cNFT, a toolbox for producing confidential NFT

Transcript

everything's set up i'll give you a thumbs up one minute hi everyone so it's always a pleasure to be at scc in paris um thanks again for the the invitation and the organization um so today we're going to present you uh a new product we are working on it's called confidential nft cnft and in this talk we'll talk about personal data web-free how do we maintain ownership and confidentiality

over our own data so let's start so yeah today um the outline of the talk is the following so first i will introduce personal data and the issues with um web free then i will present the technology we are developing today which is called cnft for confidential nft and we see that it's a full privacy preserving solution and next i will give a short introduction a short overview of a new product we are working on which is called exec personal data wallet and we will see that hope people can actually use this um

this um you know this new concept right so web free so um i will start with the definition that gavin wood gave um a few times a few years ago so weber is a decentralized internet where users can control their own data identity and destiny and today we are going to focus really on how users can control their own data in this web-free way of doing things so with webfree we say that users should allow to maintain ownership and privacy over their personal data first thing

and then the next thing which is super important is that they can should be able to decide who can use their personal data and they should able to control somehow how people are going to use it towards the intended usage of their data and basically this is what we're going to to solve so first we did a sort of survey of web2 users how do they feel now with respect to their personal data and the result is probably unsurprising for you first we have discovered that user had kind of bad experience about the way you know a service like the gear farm

are handling their personal data and typically you know when they see targeted ads they understand that somehow google facebook have learned a lot about them and they are kind of you know forging them on internet for them when we ask about you know the use of their personal data and their feeling the feeling were quite negative actually so you can see that people are aware of the problem so you know they mention a problem first they are not satisfied there are words such as displeasure they feed that insecure etc so basically we have to change and we are building a system to address those issues

and really what came up from this survey is that there is really a sense of being powerless so people are really um yeah they can't do anything with that you know they are sending their data to facebook they understand that this is not so right but they can do anything and be why is that it's because basically the web 2 was about a very simple model which is you give me your personal data and i offer you a service so the question now is how can we change that and what should we change and if we say to people now you're going to to to have more control over your data what does it mean for you and this is

the question we asked to users and basically they say controlling my data it's having more information first more information about who is doing what my data and having also more control and so the problem we are solving or trying to solve with this this new product is how can we help users to share their data when using applications while maintaining their ownerships and confidentiality over their data so i will explain those those words in more in detail so just just now but first we need to understand how web

free is going to handle personal data so we went to you understand everything is on the you know facebook servers and and the model is very known basically facebook has everything here obviously it's going to be a little bit different so here we distinguish between two different kind of information those that are unchained so that could be typically your wallet address that could be your ens name and those that are optioned what you will find option is basically information or files in these files you can have information that are related to you could be your name address phone number email address etc can have personal files that you need

for you know accessing web free services so imagine that in the future some defy protocols are going to be regulated they would probably ask for some kyc and we just can't still do as kind of a decentralized kyc and that's something possible and of course people will come with their own assets so their own files that are going to share with their friends or to monetize but what's important is that those files are not going to be on centralized servers obviously as remember the definition of web free these are going to be decentralized and of course what is super important is that for all those options files and information we must maintain

ownership and privacy and that's even more important for rep for free than web 2 in the sense that here you can need personal information with the public information and the blockchain you have all kind of information in particular you know the money people have for instance so that's super important to to make those things really private so understand confidential nft so for us you have files that are offshoring and those files information are represented by nft contract on chain and what we call data ownership it's when a user owns the data owns the nft can use the data can transfer the

ownership of the data and contrast can transfer the ownership of the usage of its data confidentiality confidentiality sorry it's obviously the fact that no one can spy on the data unless they have been authorized what's really important to understand is that to maintain confidentiality you really need to understand who can who is going to use and and the usage of the data in particular for us what's important is to to to to focus on the applications that use the data if i just send a data to a friend there is no way i can ensure that this data remain confidential

so for us the the the key point is that we do you we have to represent the application and the way data are used is always through an application so what we call data usage an application using your data as an input to produce computing results for a third party and once you have all those things the next step is to establish governance rules governance rules for user for owner of a data to express by some mean how people are going to use this data our applications are going to use the data and the conditions and the conditions can be accessed right or at least

blacklist and eventually also monetization so giving a price for use for using the data so how does cnft works there are three three main components for making a confidential nft the first one is obviously the file that can be stored on ipfs or any kind of remote storage there is obviously also a smart contract nft smart contract sorry that represent this ownership and obviously the file is encrypted and so we need the third component that we call the secret management service which stores the keys and which distribute the

keys to the people or i mean to the to the component authorized to access those keys so how an application can use a confidential nft so let's say you have alice that has personal information and imagine an application such as a decentralized kyc system for instance so at least we create a usage order that explicitly worked this application and publish this uh this order on the exact marketplace and once that you know that that order has been published then it means that the kyc application is authorized to access this

this this personal data for other case you can absolutely monetize your application uh your own data set for uh sorry in this case you can also fix a price and and and the user of this data would have to to pay for the for you for using the data so how does it work uh i will not go too much into the details but uh basically we're using end-to-end data privacy um preserving so it means that first to protect the data obviously they are encrypted and store encrypted and obviously when we transfer those data they are also encrypted so we've been doing that for

