CT-ISG: COLLABORATIVE RESEARCH: SecureWORM: Strong Regulatory-Compliant Storage

数字社会和市场越来越要求一致的信息访问、处理和存储程序。仅在美国，金融、生命科学、医疗保健和政府部门就有超过 10,000 条此类法规，包括《格雷姆-里奇-比利雷法案》、《健康保险流通与责任法案》和《萨班斯-奥克斯利法案》。这些法规中反复出现的主题是需要符合法规的存储作为基础，以确保数据机密性、访问完整性和身份验证；提供审计跟踪、保证删除和数据迁移；并提供一次写入多次读取 (WORM) 保证，这对于执行长期数据保留和生命周期策略至关重要。不幸的是，当前的合规性存储 WORM 机制从根本上来说很容易受到错误行为或有动机更改存储数据的内部人员的影响，因为它们依赖于简单的执行原语，例如软件和/或硬件设备托管的开关，不适合其目标威胁模型。在这个项目中，我们将为现实的对抗性设置构建一个高度合规的存储系统，提供有保证的存储系统文档保留和删除、快速查找和合规迁移，以及对诉讼保留和数据机密性的几个关键方面的支持。最近的合规性法规旨在培养和恢复人们对数字信息记录的信任，更广泛地说，对我们的企业、医院和教育企业的信任。随着越来越多的信息以数字方式创建和传播，合规存储将成为恢复这种信任并在社会各个层面查出腐败和数据滥用的重要工具。该项目将极大地推进最先进的技术，并为安全合规设计奠定坚实的基础。

Digital societies and markets increasingly mandate consistent procedures for the access, processing and storage of information. In the United States alone, over 10,000 such regulations can be found in financial, life sciences, health-care and government sectors, including the Gramm-Leach-Bliley Act, Health Insurance Portability and Accountability Act, and Sarbanes-Oxley Act. A recurrent theme in these regulations is the need for regulatory-compliant storage as an underpinning to ensure data confidentiality, access integrity and authentication; provide audit trails, guaranteed deletion, and data migration; and deliver Write Once Read Many(WORM) assurances, essential for enforcing long-term data retention and life-cycle policies.Unfortunately, current compliance storage WORM mechanisms are fundamentally vulnerable to faulty behavior or insiders with incentives to alter stored data because they rely on simple enforcement primitives such as software and/or hardware device-hosted on/off switches, ill-suited to their target threat model.In this project, we will build a strongly compliant storage system for realistic adversarial settings, delivering guaranteed document retention and deletion, quick lookup, and compliant migration, together with support for litigation holds and several key aspects of data confidentiality.Recent compliance regulations are intended to foster and restore humans trust in digital information records and, more broadly, in our businesses, hospitals, and educational enterprises. As increasing amounts of information are created and live digitally, compliance storage will be a vital tool in restoring this trust and ferreting out corruption and data abuse at all levels of society. This project will greatly advance the state of the art and create a strong foundation for secure regulatory compliant designs.