trustcorp THE CHALLENGE OF TRUST IN THE DIGITAL AGE

Transcription

1 THE CHALLENGE OF TRUST IN THE DIGITAL AGE Copyright, 08

2 AGENDA. THE DIGITAL TRUST. THE NEED FOR PRIVACY. PUBLIC BLOCKCHAIN? YES BUT 4. A PRAGMATIC SOLUTION FOR A NEW ECONOMY copyright, 08

3 . PUBLIC BLOCKCHAIN? YES BUT copyright, 08

4 6 MAIN CRITERIA FOR GDPR COMPLIANCE Guarantee the security of all data collected, processed and stored Guarantee to individuals access, modification, restitution and erasing their data 6 Notify the National Authority under 7h in case real risk of protection of private life infringement GDPR Collect and prove the informed consent of individuals 5 Document all protection measures and procedures Secure data against the risk of loss, theft or disclosure 4 Copyright Trustcorp, 08 4

5 99 ARTICLES, CHAPITRES Transfert de données à caractère personnel (hors UE) Autorités de contrôles indépendantes Coopération et cohérence Responsable traitement et sous-traitant Voies de recours, responsabilités et sanctions Droits de la personne concernée Dispositions pour des situations particulières de traitement Principes Actes délégués et actes d exécution Dispositions générales Dispositions finales copyright, 08 5

6 CYBER SECURITY LAWS DOMAINS TOTAL LAW GDPR Personal Data Protection LAW e.idas Personal Advanced Signature LAW NIS Interoperability Responsibility - Operational constraints Compulsory computer functions Obligations of result Articles of law / Obligations of result Section of the Act / Recommendations TOTAL ITEMS % % 77 55,6% 87 7,55% 7 4,45 % copyright, 08 6

7 GDPR ENFORCEMENT Source: Copyright Trustcorp, 08 ( 7

8 TOUS LES DOMAINES E CONOMIQUES SONT CONCERNE S PAR LA TRANSFORMATION NUME RIQUE Maturité numérique du secteur MÉDIAS TOURISME BANQUE DE DE TAIL DISTRIBUTION BIENS DE GRANDES CONSOMMATION SANTÉ AGRICULTURE SECTEUR PUBLIC CONSTRUCTION copyright, 08 8 Évolution dans le temps Source : McKinsey France, 05

9 LE BAROMÈTRE DES SANCTIONS Amende de 0M ou 4% CA Global Non-respect des principes de la protection des données personnelles Infraction aux règles applicables au consentement Infractions aux transferts de données hors de l EEE Amende de 0M ou % CA Global Absence de protection des données dès la conception et par défaut Défaut de sécurité des données Absence de notification des violations des données Absence de registre des traitements Non-respect des règles de désignation du DPO er avertissement par écrit Copyright Trustcorp, 08 9

10 PUBLIC BLOCKCHAIN HOW IT WORKS? Someone requests a transaction The requested transaction is broadcasted to a PP network of computers (the nodes) VALIDATION The network of nodes validates the transaction and the user s status using know algorithm A verified transaction can involve crypto currency, contract, records or other information The transaction is completed The new block is then added to the existing blockchain, in a way that is permanent and unalterable Has no intrinsic value in that it is not redeemable for another commodity such as gold CRYPTOCURRENCY Copyright Trustcorp, 08 0 Has no physical form and exists only in the network Its supply is not determined by a central bank and the network is completely decentralized

11 PUBLIC BLOCKCHAIN POINTS OF ATTENTION Someone requests a transaction The requested transaction is broadcasted to a PP network of computers (the nodes) VALIDATION The network of nodes validates the transaction and the user s status using know algorithm A verified transaction can involve crypto currency, contract, records or other information The transaction is completed The new block is then added to the existing blockchain, in a way that is permanent and unalterable Has no intrinsic value in that it is not redeemable for another commodity such as gold CRYPTOCURRENCY Copyright Trustcorp, 08 Has no physical form and exists only in the network Its supply is not determined by a central bank and the network is completely decentralized

12 THE REALITY ON DECENTRALIZATION The entire blockchain for both systems (Bitcoin and Ethereum) is determined by fewer than 0 mining entities. Source: Decentralization in Bitcoin and Ethereum Networks, Financial Cryptography and Data Security 08 ( % of mining capabilities coming from data centres. 58% 8% Copyright Trustcorp, 08

13 A QUESTION OF NATIONAL SOVEREIGNTY vulnerable national sovereignty Source: (on August, 08 at 5:09 CET) One country running the show! Copyright Trustcorp, 08

14 A QUESTION OF INDEPENDENCE Source: (on August, 08 at 5:09 CET) no strategic independence +7% of the blocks under the control of 4 miners Copyright Trustcorp, 08 4

