Kinamik is a software company that provides a solution called Secure Audit Vault to verify the integrity of electronic records. The solution builds tamper-evident registries to detect any changes to records in order to facilitate regulatory compliance, reduce costs of e-discovery and forensics, and deter insider threats. Kinamik's approach focuses on data integrity rather than perimeter security alone. The company was founded in 2005 and has filed several patents on its cryptographic algorithms and intellectual property.

1. El proyecto ARES (Seguridad y Privacidad de la Información) y la creación de empresas de base tecnológica Prof. Josep Domingo-Ferrer Dr. Jordi Castellà-Roca Universitat Rovira i Virgili, Tarragona Universidad Internacional Menéndez y Pelayo 20 de julio del 2009

2. Index Ares Research Team Research Themes Critical Infrastructure Protection Ubiquitous Computing Secure Electronic Transactions Digital Rights Management Private Data Management Conclusions Ares Leitmotiv First Year Scientific Indicators Kinamik Basic facts Vision, mission and goal Company profile and history Very strong market dynamics Our rationale: paradigm shift from perimeter to data level security Key drivers for better data governance Our product: Secure Audit Vault Business benefits Why are we different? R&D: open innovation Conclusions

3. Research Team ARES is composed of research groups from: Universitat Rovira i Virgili Universitat Politècnica de Catalunya Universidad de Málaga Universitat Oberta de Catalunya Consejo Superior de Investigaciones Científicas Universitat de les Illes Balears

4. Research Team Formed by 78 researchers Out of which 51 holding a Ph.D. Average age: 35 years Project duration From October 2007 to September 2012

5. Research Themes Main Objective “ Develop new technology for protection of privacy in the information society ” Research Lines: Critical infrastructure protection Ubiquitous computing Electronic transactions Digital rights management Private data management

6. Critical Infrastructure Protection Priority for homeland and corporate security: Airports, power plants, hospitals, financial facilities, etc. They depend on the safe operation of the information systems that control them

7. Critical Infrastructure Protection Infrastructure protection by means of sensor networks Constrained computational power Hostile environment solutions Key management Node failure detection A. Viejo, F. Sebé and J. Domingo-Ferrer, "Secure and Scalable Many-to-One Symbol Transmission for Sensor Networks". Computer Communications . Vol. 31, pp. 2408-2413. Jun 2008. ISSN: 0140- 3664.

8. Critical Infrastructure Protection Security primitives in sensor nodes Classification of sensor nodes Analysis of suitable security primitives for sensor nodes R. Roman, C. Alcaraz and J. Lopez, “A Survey of Cryptographic Primitives and Implementations for Hardware-Constrained Sensor Network Nodes” Mobile, Networks and Applications (MONET) Vol. 12, pag 231-244, Springer, 2008, ISSN 1572-8153. Clase I Clase II Clase III 4 Mhz (8 bit) - 1 kB RAM - 16kB ROM 4~8 Mhz (8~16 bit) - 4~10 kB RAM - 48~128 kB ROM 13~180 Mhz (32 bit) - 256~512 kB RAM - 4~32 MB ROM

9. Critical Infrastructure Protection Protecting Critical Infrastructures through WSNs Analysis of characteristics and operations of WSNs for the protection of CIs Support for Early Warning Systems (EWS) & Dynamic Reconfiguration Systems (DRS) New challenges: support services, trust/security management, secure control systems and assessment mechanisms - J. Lopez, C. Alcaraz and R. Roman, “On the Protection and Technologies of Critical Information Infrastructures”. En Foundations of Security Analysis and Design Tutorial Lectures, pp 160-182. LNCS 4677. Springer, October 2007, ISBN 978-3-540-74809-0. - C. Alcaraz, R. Roman and J. Lopez , “Análisis de la Aplicabilidad de las WSN para la protección de Infraestructuras Críticas”, VII Jornadas de Ingeniería Telemática (Jitel 2008), Alcalá de Henares, Spain, September 2008.

10. Critical Infrastructure Protection Remote integrity checking of backup data Cost-efficient solutions Data privacy concerns F. Sebé, J. Domingo-Ferrer, A. Martínez-Ballesté, Y. Deswarte and J.J. Quisquater, "Efficient remote data possession checking in critical information infrastructures". IEEE Transactions on Knowledge and Data Engineering. Vol. 20, pp. 1034-1038. Aug 2008. ISSN: 1041-4347.

