III-COR Medium: Collaborative Research: Achieving Compliant Databases

在金融丑闻和隐私问题的刺激下，世界各国政府已采取行动，通过监管数字记录的保留和删除来确保人们对数字记录的信心。该项目的目标是开发和探索一种支持各种合规方法的数据库管理系统(DBMS)体系结构，从而将传统的基于文件的合规存储服务器提供的保护级别扩展到驻留在数据库中的海量结构化数据。这项工作的关键挑战是为数据库管理系统提供合规性保证，即使是针对拥有超级用户权限的内部人员，同时平衡对可信性的需求与对可伸缩性能保证和低成本的冲突要求。通过一系列技术，从篡改检测到数据、索引、日志和元数据的篡改防止；可调的漏洞窗口；可调的保护粒度；谨慎地使用磁盘作为高速缓存以及DBMS平台和合规性存储服务器平台上的安全协处理器；以及明智地重定盘上加密单元的目标，由此产生的体系结构提供了安全和性能之间的可调折衷。这项工作使合规法律能够适用于现在存储在数据库中的企业、政府和个人数据，增加了社会对这些数据的信心。关于合规数据管理的新网络课程将提高计算机科学界对合规问题的认识，并将有助于培训认识到这些挑战和解决办法的新一代专业人员。软件原型和描述它们的技术文件将通过该项目的网站http://web.crypto.cs.sunysb.edu/cdb/传播

Spurred by financial scandals and privacy concerns, governments worldwide have moved to ensure confidence in digital records by regulating their retention and deletion. The goal of this project is to develop and explore a database management system (DBMS) architecture that supports a spectrum of approaches to regulatory compliance, thereby extending the level of protection afforded by conventional file-based compliance storage servers to the vast amounts of structured data residing in databases. The key challenge of this work is to provide compliance assurances for the DBMS, even against insiders with super-user powers, while balancing the need for trustworthiness against the conflicting requirements for scalable performance guarantees and low cost. The resulting architecture provides tunable tradeoffs between security and performance, through a spectrum of techniques ranging from tamper detection to tamper prevention for data, indexes, logs, and metadata; tunable vulnerability windows; tunable granularities of protection; careful use of magnetic disk as a cache and of secure coprocessors on the DBMS platform and compliance storage server platform; and judicious retargeting of an on-disk encryption unit. This work enables compliance laws to be applied to business, government, and personal data now stored in databases, increasing societal confidence in such data. A new web course on compliance data management will raise the computer science community's awareness of compliance issues and will help train a new generation of professionals cognizant of these challenges and solutions. The software prototypes and technical papers describing them will be disseminated through the project's web site http://web.crypto.cs.sunysb.edu/cdb/