Collaborative Research: Secure Provenance in High-End Computing Systems

协作研究：高端计算系统的安全来源

• 批准号: 0937833
• 负责人: Radu Sion
• 金额: $ 56.5万
• 依托单位: SUNY at Stony Brook
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2009
• 资助国家: 美国
• 起止时间: 2009-09-15 至 2013-08-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=0937833&HistoricalAwards=false
• 关键词: Collaborative; Research; Secure; Provenance; End

Data provenance documents the inputs, entities, systems, and processes that influence data of interest---in effect providing a historical record of the data and its origins. The generated evidence supports essential forensic activities such as data-dependency analysis, error/ compromise detection and recovery, and auditing and compliance analysis. This collaborative project is focused on theory and systems supporting practical end-to-end provenance in high-end computing systems. Here, systems are investigated where provenance authorities accept host- level provenance data from validated provenance monitors, to assemble a trustworthy provenance record. Provenance monitors externally observe systems or applications and securely record the evolution of data they manipulate. The provenance record is shared across the distributed environment. In support of this vision, tools and systems are explored that identify policy (what provenance data to record), trusted authorities (which entities may assert provenance information), and infrastructure (where to record provenance data). Moreover, the provenance has the potential to hurt system performance: collecting too much provenance information or doing so in an inefficient or invasive way can introduce unacceptable overheads. In response, the project is further focused on ways to understand and reduce the costs of provenance collection.

数据出处记录了影响感兴趣数据的输入，实体，系统和过程 - 实际上提供了数据及其起源的历史记录。生成的证据支持基本的法医活动，例如数据依赖性分析，错误/妥协检测和恢复以及审计和合规性分析。该协作项目的重点是支持高端计算系统中实用端到端出处的理论和系统。在这里，调查了出处当局接受来自经过验证的出处监视器的主机级出处数据的系统，以组装值得信赖的出处记录。出处监视外部观察系统或应用程序，并安全地记录其操纵数据的演变。出处记录在分布式环境中共享。为了支持该愿景，探索了工具和系统，以识别策略（要记录的出处数据），受信任的当局（哪些实体可以主张出处信息）和基础架构（在哪里记录出处数据）。此外，出处有可能损害系统绩效：收集过多的出处信息或以低效或侵入性的方式收集出来的信息可能会引入不可接受的开销。作为回应，该项目进一步集中在理解和降低出处收集成本的方法上。