11. Critical Infrastructure Protection Intrusion Detection Systems Analysis of network traffic for attack detection Data collection preserving user privacy Agent-based solutions - J. Garcia-Alfaro and G. Navarro. "Prevention of Cross-Site Scripting Attacks on Current Web Applications". Lecture Notes in Computer Science. Vol. 4804 (On the Move to Meaningful Internet Systems 2007: CoopIS, DOA, ODBASE, GADA, and IS), pp. 1770-1784, Nov 2007, Portugal. ISSN: 0302-9743. - R. Páez, J. Tomàs-Buliart, J. Forné, M. Soriano, “Securing Agents against Malicious Host in an Intrusion Detection System”, 2nd International Workshop on Critical Information Infrastructures Security (CRITIS), 2007.

12. Ubiquitous Computing Privacy in RFID-tagged shopping Tagged products can be traced thus jeopardizing buyer privacy Research on privacy-preserving tag identification A. Solanas and J. Manjón, "Deployment of RFID Readers for the Scalable Identification of Private Tags: a Simulation Study". RFID Security: Techniques, Protocols and System-On-Chip Design . 2008. ISBN: 978-0-38776-480-1.

13. Ubiquitous Computing Security and privacy in RFID-enabled personal documentation RFID in traditional paper-based documentation provides advanced features and a seamless link to the information system Advanced security mechanisms required to protect the identity and the personal information of bearers. - P. Najera, F. Moyano and J. Lopez, "Security mechanisms and access control infrastructure for e-Passports and general purpose e-documents". Journal of Universal Computer Science, Special Issue on Data Security and Privacy Protection in Pervasive Computing environments. To appear - P. Najera, F. Moyano and J. Lopez, "Secure Integration of RFID Technology in Personal Documentation for Seamless Identity Validation" in 3rd Symposium of Ubiquitous Computing and Ambient Intelligence 2008. pp. 134-138. Series: Advances in Intelligent and Soft Computing , Vol. 51, Springer. 2008. ISBN: 978-3-540-85866-9

14. Ubiquitous Computing Location Based Services User devices receive information depending on their location Technology solutions protecting users from tracing are needed A. Solanas and A. Martínez-Ballesté, "A TTP-Free Protocol for Location Privacy in Location-Based Services". Computer Communications . Vol. 31, pp. 1181-1191. Apr 2008. ISSN: 0140-3664.

15. Ubiquitous Computing Mobile Ad-Hoc Networks Decentralized networks Research on Routing technology in hostile environments Certificate Validation Trust models - J. Forné, J. L. Muñoz, F. Hinarejos, O. Esparza, "Certificate status validation in mobile ad hoc networks". IEEE Wireless Communications, February 2009. - M. Mejia, N. Peña, J. L. Muñoz, O. Esparza, "A review of trust modeling in ad hoc networks". Internet Research, Vol. 19 No. 1, pp. 88-104. 2009

16. Ubiquitous Computing Vehicular Ad-Hoc Networks Car-to-car communications permit: Real-time alerts about dangers (braking, lane changes, etc.) Announcements about traffic conditions (jams, icy roads, etc.) Privacy must be kept by preventing driver tracking V. Daza, J. Domingo-Ferrer, F. Sebé and A. Viejo, "Trustworthy privacy-preserving cargenerated announcements in vehicular ad hoc networks". IEEE Transactions on Vehicular Technology, 58(4):1876-1886, 2009.

17. Secure Electronic Transactions Research on security and privacy of electronic transactions Legal aspects of electronic transactions Electronic payment systems Electronic contracts Formal validation of protocol security Private information retrieval - A. Martínez Nadal, “Comentarios a la ley 59/2003 de firma electrónica”. CIVITAS EDICIONES, S.L. ISBN: 978-84-470-2221-2. - J. Castellà-Roca and A. Vives-Guasch, “Billetes electrónicos seguros”. Reunión Española de Criptología y Seguridad de la Información (RECSI) , pp. 141-150. 2008. ISBN: 978-84-691-5158-7.

