Cryptographic Enforcement of Language-Based Information Erasure – Københavns Universitet

Cryptographic Enforcement of Language-Based Information Erasure

Talk by Aslan Askarov

All are welcome!

Abstract:

Information erasure is a formal security requirement that stipulates when sensitive data must be removed from computer systems. In a system that correctly enforces erasure requirements, an attacker who observes the system after sensitive data is required to have been erased cannot deduce anything about the data. Practical obstacles to enforcing information include: (1) correctly determining which data requires erasure; and (2) reliably deleting potentially large volumes of data, despite untrustworthy storage services.

In this work, we present a novel formalization of language-based information erasure that supports cryptographic enforcement of erasure requirements: sensitive data is encrypted before storage, and upon erasure, only a relatively small set of decryption keys needs to be deleted. This cryptographic technique has been used by a number of systems that implement data deletion to allow the use of untrustworthy storage services. However, it has not been related to the formal foundations of information erasure until this work. In particular, we study a programming language extended with primitives for public-key and shared-key cryptography, and demonstrate how information-flow control mechanisms can automatically track data that requires erasure and provably enforce erasure requirements even when programs employ cryptographic techniques for erasure.

— Joint work with Scott Moore, Christos Dimoulas, and Stephen Chong.

Bio:

Aslan Askarov is an Associate Professor in the Logics and Semantics group in the Department of Computer Science at Aarhus University. Prior to joining AU in the August of 2014, he was a postdoctoral fellow at Harvard University, and was previously a postdoctoral associate at Cornell University. He received a PhD from Chalmers University of Technology in Gothenburg, Sweden in 2009. Aslan's research interests include computer security, programming languages, and systems.