Chapter 13 - Chip-Secured Data Access: Confidential Data on Untrusted Servers

Abstract

The rapid growth of ubiquitous computing impels mobile users to store personal data on the Web to increase its availability. In the same way, corporate databases are made increasingly accessible to authorized employees over the Internet. Small businesses are prompted to delegate part of their information system to Web-hosting companies or database service providers (DSP) that guarantee data resiliency, consistency, and high availability. Confidential data threatened by attackers is manifold: information related to the private life of individuals (for example, agenda, address book, bookmarks, medical records, household expenses), credit card numbers, patents, business strategies, diplomatic, or military secrets. Even ordinary data may become sensitive once grouped and well organized in databases. Customers have no other choice than trusting DSP's argument that their systems are fully secured and their employees are beyond any suspicion. However, according to the “Computer Crime and Security Survey” published by the Computer Security Institute (CSI) and the FBI, the theft of intellectual property due to database vulnerability costs American businesses $103 billion annually, and 45% of the attacks are conducted by insiders.