BBVA and the IMDEA Software Institute partner to research advanced cryptographic techniques

This technology is key to the creation of data-based digital solutions that protect the privacy and security of users’ data.
Listen to audio Leer en español

Through this partnership, BBVA and the IMDEA Software Institute have created a joint framework to research the use of this technology in the development of digital solutions that make it possible to harness data’s potential while also ensuring that users’ data remain private, anonymous and secure.

The impact of COVID-19 on the spread of cybercrime

Cybercriminals are taking advantage of COVID-19 and the new reality it has imposed: telecommuting hitting peak levels and huge amounts of information — and misinformation — circulating the Internet. Scammers are ramping up their activities as they try to maximize ill-gotten gains. We explain how these organized groups work, what attacks are the most common, and what we can do to protect ourselves.

The agreement is especially relevant in the current context marked by the coronavirus crisis, which is demonstrating the importance of having robust systems to safeguard the privacy and security of data. On the one hand, this is due to the rise of cyber attacks in recent weeks in which cyber criminals are taking advantage of users’ increased use of digital channels during the lockdown. And on the other, due to the interest sparked by the creation of COVID-19 tracking apps that respect data privacy, for which technologies of this kind could be very useful.

With this new partnership, both institutions will explore the application of a series of cryptographic techniques in the financial sector - techniques that make it possible for data to be shared and analyzed without exposing their content to third parties thanks to algorithms, protocols and encryption systems. These technologies, known as PET, or privacy-enhancing technologies are one of the fields in which the IMDEA Software Institute specializes, as well as one of the areas of interest that BBVA researches in its Research and Patent area.

Within this group of technologies, one that has the greatest potential and which will be the main subject of the new team’s study is zero knowledge proofs (ZKP). This technology uses cryptographic algorithms to make it easier to verify the accuracy of information, without having to share the data that comprise it. This way, it can help to create data-based solutions in which customers’ sensitive data is not exposed to third parties (as it is not necessary to share the data with them to prove that they are accurate).

Thanks to this agreement, both institutions are combining their capacities and knowledge in these areas. The goal is for the research to translate into tangible advances that make it possible to transfer the benefits of this technology to the financial sector, the corporate world, the scientific community and society as a whole.

To do so, in the first stage, the joint team will research how to solve some of the current challenges that the roll-out of this technology is still facing in order to share the results with the scientific community to foster progress in this discipline. Some of these challenges involve its integration with the current communication systems that companies are using, or the lack of common standards for the use of cryptographic protocols, which complicates its adoption on a large scale.

BBVA and the IMDEA Software Institute will also work on a series of real use cases identified in the financial sector, as well as the development of viable prototypes that can be incorporated in the digital products and services offered to BBVA customers.

Zero Knowledge Proof: how to maintain privacy in a data-based world

Is it possible to show that something is true without revealing the data that proves it? This is what ‘Zero Knowledge Proof’ technology proposes, a technique which employs cryptographic algorithms so that various parties can verify the veracity of an item of information without sharing the data that compose it.

“There is a growing need to develop technological solutions that allow us to protect the information we share when consuming digital serviced in our everyday lives. And at BBVA, we see great potential in theses technologies to makes this possible. This need has become even more tangible as a result of the COVID-19 crisis, which is demonstrating the need for robust data protection systems given the growing number of cyber attacks and the use of apps that register users’ data to track the disease, which have emerged in some countries,” explains Carlos Kuchkovsky, the Head of Research and Patents at BBVA. “Now, thanks to this collaboration, we will be able to expand our capacity to research in this area of knowledge and apply it to the bank, so that its benefits reach our customers,” he added.

“Until recently, these cryptographic techniques were only of interest on a theoretical level. In recent years, we have seen enormous advances that could make them applicable to some practical scenarios, but several challenges remain: the efficiency and integration in larger systems, among others,” explains the postdoctoral researcher and the IMDEA Software Institute, Antonio Faonio. The researcher Dario Fiore, Associate Professor of Research at the institute who will also be a part of this partnership, says that: “This collaboration could help us and the scientific community to transfer this technology to relevant industrial actors and to identify the problems that must be addressed to reach this goal.”
Use cases

BBVA has been researching the use of these technologies, specifically the ZKP technology, in the financial sector for some time now and has already identified different scenarios in which it offers significant benefits. Meanwhile the IMDEA Software Institute has some of the most renowned experts in this field on an international level who are actively researching the continuous improvement of ZKP technology.

In general terms, the technology could serve to make it easier for financial institutions to verify the accuracy of information necessary for the sale of a product or service (such as the customer’s salary or age), without having to expose sensitive data. Similarly, financial institutions could use the technology to make it easier for users to share digital evidence that certifies their financial information with third parties, without having to share their data.

In the identity field, the technology could also be used to develop authentication systems without the risk of the information being stolen, as personal data does not need to be shared to prove identity.