CT-ISG: COLLABORATIVE RESEARCH: SecureWORM: Strong Regulatory-Compliant Storage

数字社会和市场日益要求信息的访问、处理和存储采用一致的程序。仅在美国，金融、生命科学、保健和政府部门就有10 000多项此类条例，包括《格拉姆-利奇-比利法》、《健康保险流通和责任法》和《萨班斯-奥克斯利法》。这些法规中反复出现的一个主题是需要符合法规的存储作为基础，以确保数据机密性、访问完整性和身份验证;提供审计跟踪、保证删除和数据迁移;并提供一写多读（WORM）保证，这对于实施长期数据保留和生命周期策略至关重要。不幸的是，当前的顺应性存储WORM机制从根本上容易受到错误行为或具有改变存储数据的动机的内部人员的攻击，因为它们依赖于简单的执行原语（例如软件和/或硬件设备托管的开/关开关），不适合他们的目标威胁模型。在这个项目中，我们将为现实的对抗环境构建一个高度兼容的存储系统，提供有保证的文档保留和删除、快速查找和兼容迁移，以及对诉讼搁置和数据机密性的几个关键方面的支持。最近的合规性法规旨在培养和恢复人们对数字信息记录的信任，更广泛地说，在我们的企业，医院和教育企业。随着越来越多的信息以数字方式创建和生活，合规存储将成为恢复这种信任并在社会各个层面发现腐败和数据滥用的重要工具。该项目将极大地推进最先进的技术水平，并为安全的合规设计奠定坚实的基础。

Digital societies and markets increasingly mandate consistent procedures for the access, processing and storage of information. In the United States alone, over 10,000 such regulations can be found in financial, life sciences, health-care and government sectors, including the Gramm-Leach-Bliley Act, Health Insurance Portability and Accountability Act, and Sarbanes-Oxley Act. A recurrent theme in these regulations is the need for regulatory-compliant storage as an underpinning to ensure data confidentiality, access integrity and authentication; provide audit trails, guaranteed deletion, and data migration; and deliver Write Once Read Many(WORM) assurances, essential for enforcing long-term data retention and life-cycle policies.Unfortunately, current compliance storage WORM mechanisms are fundamentally vulnerable to faulty behavior or insiders with incentives to alter stored data because they rely on simple enforcement primitives such as software and/or hardware device-hosted on/off switches, ill-suited to their target threat model.In this project, we will build a strongly compliant storage system for realistic adversarial settings, delivering guaranteed document retention and deletion, quick lookup, and compliant migration, together with support for litigation holds and several key aspects of data confidentiality.Recent compliance regulations are intended to foster and restore humans trust in digital information records and, more broadly, in our businesses, hospitals, and educational enterprises. As increasing amounts of information are created and live digitally, compliance storage will be a vital tool in restoring this trust and ferreting out corruption and data abuse at all levels of society. This project will greatly advance the state of the art and create a strong foundation for secure regulatory compliant designs.