CT-ISG: COLLABORATIVE RESEARCH: SecureWORM: Strong Regulatory-Compliant Storage

数字社会和市场越来越要求对信息的获取、处理和存储采取一致的程序。仅在美国，金融、生命科学、医疗保健和政府部门就有10,000多项这样的法规，包括《格拉姆-利奇-布莱利法案》、《健康保险流通与责任法案》和《萨班斯-奥克斯利法案》。这些条例中反复出现的主题是，需要合规的存储作为基础，以确保数据机密性、访问完整性和身份验证；提供审计跟踪、保证删除和数据迁移；并提供一次写入多次读取(WORM)保证，这对于实施长期数据保留和生命周期策略至关重要。不幸的是，当前的合规性存储WORM机制从根本上很容易受到错误行为或有动机更改存储数据的内部人员的攻击，因为它们依赖于简单的实施原语，如软件和/或硬件设备托管的开/关开关，不适合其目标威胁模型。在此项目中，我们将为现实的敌对设置构建一个强合规性存储系统，提供有保证的文档保留和删除、快速查找和合规迁移，以及对诉讼搁置和数据保密性的几个关键方面的支持。最近的合规法规旨在培养和恢复人们对数字信息记录以及更广泛地说对我们的企业、医院和教育企业的信任。随着越来越多的信息被创建并以数字方式生活，合规存储将成为恢复这种信任和发现社会各个层面的腐败和数据滥用的重要工具。该项目将极大地推动最先进技术的发展，并为安全合规设计奠定坚实的基础。

Digital societies and markets increasingly mandate consistent procedures for the access, processing and storage of information. In the United States alone, over 10,000 such regulations can be found in financial, life sciences, health-care and government sectors, including the Gramm-Leach-Bliley Act, Health Insurance Portability and Accountability Act, and Sarbanes-Oxley Act. A recurrent theme in these regulations is the need for regulatory-compliant storage as an underpinning to ensure data confidentiality, access integrity and authentication; provide audit trails, guaranteed deletion, and data migration; and deliver Write Once Read Many(WORM) assurances, essential for enforcing long-term data retention and life-cycle policies.Unfortunately, current compliance storage WORM mechanisms are fundamentally vulnerable to faulty behavior or insiders with incentives to alter stored data because they rely on simple enforcement primitives such as software and/or hardware device-hosted on/off switches, ill-suited to their target threat model.In this project, we will build a strongly compliant storage system for realistic adversarial settings, delivering guaranteed document retention and deletion, quick lookup, and compliant migration, together with support for litigation holds and several key aspects of data confidentiality.Recent compliance regulations are intended to foster and restore humans trust in digital information records and, more broadly, in our businesses, hospitals, and educational enterprises. As increasing amounts of information are created and live digitally, compliance storage will be a vital tool in restoring this trust and ferreting out corruption and data abuse at all levels of society. This project will greatly advance the state of the art and create a strong foundation for secure regulatory compliant designs.