CSR: Medium: CloudTracker: Transparent, Secure Provenance Tracking and Security Policy Enforcement in Clouds

CSR：中：CloudTracker：云中透明、安全的来源跟踪和安全策略执行

• 批准号: 1161541
• 负责人: Radu Sion
• 金额: $ 87.1万
• 依托单位: SUNY at Stony Brook
• 依托单位国家: 美国
• 项目类别: Continuing Grant
• 财政年份: 2012
• 资助国家: 美国
• 起止时间: 2012-08-01 至 2018-07-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1161541&HistoricalAwards=false
• 关键词: CSR; Medium; CloudTracker; Transparent; Secure

As companies, governments, and individual users adopt increasingly diverse computing platforms, from outsourced cloud computations to personal laptops and mobile devices, enforcing uniform security policies across these platforms becomes unwieldy.Similarly, regulatory compliance and business auditing requires tracking the history of this data in a comprehensive, secure, and platform-independent manner. Unfortunately, technology has not kept pace with these practical concerns, and several systems and security research challenges must be addressed to make this vision a reality.There is a natural and under-explored connection between understanding the origins of data and using that data's history to enforce security policies. To leverage this connection, this project is developing a comprehensive, general framework for automatically tracking the history of data and enforcing associated security policies in cloud computing environments. The research focuses on three key research challenges. First, the project investigates novel applications of virtualization technologies to transparently infer data provenance by inspecting a guest operating system (OS) and applications. Second, this project is developing techniques to securely store, manage, and query provenance data at cloud scale. Finally, the project combines the first two technologies to transparently and collaboratively enforce security policies throughout the cloud and end-user systems.The prototype system is designed to allow individual users and organizations to rapidly adopt new technology platforms, from clouds to novel end-user systems, without having to worry about the interaction of these new systems with security policies and regulatory compliance concerns.

随着公司、政府和个人用户采用越来越多样化的计算平台，从外包云计算到个人笔记本电脑和移动设备，在这些平台上执行统一的安全策略变得笨拙。同样，监管合规性和业务审计要求以全面、安全和独立于平台的方式跟踪这些数据的历史。不幸的是，技术没有跟上这些实际问题的步伐，必须解决几个系统和安全研究挑战，才能使这一愿景成为现实。了解数据来源和使用数据的历史来执行安全策略之间存在着一种自然且未被充分探索的联系。为了利用这种联系，该项目正在开发一个全面、通用的框架，用于在云计算环境中自动跟踪数据历史并实施相关的安全策略。这项研究集中在三个关键的研究挑战上。首先，该项目调查了虚拟化技术的新应用，以通过检查来宾操作系统(OS)和应用程序来透明地推断数据来源。其次，该项目正在开发安全地存储、管理和查询云级来源数据的技术。最后，该项目结合了前两种技术，以透明和协作的方式在整个云和最终用户系统中实施安全策略。原型系统旨在允许个人用户和组织快速采用从云到新型最终用户系统的新技术平台，而不必担心这些新系统与安全策略和合规性问题的交互。