18. Secure Electronic Transactions Private Information Retrieval User queries to Internet search engines reveal user habits Research on query anonymization: Query masking P2P-based query anonymization - J. Domingo-Ferrer, A. Solanas and J. Castellà-Roca, "h(k)-Private Information Retrieval from Privacy- Uncooperative Queryable Databases". Online Information Reviews. To Appear. - J. Domingo-Ferrer, M. Bras-Amoròs, Q. Wu and J. Manjón, "User-Private Information Retrieval Based on a Peer-to-Peer Community”. Data & Knowledge Engineering. To Appear.

19. Digital Rights Management Intellectual property of digital content has to be protected P2P file sharing makes content redistribution very easy

20. Digital Rights Management Research on Copy Detection Systems Watermarking Copyright information embedded into digital content Fingerprinting Security against collusion by dishonest buyers M. Fallahpour, D. Megías, “Reversible Data Hiding Based On H.264/AVC Intra Prediction”. Lecture Notes in Computer Science (IWDW 2008). ISSN: 03029743. J. Tomas-Buliart, M. Fernández, M. Soriano “Protection of mobile agents execution using a modified Self- Validating Branch-Based Software Watermarking with external sentinel” in CRITIS, Frascati, Oct. 2008.

21. Private Data Management Electronic transactions permit automatic collection of large amounts of personal data Sharing and publishing personal data must be compatible with individual privacy - Transfer Contracts: EUROSTAT, IDESCAT - Spin-Off: STAITEC

22. Private Data Management Secure Data Mining Research on: Data masking methods Record linkage algorithms Privacy preserving data mining - J. Nin, J. Herranz, V. Torra, "Rethinking Rank Swapping to Decrease Disclosure Risk". Data & Knowledge Engineering. Vol. 64, issue 1, Pages 346-364. Jan 2008. ISSN: 0169-023X. - J. Domingo-Ferrer, F. Sebé and A. Solanas, “An anonymity model achievable via microaggregation”, LNCS 5159, pp. 209-218, Aug. 2008. Vol. 5th VLDB Workshop on Secure Data Management-SDM 2008, Berlin: Springer- Verlag No 1,77 77 32 Yes 1,68 70 35 Yes 1,55 63 25 Result Height Weight Age (···) (···) (···) 1,77 77 Anna (···) (···) (···) Height Weight Name

23. Conclusion Information society has to stay secure to survive. Security will progress even without public support … … but privacy technology has less commercial appeal. Information society must respect privacy to stay human.

24. ARES Leitmotiv “ National and corporate security” vs “ Individual Privacy”

25. First Year Scientific Indicators 8 5 Ph.D. Theses 18 12 Intergroup publications 16 10 New funded projects 1 1 Patents 93 60 Book Chapter or ISBN conferences 81 60 ISI JCR journal articles or LNCS Actual Objective

26. First Year Scientific Indicators Researchers who have joined ARES: Post-doctoral grant holders: Qianhong Wu from China Roberto Di Pietro from Italy Guillermo Navarro from Spain David Rebollo from Spain Pre-doctoral grant holders: From Spain: 8 From China: 1 From Cuba: 2 From Sweden: 1 From Romania: 1 From Iran: 1

27. Kinamik Data Integrity

28. Basic facts Kinamik is a software development company specialized in providing solutions that collect, secure and seal sensible digital records and makes them tamper-evident. We play in the Data Governance space. Kinamik’s integrity focus will improve data quality for e-discovery, compliance, forensics and information security processes (GRC) Our software provides an irrefutable proof that a record has not been changed since its creation, regardless who creates, manages, collects or stores this information. This approach makes data trustworthy without any possibility of contesting its integrity and validity.

