Role-Based Ecosystem for the Design, Development, and Deployment of Secure Multi-Party Data Analytics Applications
No ratings
Presented at IEEESecDev 2019 by
Software applications that employ secure multi-party computation (MPC) can empower individuals and organizations tobenefit from privacy-preserving data analyses when data sharingis encumbered by confidentiality concerns, legal constraints,or corporate policies. MPC is already being incorporated intosoftware solutions in some domains; however, individual use casesdo not fully convey the variety, extent, and complexity of theopportunities of MPC. This position paper articulates a rolebased perspective that can provide some insight into how futureresearch directions, infrastructure development and evaluationapproaches, and deployment practices for MPC may evolve.Drawing on our own lessons from existing real-world deployments and the fundamental characteristics of MPC that makeit a compelling technology, we propose a role-based conceptualframework for describing MPC deployment scenarios. Ourframework acknowledges and leverages a novel assortment ofroles that emerge from the fundamental ways in which MPC protocols support federation of functionalities and responsibilities.Defining these roles using the new opportunities for federationthat MPC enables in turn can help identify and organize thecapabilities, concerns, incentives, and trade-offs that affect theentities (software engineers, government regulators, corporateexecutives, end-users, and others) that participate in an MPCdeployment scenario. This framework can not only guide thedevelopment of an ecosystem of modular and composable MPCtools, but can make explicit some of the opportunities thatresearchers and software engineers (and any organizations theyform) have to differentiate and specialize the artifacts and servicesthey choose to design, develop, and deploy. We demonstrate howthis framework can be used to describe existing MPC deploymentscenarios, how new opportunities in a scenario can be observedby disentangling roles inhabited by the involved parties, and howthis can motivate the development of MPC libraries and softwaretools that specialize not by application domain but by role.