The Importance of Privacy-Enhancing Technologies

Transcript

Hello, nice to meet everyone. Um, just a little bit about myself. I've been uh working in the blockchain space past seven years. Uh, building out the protocols and blockchain ecosystems now been with Partisia for two years. Uh, I've been living in SUK, Switzerland for seven years. Um, and excited to be here. So as I mentioned I'm talking about the importance of uh uh bravis enhancing technologies under the new uh GDPR guidelines for blockchains and what kind of architecture uh should a protocol uh keep in mind on or build on um to adhere all the to not only the GDPR but to all the uh data protection rules and

regulations around the world. So what is a public blockchain? um it is a combination of a database and a global network and that's why it's causing trouble with the with the data protection rules. So uh here are here is a highlight of the biggest hurdles and challenges for public blockchains. Uh we have um data provenence issues on uh how to ensure the receability of data while keeping the users uh anonymity. Uh we have data minimization requirements um to only use the um the selected data for the computation that is only necessary and essential uh not the entire data because currently the public blockchains

are basically providing a um database for absolutely all kinds of data. So um how to enable like selective disclosure. Then we have a data replication across global network in public blockchains. All nodes across the uh world are replicating all our data. uh and we have the hurdle and challenge of right to erasure. I would say this is the biggest one. Right to eraser and right to be forgotten. And um then we have the sodonymization problem. Um effective sodmization techniques are required to disassociate identities from their sensitive confidential data and user consent challenges.

So we believe that the web 2 actually has uh solved the regulatory requirement challenges and and it does have. So the GDPR once it was adopted in 2018 all the web 2 applications and uh services had to comply with them. So uh how does the architecture work there? We have we have a customerf facing infrastructure which can be called public network and it's the internet where users request a certain information and receive the output but only the transaction uh information will leave in the logs like the uh timestamped um log information of different internet devices like routers and uh and um and firewall and so on.

And then we have internet uh which is for example banks which actually store and hold the user financial information and the data and assets. Uh and through uh the internet uh this information will be then um rooted to the in internet um only the certain details which each individual user uh wants to get access to and has authorization to access to. uh and this is how it works and has been solved in the web two space and the internet is protected by firewalls and different other access authorization uh management.

Um so taking back a look on the on the current model. So if we talk about the transaction information then in the web two space or in enterprise space uh we have global network devices we have routers and firewalls which hold only the transaction data logs uh who connected to whom and the time stamps as I mentioned but in the web tree we have absolutely all kinds of user data like their wallet addresses uh the financial assets uh on their in their wallets uh which is all uh revealed on the public chain.

And the web three public blockchains they don't hold the actual assets and um sorry they hold the actual assets and user identifiable data on chain. So how the storage asset storage is handled currently it's uh in the web two world it's uh recorded and held on the enterprise internets and in their private uh networks and clouds and only the um and only the amount and transfer information is private and only the authorized uh users within the enterprise can access it and on the public chains um it's uh it's basically the source of truth uh all the assets Um uh wallet is just a mean uh for users to

basically have the UX UI uh for their for their portfolio but assets are also stored on chain. Um and how personal data is managed in web two uh it's held inside the enterprise database in the digital cloud and internet. uh but it's only accessible to to the either the internal enterprise users or if it's a public information then it's uh revealed via website to public uh users and in web three uh whatever is contained in the public blockchain all the user data is uh visible uh across the world on on the block explorer or network. But how it should be is uh by combining private

and public blockchain similar to what web two has done. We uh the the public blockchain should only hold the logs and transaction details while private blockchain keeps the data and assets. Um so uh and it's protected and verified by MPC which I'm coming uh and uh deep diving into a bit um which is a privacy enhancing technology and the actual assets uh should be recorded and held on the private blockchain but through uh multi-arty computation and the uh collaboration between public public and private um you will be able to see the logs and uh for audit purposes and transfer only that on the public side and uh the private blockchains should

hold the personal data uh with public blockchain only providing the conduit for users to be able to access and manage it. So uh coming back to what partisia has been building we have uh built our infrastructure since 80s uh with privacy by design compliant privacy. Uh one of our co-founders is Ivan Dumgard who's known for Merkel Dumgard hash function. Uh he's behind the inventions uh of Shiaan Shau algorithm as well as MPC uh multi-party computation.

