se<span style="font-family: "verdana" , "sans-serif";">curity</span></span></span></span></span></span></b></div><div class="MsoNormal"><br /><span style="font-family: "verdana" , "sans-serif"; font-size: 10.0pt; line-height: 115%;">At our Cybersecurity Center of Excellence in Beer Sheva, Israel<span style="font-family: "verdana" , "sans-serif";">, my</span> team of researchers decided to take a holistic approach<span style="font-family: "verdana" , "sans-serif";"> to <span style="font-family: "verdana" , "sans-serif";">car sec<span style="font-family: "verdana" , "sans-serif";">urity</span></span></span>. On one hand, we want to protect the car so that hackers can’t take over control<span style="font-family: "verdana" , "sans-serif";"> by</span> changing the car’s speed or direction, or applying <span style="font-family: "verdana" , "sans-serif";">t</span>he brakes, for example. On the other hand, we want to protect the data stored in and sent by the car’s systems. This data is used to send messages if the car was stolen, or if the driver had a heart attack, or simply about its speed and location. If abused by hackers, false data <a href="http://arxiv.org/pdf/1410.0151.pdf" target="_blank">can be injected</a> to create fake traffic jams that reroute vehicles, submit false information to insurance companies for pay<span style="font-family: "verdana" , "sans-serif";">-</span>as<span style="font-family: "verdana" , "sans-serif";">-</span>you<span style="font-family: "verdana" , "sans-serif";">-</span>drive packages, or even <span style="font-family: "verdana" , "sans-serif";">determine if </span>someone is not at home. Each digital component in the car that is connected to an outside system is vulnerable. </span></div><div class="MsoNormal"><br /></div><div class="MsoNormal"><span style="font-family: "verdana" , "sans-serif"; font-size: 10.0pt; line-height: 115%;">Most automotive security systems focus on in<span style="font-family: "verdana" , "sans-serif";">-</span>car security, similar to the way an anti-virus program might work on our home computer. This may include isolating the car’s infotainment and critical drive systems, or even the inter-car connections that are used to prevent accidents. <a href="https://securityintelligence.com/made-in-ibm-labs-solution-for-detecting-cyber-intrusions-to-connected-vehicles-part-i/">Our research technology</a> goes beyond the level of the individual car. By taking into account all cars' data channels, we can build a system that uses the synergy between the many sources. For example, by collecting and analyzing data from many cars, we can cross reference them to validate that the information coming in is correct. If one car says it’s traveling at 50 kmph and all the other cars near it are traveling 90 kmph then obviously something is not right. </span></div><div class="MsoNormal"><br /></div><div class="MsoNormal"><span style="font-family: "verdana" , "sans-serif"; font-size: 10.0pt; line-height: 115%;">Our goal is to offer security visibility by identifying suspicious activity and alerting the drivers or car manufacturers<span style="font-family: "calibri" , sans-serif; font-size: 11.0pt; line-height: 107%; mso-ansi-language: EN-US; mso-bidi-font-family: "Times New Roman"; mso-bidi-language: AR-SA; mso-fareast-font-family: Calibri; mso-fareast-language: EN-US;"><span style="mso-spacerun: yes;"></span></span></span><span style="font-family: "verdana" , "sans-serif"; font-size: 10.0pt; line-height: 115%;"><span style="font-family: "calibri" , sans-serif; font-size: 11.0pt; line-height: 107%; mso-ansi-language: EN-US; mso-bidi-font-family: "Times New Roman"; mso-bidi-language: AR-SA; mso-fareast-font-family: Calibri; mso-fareast-language: EN-US;"><span style="mso-spacerun: yes;"><span style="font-family: "verdana" , "sans-serif"; font-size: 10.0pt; line-height: 115%;"> — </span></span></span>even without having to install a specific component in the car. Our hybrid solution includes a component that sits in the car, but its intelligence sits in the cloud. This allows us to continuously protect the car and driver, remaining connected at all times and not only when the car goes in for servic<span style="font-family: "verdana" , "sans-serif";">e</span>. </span></div><div class="MsoNormal"><br /></div><div class="MsoNormal"><span style="font-family: "verdana" , "sans-serif"; font-size: 10.0pt; line-height: 115%;">This new solution also offers more control and transparency over what information is being collected about you from your car. Since the data collected includes information on where your car is every single second of the day, our technology will allow users to access services to help secure the car, but will only use personal identification if the driver agrees to share it.</span></div><div class="MsoNormal"><br /></div><div class="MsoNormal"><span style="font-family: "verdana" , "sans-serif"; font-size: 10.0pt; line-height: 115%;">By building a protective solution whose architecture allows it to adjust itself to new threats as they arise, we are giving the automotive industry a boost in the right direction. With IBM’s vast amounts of IT security knowledge and assets — alongside new algorithms from Research</span><span style="font-family: "verdana" , "sans-serif"; font-size: 10.0pt; line-height: 115%;"><span style="font-family: "verdana" , "sans-serif"; font-size: 10.0pt; line-height: 115%;"> — </span> we can offer true protection for connected cars and the data being collected from them. </span></div><div class="MsoNormal"><br /></div><div class="MsoNormal"><span style="font-family: "verdana" , "sans-serif"; font-size: 10.0pt; line-height: 115%;">Our next step<span style="font-family: "verdana" , "sans-serif";"> is</span> targeted at bringing the technology to market. We recently demonstrated a prototype solution for securing vehicles at the <a href="https://securityintelligence.com/events/66th-international-motor-show-2015-in-frankfurtmain/" target="_blank">International Motor Show</a> in Frankfurt, Germany.<span style="font-family: "verdana" , "sans-serif";"> Read m<span style="font-family: "verdana" , "sans-serif";">ore about the de<span style="font-family: "verdana" , "sans-serif";">m<span style="font-family: "verdana" , "sans-serif";">o,</span></span></span></span><span style="font-family: "verdana" , "sans-serif";"></span> <a href="https://securityintelligence.com/made-in-ibm-labs-solution-for-detecting-cyber-intrusions-to-connected-vehicles-part-i/">here</a>.</span></div>

automotive connected cars cybersecurity hybrid cloud IBM Research - Haifa security Would you know if your car was being hacked?

Yair Allouche, IBM cybersecurity researcher Editor’s note: This article is by Yair Allouche, researcher at IBM’s Cybersecurity Center of Ex...