PreVeil Pushes Encryption Past the End

We all know that perimeter technologies are somewhat now playing second string to newer approaches to data security: acceptance that breaches are inevitable. Once in a while, we find one technology that cuts through the noise and presents an approach that looks very novel and very workable.

Whether or not you believe in "encryption everywhere," its time will come in 2018, when an innovative startup will commercialize and launch an encryption concept incubated from the labs at MIT.

PreVeil CEO Raluca Ada Popa

Spearheading the new technology, which concept claims that even after an intrusion, information stored on servers remains encrypted and is therefore useless data to cyber thieves, is founder and CTO at PreVeil, Raluca Ada Popa.

Popa holds a double major Bachelor's degree, a Master's and a Doctorate in computer science -- all with a GPA of 5.0 -- and also holds the patents to PreVeil's encryption everywhere concept. She's also an assistant professor at U.C. Berkeley specializing in computer science and applied cryptography.

"I was always thinking of algorithmic, logical things, but at the same time, I also wanted to have an impact on the world," said Popa, "I had to do math, had to think analytically and I was only interested in solving difficult problems."

The math and operational processing behind the concept supports the idea that traditional encryption, although it has served well, just doesn't extend far enough given that intrusions are inevitable. Encryption od data in transit and storage works fine. But encryption during computing and processing of data is missing.

Don't worry about server breaches
"Servers were continually being breached, so my Light Bulb Moment was 'maybe we should stop fighting that battle because we're always losing,' " Popa told SecurityNow, "Let's stop trying to have a wall around data and instead always have it encrypted." Today's encryption protects data when it's at rest or in transit, but it's decrypted at the destination, and that leaves a huge security hole and low-hanging hacker opportunities.

Thinking of taking the concept from the whiteboard to commercialization, there was a healthy dose of reality that the process might be too much of a challenge. Also, it was Popa's first outing into forming a company and trying to drive a new mindset about the use of encryption.

"[But] I had a hard time thinking about only making an incremental change," said Popa, who loves challenges.

Having formed in 2015, PreVeil has been developing the technology and now has productized the concept. Solutions for file sharing and email security will be available by the end of the year for Windows, Mac, Android and iPhone. Its enterprise security solution will also released within a month. Services will be free for individual users, and the business model is to charge enterprises. Currently, PreVeil has about 30 enterprise trials on the go, but no formal customers yet.

Show me the money
Popa reckons that a big driver of enterprise interest is being driven by media coverage of attacks, and is starting some thinking about new solutions rather than necessarily beefing existing systems.

Apparently, some enterprise budget is being moved from perimeter defense towards newer technologies, and some companies are even able to justify additional security spending. There are also worries out there that companies which don't keep up with encryption may become soft targets for hackers.

Another pressure point is consumer expectation. There may be more realistic views on the street about weak data security from consumer brands, and Popa speculates that the next generation of encryption will power competitive differentiators for consumers willing to pay for stronger security-as-a-service.

Enterprise teams adopting new encryption technologies could face a knowledge gap and steep learning curves. "The good thing is that the high-level concepts are actually easy to grasp. There are no more single key-holder approvals, and now firms can get encryption through a group of people," said Popa. "It's definitely a big step to take, and there are those who are still thinking about it."

The past and the future
PreVeil is notable by the presence of chairman and founder Sanjeev Verma. Apart from the practicality of ensuring financing (the firm was initially privately funded) for the idea, Verma has a track record of success that includes being the founder of Airvana, the giant of CDMA in the early Noughties.

As a business partner, Popa liked him because he also had good technical knowledge and bridged the gap between her academic expertise through enabling the packaging of a new service. "We had been friends for a long time, and he was interested in potentially commercializing my research. There were a few other organizations who approached me, but I basically said 'no' to all of them," said Popa.

There are some roadmap items coming up that indicate an extension of PreVeil's ambitions as well as a fledgling move to apply encryption everywhere, well, everywhere. "We're looking at adding chat functionality, and looking to integrate with the blockchain, so that cryptographic identities are really secured by the blockchain."

How does the new technology work?

There's an explainer video here. And yes, the time-honored characters of Bob, Alice and Chris all star in the clip.

Related posts:

— Simon Marshall, Technology Journalist, special to Security Now