A new approach to making privacy protections granular in existing business applications
SRI International has a track record of incubating new technologies and releasing them into new ventures backed by world-class researchers, including Nuance Communications, which was recently acquired by Microsoft for $19.7 billion. This stable of trailblazing tech spin-offs has a new addition in the form of Confidencial, Inc. The company will announce its move out of stealth mode at the RSA Conference in San Francisco.
Here is a look at how Confidencial’s forward-looking and seamlessly adoptable encryption technology will change and make the world of privacy more granular.
Who is behind Confidencial?
Karim Eldefrawy, along with colleague Razmik Abnous are co-founders of Confidencial. Karim joined SRI International in 2017, specializing in cybersecurity and cryptography. Razmik specializes in enterprise software and was a CTO of several companies, including industry-leading document management company, Documentum. The two were introduced when Eldefrawy and the team from SRI ventures began looking to transition two of the DARPA initiatives he was working on: a program developing privacy-preserving technologies for distributed and online systems named Brandeis PRIME (under the DARPA Brandeis program), and a program for secure and privacy-preserving communications named PRISM (under the DARPA program for Resilient Anonymous Communication for Everyone, RACE)
What is Confidencial?
The Brandeis PRIME project was the catalyst in the development of Confidencial. PRIME was designed to develop an answer to protect the privacy of data used during emergency relief planning efforts or similar settings involving multiple parties (potentially from different governments, entities or nations). Such data may include health information and digital identity. Balancing this privacy with access to data under emergency conditions is a challenge and a privacy conundrum.
The answer that SRI researchers came up with initially relied on Attribute Based Encryption (ABE). This is a form of highly granular encryption based on attributes that people satisfy (e.g., identities, position or role in organizations, or clearance and access level in defense and government settings), a sort of secured redaction that can control access to information in documents at the paragraph level. ABE, while mature and well-developed in research and academic literature, is not yet a standardized nor commercially deployed form of encryption. To be able to utilize such a solution in enterprises today, the team had to rethink its solutions to instead leverage standardized (e.g., by the National Institute of Standards and Technologies, NIST) encryption schemes.
An academic paper (which can be found here) describing the initial research efforts will be presented on June 30th at the 6th International Symposium on Cyber Security, Cryptology and Machine Learning (CSCML 2022).
During the research into commercializing Brandeis PRIME, Abnous realized that this privacy conundrum was not just an issue for the military or the government. As an enterprise software expert, he saw the potential for wider applications of the solution. Currently, over 1 million organizations use Microsoft Office, including SRI. Abnous determined that the need to share parts of documents selectively is a pervasive problem and something that could benefit any company.
Abnous explains some of its applications within a privacy regulation context:
“During an application for a mortgage, a mortgage company will ask for your social security number, credit card information, etc. The information may be protected by the company, as regulations require; however, many people inside the company have access to that information. Confidencial can allow this personal information to be shared but enforce limiting the access to such data to a need-to-know basis. Confidencial also gives visibility of access events so that the heads of privacy and security at these organizations have auditability and traceability.”
Many industries need a granular privacy solution, including pharmaceuticals and healthcare. An example is drug development, such as the Pfizer vaccine for COVID. Drug R&D typically collaborate with other biotech companies, hospitals and multiple contract manufacturing companies, where sensitive information tied to clinical trials is shared amongst the collaborators. This information takes many forms, such as clinical trial results or intellectual property (IP). Companies may well encrypt the folders, documents or databases containing such data. However, the entire document is still fully available to anyone with access (and keys) to it. Making this information selectively and easily accessible, on a need-to-know basis and in a granular manner, which provides the flexibility to share and maintain privacy of sensitive data.
Many other sectors will benefit from the selective disclosure of protected information, including banking and financial services. These organizations typically use many spreadsheets that hold sensitive information tied to financial reporting for a company. In addition, many stakeholders share and collaborate on these spreadsheets, for example, during a tax filing or audit. As a result, the financial service organization will want to protect certain parts of the spreadsheet but make other components available per user.
Confidencial and zero-trust security
The design of Confidencial is user-centric. Therefore, deployment and usability have been key design remits. Eldefrawy explains:
“Encryption involves key generation; how are the keys generated and stored? How do you plug into real-world systems when you deploy was one of the big challenges of designing Confidencial. Any new solution must seamlessly work within an existing enterprise infrastructure. In addition, most enterprises also use identity and access control management systems. The most widely used being Microsoft Active Directory (AD) and Azure AD in the cloud. A major challenge for Confidencial was seamlessly and transparently integrating with popular enterprise applications so large organizations can easily enroll hundreds of thousands of people and generate keys in a secure manner. The other key technology challenge was the usability of the solution. For example, managing remote workers and access control outside the enterprise perimeter.”
The answer to these challenges was to make Confidencial a plug-and-play software-only technology. The solution delivers provable security and privacy guarantees and is part of a zero-trust security approach. In addition, the technology integrates seamlessly into the Microsoft Office suite (and similar platforms such as Google Workspace and PDF editors) for ease of deployment and use. Confidencial’s use of cryptographic standards is in a black-box manner, i.e., the platform does not depend on the exact internal details of the encryption algorithms, and thus can accommodate several standards; the platform is also designed to be future-proof and evolve with the enterprise as new quantum-safe cryptographic standards are ratified, once the NIST post-quantum cryptography (PQC) standardization process is finalized.
Eldefrawy said, “employees can continue to use the tools and the interfaces they are familiar with. This means that Confidencial does not require any changes to how the employee works or any onerous training.”
How to stay Confidencial
Confidencial has completed an oversubscribed seed round. In addition to SRI International, seed round investors include WERU Investment, First Spark Ventures, Airstream Venture Partners, Perot Jain, and Brandin Cooks. Confidencial had previously raised a pre-seed round in April of 2021 with SRI International and MDSV. The official announcement of Confidencial and the launch of its website will be made public at the RSA Conference (June 6 to 9, 2022). Interested parties and early adopters can register for the beta version at www.confidencial.io.
