Abstract:

Yioop is an open-source web portal that works as a search engine and a discussion board. To function as a wiki system and as a discussion board, Yioop provides a group feature that allows users to create, join and share content with each other. Such a system must store and access data, so data security is essential. Apart from database security, Yioop generates statistical data that needs to be protected. The security mechanism also covers access restrictions to the groups as well as the data shared among group members. The main objective of this project is to protect user data and make the portal more secure. While Yioop has a security mechanism in place, the goal for CS297 was to extend it by implementing several security measures like differential privacy, secret sharing, and homomorphic encryption. These techniques will be incorporated into Yioop as part of the CS298 project.

CS297 Results

• Created an encrypted group in Yioop. Users and threads were added to this group to check how these changes reflect in the database
• Implemented differential privacy to mask the number of users in groups. This deliverable ensures that Yioop is protected against statistical attacks
• Secret sharing encryption scheme was implemented. The secret was split into a number of shares such that a user can have parts of the secret. A threshold number of users combining their shares leads to decrypting the secret
• A partially homomorphic encryption scheme was implemented (Paillier cryptosystem)

Proposed Schedule

Key Deliverables:

• Software
  • Build flagging feature for discussion board
  • Implement secret sharing encryption to support flagging
  • Implement homomorphic encryption technique to support voting feature in discussion board
• Report
  • CS298 Report
  • CS298 Presentation

Innovations and Challenges

• One of the challenges in the project is implementing the encryption techniques from scratch, without using external libraries
• Implementing the secret sharing encryption technique using finite field arithmetic requires a lot of research and a thorough understanding of the associated mathematics principles
• Homomorphic encryption algorithms are not mainstream, and there aren't many research papers published about Paillier encryption in particular. Implementing it as a voting mechanism requires a lot of time and research

References:

[1] C. Dwork, "Differential Privacy, 33rd International Colloquium on Automata, Languages and Programming, part II", 2006

[2] A. Shamir, "How to share a secret", Communications of the ACM, 612,613

[3] D. R. Stinson, M.R.Patterson, "Cryptograph Theory and Practice", 4th edition, page 467

[4] A. Acar et al., A Survey on Homomorphic Encryption Schemes: Theory and Implementation, Florida International University