uh we have uh many other uh top-notch cryptographers in our company and that have been now optimizing and developing multi-party computation over 37 years. We have uh thousands of uh commercial uh applications and more than thousand research papers. So we've launched the uh public permissionless uh blockchain in 2018 a bit later but we started off with the private network and we have incorporated the multi-party computation into our infrastructure to provide data collaboration data processing and management and share of confidential data uh whilst it's distributed there is no single um intermediary that has access to it. So it's a distributed form

of comput computation whilst uh keeping the secret data uh confidential and encrypted. Uh it's done so in a data being uh that is at rest that is in process and uh that is in transit. So we're also offering this MPC solution for other protocols for example. So we have the interoperability built in place and we do also offer it via an execution engine to uh web two applications um um which are based out of HTML um environment. So completely um versatile way of uh using it and leverage on MPC and uh so it goes way beyond zero knowledge proofs which most probably all

of you have heard of. Uh the problem with serial knowledge proofs is you can only use one user input and have a binary output. So you can verify if something is truth or false or someone is above a certain age, if someone is vaccinated, but that's only limited down to it and it's extremely expensive to scale it up to multiple users with multiple data inputs. So that's what MPC solves and uh we believe the compliant solution is a public and private uh hybrid network. This is what we have uh built several solutions out for NOS's, governments um enterprises um that want to uh move over to web tree but still keep the data uh encrypted and

and secured uh but want to compute on it and basically maybe collaborate with even competing institutions um that are across borders. So how it's done is we're keeping or we're sticking to the same principle as web two. It's just a different philosophy. So um the distinct uh we have clear division of public and private network. Uh but both are decentralized. So the private network is also processing the data in a decentralized manner where no one has uh no one has a um uh source of the data.

Uh it's distributed between different MPC nodes. So basically uh enterprises are able to use the public chain for accessibility and traceability and auditability uh but keep their secure and confidential processes um and internal data protected by the internet or the private blockchain which is uh only between uh trusted nodes and then the private and public network uh can collaborate uh between messaging protocol and the Smart contracts are also uh functioning between the both networks and with the with the smart contracts you're able to compute the MPC is extremely customizable. So you're able

to compute on who has the access like you're enable to customize the access management and which kind of data should be computed on what is the output because the output will be public to all these stakeholders. So we also have a jurisdiction management in place uh which is crucial to adhere to all the data protection rules. I'm speaking about the GDPR in this session but uh there are some other similar uh data protection rules um enforced uh around the world. We have uh GPTPA in India. Uh we have PIPA in Japan. Even uh California uh has CCPA and uh some several other jurisdiction has have enforced similar rules than

GDPR. So this MPC solution uh can be customized to adhere with all the other uh international data protection rules as well or that are specific to each uh uh location, geographical location. And uh how we run our public network is each node operator has to pass KYB process. So they are detecting their um jurisdiction that they run their node operation and once a application or a enterprise is um handling the processing of the confidential data which has to be limited down to only a certain uh jurisdiction or country then they can select the nodes uh which are specifically operating only in these

countries or uh geographical uh borders. Um so basically we're enabling through hybrid blockchain private uh public and private blockchain model uh with MPC and jurisdiction management a new type of uh data market or data market 3.0 O uh where public network uh is accessible by general public private network is accessible only by trusted parties similar to web 2 and uh it's all protected by multi-party computation uh we have worked uh with uh with Dan since early 2000s I mean most of the developer team is in our house in Denmark um and the we had a collaboration with the Danish statistics

uh and the health data uh authority. So they're collaborating using our infrastructure to provide the uh data which is disassociated from the specific specific uh patient uh for analysts to uh compute on different results um either um what is an outcome of a certain medication um consumption or healthcare treatment um and and so much more. We also have a use case currently running in out of Japan. Uh it's called digital platformer which is uh using this private public hybrid model to uh be able to detect fraud and money laundering and illicit activity between

different financial institutions um by uh enabling them to collaborate on financial data on a public network and uh keeping it all private adhering to the data protection rules. uh because currently the financial institutions are only limited down to the insights or in internally and uh that will open up the whole um process. It will simplify the process and uh um enable anti uh enabling uh financial pro detection in a much uh seamless more seamless way thanks to this infrastructure that we have in place. So we believe we have uh solved uh the compliance issues and regulation issues and uh that would be

the model we propose uh that has been proven to be efficient and adopted and uh we have also many other uh crypton cryptography methodologies um to provide customizable um privacy and uh I'm happy to have any questions if there are any questions answer. So I yeah you can reach out to me or reach out to us at vertisblockchain.com and thank you thank you so