30 years so there's no surprise here during when data are processed by an application we rely on hardware and class or trusted execution environment and more specifically intellij x enclaves so you may know this technology it's basically a hardware feature that exists in the microprocessor so that when doing a computation no one can spy on the memory because the memory is always encrypted so these things is new and of course this is not enough to maintain confidentiality you must have governance that's super important so for that we use the nft smart contract on the blockchain

and under governance rules and we also have a component that we call the secret management service which also run within an enclave and this is the way we are sure that at no point in time secrets our secrets are you know they're always encrypted okay so this thing is running right now on i exactly it's been it's been there for a year or two something like that and what i'm going now to present you is a the prototype of the next product we are working on which is called the personal data wallet and the goal with the personal data

wallet is to make all those features accessible to to anyone so the data wallet is basically a place where people will be able to store their personal information and protect so on on the one hand they will be able to select partner dabs that can use their data and the other hand they will have a dashboard to control and monitor and understand what is being done with their data so it looks like this you have a dashboard you have the list of confidential nft that has been created and you have a list of partnered ups so for instance i will give you an

example of an information you know personal information can create so here in this case we'll take the email address so the user is very simple the user will just fill the the different form of information the form such as that's my email the name of the cnft and the description so once this is done the cnft is created so it means that you have an nft that has been maintained on ethereum and you have a file that is encrypted somewhere on ipfs and plus you have the keys that have been sent to the secret management service okay so what can you do with the cnft you can now link this cnft to an application so

that the application can use your confidential data your personal information so here you can see that we have a list of partnered apps so you can imagine any kind of partnered ups you know here we have listed one that is private email sending that sounds like interesting for for an email address uh the other one are less relevant obviously you can have a token tractor so you can imagine for instance you know defy services that will give you information about your wallet and your portfolio but while remember still you will be able to maintain the confidentiality about your your information so here you see that we have the private email sending so this application allows you to receive email from third parties

while avoiding to share your personal email address to them with them so it means that when we're going to link or email to that to that application people will be able to send us email but they will never know what our actual email address is and nobody will never know that and that's really the point so to do that it's very simple you have um you know a presentation of the of the the application and the permissions and so obviously the application will will access the email address but as the email address and the application are executed within an

enclave nobody can extract this uh this information of course and so if we authorize the connection then then it means that the two are linked and now this private email this private email application is authorized to access our email address okay so as a conclusion the goal of web3 is to allow users to control their own data we have presented two things today one is the confidential nft which is already part of the ixx stack and as a developer you can already you know build your application on top of that it's a full privacy uh preserving a solution that relies on ethereum and

also on on confidential computing i think that there are very few developer stacks that can manage that at the moment so that that can be interesting for developers the future is the exec data wallet so this is something we are working on now and that will be released probably by the end of the year um and using that you can manage your own personal information and your computing assets and the goal we have with this personal data wallet is also to allow people to monetize their uh their um their data so thank you and maybe we have time for a couple of questions if you have some

[Applause] any questions thank you is there any way for users to remove their personal data from ipva storage in your system

they can't remove they can't remove the data but what they can do is that [Music] you have a data but no one can use it unless you publish an order and that's the order wants in the marketplace that allows people to access the data [Music] so if you don't publish that order no one can access the data at this order you can revoke it at any time so um removing the actual offshoring data i think it clearly depends on the you know the remote storage system you are using if you are allowed to remove the data from from that remote storage then you can if you are not allowed like

on the ipfs i don't know if you can or then you you thank you oh hi um what would you say the biggest benefit of cnfts over verifiable credentials would be about what

the the biggest benefit of cnft is over using something like verifiable credentials uh i i i didn't understand the alternative what was the alternative sorry the uh cnft versus what verifiable credentials very fine ah verified credit shows yeah okay so here the idea is that you you kind of produce a proxy between the one that are going to verify your credentials and you so this is basically what we have shown with uh with the email you know you have someone that you know that want to send you an

email and you don't immediately communicate the email address because you want to keep this information secret and so you kind of create a proxy which is an application that will be allowed to send you an email but you don't have to reveal your email so you can imagine this kind of proxy and you know that could be extended to many different usages so for instance you could imagine connecting you know to a web to service while not revealing your credentials um but at the moment this is not something we have you know really worked on but it could be a future one

i don't know if it answers your questions thank you i think we're good thank you thank you very much have a good day