5 ms·

This caught my eye: > https://github.com/apache/incubator-pirk https://github.com/apache/incubator-pirk > Employing homomorphic encryption techniques, PIR ena

by rdtsc 9y ago

This caught my eye: > https://github.com/apache/incubator-pirk https://github.com/apache/incubator-pirk > Employing homomorphic encryption techniques, PIR enables datasets to remain resident in their native locations while giving the ability to query the datasets with sensitive terms. I can imagine a few scenarios there. One perhaps is when db admin should not find out what someone, possibly working on a classified project is querying. Or say one compartment / project collected the data and now they want to share it with another project. Those read into the second project don't want to reveal to the first one what they are querying because it would reveal classified information. Another scenario is a database which has results of possibly illegally intercepted communications. If the NSA can argue that the Constitutionally defined "search" doesn't occur until someone actually performs a search (as in runs an SQL query over the data). Then having PIR capability means being able to break the law but only let as few people as possible do it. Also https://github.com/redhawksdr https://github.com/redhawksdr is pretty damn impressive. It looks like a complete parallel implementation of GNU Radio. Completed with an IDE and such. Wonder how it compares?

jamra 9y ago
All valid points, but I think it has more to do with this research being popular in the encryption community. One of the Coursera teachers was working on something like that. An example of use is video games that help prevent hacking and modification. I think that there could be some great consumer usage for having the ability to encrypt data, but still be able to search it.
Tepix 9y ago
Intriguing indeed. Could this tech also be used to query a database or service to plot a route (say for navigating with your car) without revealing the route?
Spearchucker 9y ago
This is pretty common in the commercial world too, and something I've done more than once myself. The obvious use case is storing medical records. In the UK personal medical records are often stored by systems integrators in datacentres with nebulous locations, and need to be accessed by third parties for things like underwriting life insurance policies. To protect the data (compliance with the EU data protection act) it's encrypted in transit AND at rest. Access to data by third parties is managed through AMRAs (access medical record authorisation), which are completed by the third party, authorised by the data owner (private individual) and given to the data owner's general/dental practitioner or pharmacist, who is able to access and decrypt and appropriately share the sensitive data.
- raverbashing 9y ago
  Are AMRAs kinda like "stored procedures" then?
  - Spearchucker 9y ago
    AMRAs are like physical documents with an instruction to the information guardian, with a signature from the information owner, authorising access. A lot of it is electronic these days, and is automated to the point that an individual authorises access by clicking a link in an email that calls an endpoint that in turn releases a token and URL to the requestor to view the appropriate records.
    - Cakez0r 9y ago
      So like OAuth?
      - Spearchucker 9y ago
        Partly. OAuth is authentication (who I am), which is part of it, but the real point is authorisation (what I can do).
zitterbewegung 9y ago
So looking at the apache incubator project pirk is retired due to inactivity [1]. Is anyone interested in reviving the project? [1] http://incubator.apache.org/projects/index.html#pirk http://incubator.apache.org/projects/index.html#pirk
secfirstmd 9y ago
I guess an example might be that the NSA has access to other partners information (e.g non-five eyes like Germany) and doesn't want their DB folks to be able to see that they are quering against the databases (e.g Merkels phone number)
- eu90h 9y ago
  This is exactly what PIR is for. A good intro is chapter 6 of the (awesome and ahead-of-its-time) book Malicious Cryptography. One of the authors works at the agency now, I believe.

by rdtsc 9y ago

jamra 9y ago

All valid points, but I think it has more to do with this research being popular in the encryption community. One of the Coursera teachers was working on something like that. An example of use is video games that help prevent hacking and modification. I think that there could be some great consumer usage for having the ability to encrypt data, but still be able to search it.

Tepix 9y ago

Intriguing indeed. Could this tech also be used to query a database or service to plot a route (say for navigating with your car) without revealing the route?

Spearchucker 9y ago

This is pretty common in the commercial world too, and something I've done more than once myself. The obvious use case is storing medical records. In the UK personal medical records are often stored by systems integrators in datacentres with nebulous locations, and need to be accessed by third parties for things like underwriting life insurance policies. To protect the data (compliance with the EU data protection act) it's encrypted in transit AND at rest. Access to data by third parties is managed through AMRAs (access medical record authorisation), which are completed by the third party, authorised by the data owner (private individual) and given to the data owner's general/dental practitioner or pharmacist, who is able to access and decrypt and appropriately share the sensitive data.

raverbashing 9y ago
Are AMRAs kinda like "stored procedures" then?
- Spearchucker 9y ago
  AMRAs are like physical documents with an instruction to the information guardian, with a signature from the information owner, authorising access. A lot of it is electronic these days, and is automated to the point that an individual authorises access by clicking a link in an email that calls an endpoint that in turn releases a token and URL to the requestor to view the appropriate records.
  - Cakez0r 9y ago
    So like OAuth?
    - Spearchucker 9y ago
      Partly. OAuth is authentication (who I am), which is part of it, but the real point is authorisation (what I can do).

zitterbewegung 9y ago

So looking at the apache incubator project pirk is retired due to inactivity [1]. Is anyone interested in reviving the project? [1] http://incubator.apache.org/projects/index.html#pirk http://incubator.apache.org/projects/index.html#pirk

secfirstmd 9y ago

I guess an example might be that the NSA has access to other partners information (e.g non-five eyes like Germany) and doesn't want their DB folks to be able to see that they are quering against the databases (e.g Merkels phone number)

eu90h 9y ago
This is exactly what PIR is for. A good intro is chapter 6 of the (awesome and ahead-of-its-time) book Malicious Cryptography. One of the authors works at the agency now, I believe.