29. Vision, mission and goal Vision ALL organizations will eventually implement independently verifiable tamper-proof registries for sensitive electronic records in order to: protect against internal malpractice, meet compliance guidelines, show good conduct to regulators and courts of law demonstrate transparency in their operations. Mission Provide an easy way to answer a tough question: How do I know that the digital records I am looking at are correct? Goal Become the de-facto standard for tamper-proofing electronic records and trustworthy sources of information for auditing best practices

30. Company profile and history Company History and Background Kinamik started its activities in late-2005 Spin-off from Scytl Using internationally-recognized standard cryptographic algorithms and owned intellectual property, Kinamik designed and developed a solution that provides a tamper-evident seal for electronic records Six patents have been filed between 2005 and 2008 In 2007 Kinamik was a Red Herring 100 finalist; nominated for the ICT European Technology Prize in 2007 and semifinalist for the Eurecan 2008 VC-based, three capital rounds

31. Very strong market dynamics

32. Our rationale: paradigm shift from perimeter to data level security The security industry has been running backward, starting at the edge (perimeter security) and working its way to the data itself 3 fundamental reasons why perimeter security only will not work: Attackers are more savvy walking through the many holes of firewalls… Insider threats are becoming more important than external threats (tipping point) The notion of perimeter is changing: SOA, SaaS, Grids, Virtualization are eliminating the borders, increasing data mobility If data gets corrupt, billions of dollars of investment (in perimeter security) would be protecting rubbish… or worse, fraud!

33. Key drivers for better data governance Regulations, compliance with laws and internal security policies are mandating better data management and correctness Complexity of systems and varied sources of information create greater manipulation vulnerabilities Virtualization, globalization means losing control of data Perimeter security is tightened, threats are moving inside The key is data integrity

34. Our product: Secure Audit Vault What is it? A market-leading software solution that provides irrefutable proof of integrity on electronic records at a fine granular level. It helps organizations reduce audit and compliance costs, mitigates insider threat and gives legal admissibility and best-evidence in case of litigation. What does it do? Kinamik systematically builds tamper-evident registries of trustworthy information that hold even the most privileged users (system administrators) accountable for their actions. Our solution can detect any intentional or unintentional electronic record tampering at a level of granularity unique in the market. It is also able to handle large amounts of data without generating significant overhead. While processing electronic records, Kinamik’s software builds a centralized repository secured down to record level.

35. Business benefits Four drivers: Cost in e-evidence and forensic processes is growing at great speed, and so is number of litigation  Kinamik provides the best legal evidence of digital information in case of any need Regulatory compliance requires data integrity best practices (SOX, PCI DSS, HIPAA, GLBA, Data Privacy Directives…)  Kinamik facilitates compliance processes for organizations Insider threats & Privacy protection  Kinamik helps deterrence of insider threat by systematically building tamper-evident registries of trustworthy information, holding even the most privileged users (system administrators) accountable for their actions. Forensics and auditing processes  Kinamik reduces workload costs by providing a secure and centralized data repository for all sensitive data

36. Why are we different? We have designed, developed and optimized a product that: can detect any change of data at fine granular level can handle a very large amount of data is seamless to integrate in any IT environment does not generate significant overhead We build tamper-evident registries of trustworthy information We notarize data and help building trust in Information Sharing Environments

37. R&D: open innovation How do we develop and collaborate? Internal team for strategic decisions (roadmap definition), design, development and testing External validation of our software In some cases, implementation Applying for research project grants (EU-7FP)

38. R&D: open innovation How does the CRISES-URV help us? Apply the academically needed balance for a private VC-based start up to deploy accurate solutions to the market Technical reports: Report on KNotary Technical Basis (KTB) Analysis and updates to the KTB to obtain an accurate and quality document. Suggestions and recommendations for further work (KTB): Internal report for Kinamik describing additional analysis work efforts required and other suggestions. Code validation: Evaluación del algoritmo de escalado de una secuencia de números pseudoaleatoris dentro de un rango fijado Revisión del modelo de datos correspondiente a la aplicación kNotary de registro seguro The objective was to review the data model of the Knotary Application for secure registration (Immutable Audit Logs) Development of new technology needs (i.e. Feed for Sun Solaris) Remote audit trail storage for OpenSolaris Master thesis projects: the student may be hired once the project is complete.

39. Conclusions Spin-off of Scytl (VC-based) Secure Audit Vault Verifiable tamper-proof registers for sensitive electronic records Irrefutable proof of integrity on electronic records at a fine granular level Able to handle large amounts of data Forensic and auditing processes Research and Development URV-CRISES

40. Thanks for your attention