15 THE REALITY ON SECURITY The cost of the deanonymisation attack on the full Bitcoin network is under 500 Source: Deanonymisation of clients in Bitcoin PP network, ACM Conference on Computer and Communications Security, 04 ( NO BINDING SECURITY WITH DEEP CONTROL Miners have strong influence on transaction management as they can:. Censor transactions ( DoS). Re-order transactions ( front-running) Source: Security challenges in Ethereum smart contract programming Sergei Tikhomirov, CLUSIL Blockchain series Installment #4 Luxembourg, 7/9/07 ( Copyright Trustcorp, 08 5

16 BUILDING A PROFITABLE BUSINESS MODEL? PRICING BASIC PRINCIPLE Ethereum transaction fees based on ETH rate. Highly fluctuating and not regulated. Bill of Material Cost speculative solution unacceptable by industry Strategy led by banks favorable to speculation and trading!!!! Development Cost Overhead Source : on August, 08 at 6:47 CET Copyright Trustcorp, 08 6 Price of a service/product is negotiated up-front with the customer and cannot handle the fluctuations of ETH. Service/ Product Price

17 A CLEAR NEED FOR INTEROPERABILITY A PAYMENT TRANSACTION ACROSS MULTIPLE "LEDGERS» ISSUES Unpredictable (slow) delivery Manual customer service Unpredictable (high) cost High exception rate Copyright Trustcorp, 08 7 WAYS TO ADDRESS THE PROBLEM: () Homogeneization Hard to achieve () Interoperability Hard to implement and maintain inside each blockchain architecture Easier to implement and maintain via a third party solution Source:

18 AND... PUBLIC BLOCKCHAIN CANNOT ENFORCE GDPR Total transaction privacy? Data are visible to anyone. Blocks are public. Even if it is encrypted. Right to be forgotten? Infrastructure maintained by known/trusted entities? Blocks are immutable. Impossible go back in the past. GDPR By construction, there is no a priori trust established in the public blockchain. A consensus must be established. Proof of identity? Copyright Trustcorp, 08 8 There is no identity check in the public blockchain.

19 LES BLOCKCHAINS PRIVÉES AUSSI... Dans le contexte de la conformité au RGPD (depuis le 5 mai 08) Blockchain sans permission (publique ex., BITCOIN) Blockchain avec permission (privée ou consortium) La Blockchain ValeSign (supervisée et de confiance). Accès «offline» Non Possible Oui. Validation indépendante de l infrastructure. Transactions totalement confidentielles 4. Infrastructure maintenue par une entité connue et de confiance 5. Coût raisonnable (faible coût de transaction) 6. Rapide (validation rapide d une transaction) Non Non Oui Non Non Oui Non Oui Oui Non Oui Oui Non Oui Oui 7. Preuve d identité Non Possible Oui (esignature qualifiée) 8. Droit à l oubli (possibilité d effacer une information) Non Non Oui copyright, 08 9

20 THE 7 MAIN TECHNOLOGIES NECESSARY FOR GDPR REGULATION. New Communication Method: Security Double (Authentication and Qualified Seal + Revocation Lists). New Signature Advanced : Legality Double (Individual and Notary). New Encryption Process: Secret Double (Symetric and Asymmetric combined together) 4. New Validation Process: Blockchain Trinary (Seal, Encryption, Advanced Signature combined) 5. New Rooming Framework: Interoperability Trinary Qualified Controllers/Processors/Validation Parties 6. New digital Governance-Sovereignty: Justice Trinary (Law/Code of Conduct/Private Agreement) 7. New Cross border Market Places: real time scheduling Multilateral copyright, 08 0

21 copyright, 08 SEQUENCES TRUST SERVICE CONTROLLER OPERATOR PROCESSOR VALIDATION CERTIFICATIO N PARTY OPERATOR PROCESSOR TRUST SERVICE CONTROLLER SEQUENCES DYNAMIC AGILE PRIVATE BLOCKCHAIN IN FULL INTEROPERABILITY BETWEEN APPOINTED -QUALIFIED CONTROLLERS and PROCESSORS..

22 THE FUTURE OF (PUBLIC) BLOCKCHAIN... Research concludes that blockchain will escape from cryptocurrencies and drive standalone applications/utilities for financial services. Source: Turns into a fad (like Secondlife) Remains a niche payment instrument Currency Blockchain Currency Blockchain Ushers in "Trustless» world Low adoption and high risk Value collapsing Technology buzz Strict regulation reducing scope of use Central banks control the currency aspect Blockchain is adopted as a record keeper Volume handling limit do not enable scaling Decentralization concept do not scale and blockchain is processed on traditional systems Becomes the de facto standard for all financial transactions Probability 5% 75% 60% 0% 0% Time to event - years - years - years 5-0 years 0-0 years Copyright Trustcorp, 08

23 MAKE THE RE-ENGINEERING OF THE BLOCKCHAIN TO BE STRONG AND COMPLIANT GDPR, e.idas & NIS. copyright, 08