Architecture of Secure Multi-Party Computation as a Service with No Single Point of Trust

Abstract

Information privacy is receiving significant attention in both legislative and public discourse. Increasing awareness of the risks inherent in cross-organisational data analysis has led to limitations on traditional statistical approaches. Although secure multi-party computation (MPC) offers a promising solution to risk mitigation, existing MPC technologies remain too resource-intensive for widespread practical adoption. The JOCONDE project seeks to overcome this problem with a novel MPC as a Service system. This thesis contributes to the system design by addressing its challenge – to circumvent a single point of trust. No entity should be able to compromise sensitive data – the foundational security guarantee of MPC, which must be extended to the new system. A threat model has been developed to reach the goal, serving as the basis for formulating appropriate countermeasures and architectural decisions. Experts validated the results and confirmed the completeness of the threat model along with the sufficiency and feasibility of single-point-of-trust mitigations. Teabe privaatsus on laialdast tähelepanu pälvinud nii seadusandluses kui üldsuse seas. Teadvustatakse muuhulgas riske, mis kaasnevad andmete töötlemisega organisatsioonide üleselt, piirates levinud statistika tootmise metoodikaid. Turvalise ühisarvutuse (MPC) tehnoloogiad pakuvad probleemile lahendust, kuid praktikas osutub nende rakendamine liiga ressursimahukaks. JOCONDE projekti algatusel otsitakse ressursiprobleemile lahendust uudse turvalise pilvühisarvutuse süsteemiga. Käesolev lõputöö sisaldab osa süsteemi disainist, mis keskendub kriitilise usalduspunkti (single point of trust) vältimisele. Aluseks olev turvalise ühisarvutuse turvagarantii, mis tagab, et ükski osapool pole võimeline tundlikke andmeid kompromiteerima, peab laienema ka uuele süsteemile. Selle nimel loodi ohumudel, millest lähtudes disainiti meetmed ning koostati komplekt arhitektuurilisi otsuseid. Saadud tulemusi valideeriti ekspertintervjuudes – kinnitati ohumudeli täielikkus, lahenduse piisavus kriitilise usalduspunkti vastu ning otsuste äriline teostatavus.