CSR: Medium: CloudTracker: Transparent, Secure Provenance Tracking and Security Policy Enforcement in Clouds

CSR：中：CloudTracker：云中透明、安全的来源跟踪和安全策略执行

• 批准号: 1161541
• 负责人: Radu Sion
• 金额: $ 87.1万
• 依托单位: SUNY at Stony Brook
• 依托单位国家: 美国
• 项目类别: Continuing Grant
• 财政年份: 2012
• 资助国家: 美国
• 起止时间: 2012-08-01 至 2018-07-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1161541&HistoricalAwards=false
• 关键词: CSR; Medium; CloudTracker; Transparent; Secure

As companies, governments, and individual users adopt increasingly diverse computing platforms, from outsourced cloud computations to personal laptops and mobile devices, enforcing uniform security policies across these platforms becomes unwieldy.Similarly, regulatory compliance and business auditing requires tracking the history of this data in a comprehensive, secure, and platform-independent manner. Unfortunately, technology has not kept pace with these practical concerns, and several systems and security research challenges must be addressed to make this vision a reality.There is a natural and under-explored connection between understanding the origins of data and using that data's history to enforce security policies. To leverage this connection, this project is developing a comprehensive, general framework for automatically tracking the history of data and enforcing associated security policies in cloud computing environments. The research focuses on three key research challenges. First, the project investigates novel applications of virtualization technologies to transparently infer data provenance by inspecting a guest operating system (OS) and applications. Second, this project is developing techniques to securely store, manage, and query provenance data at cloud scale. Finally, the project combines the first two technologies to transparently and collaboratively enforce security policies throughout the cloud and end-user systems.The prototype system is designed to allow individual users and organizations to rapidly adopt new technology platforms, from clouds to novel end-user systems, without having to worry about the interaction of these new systems with security policies and regulatory compliance concerns.

随着公司，政府和个人用户采用越来越多样化的计算平台，从外包云计算到个人笔记本电脑和移动设备，在这些平台上执行统一的安全策略变得笨拙。类似，监管性合规性和业务审计需要以全面的，安全和平台独立的方式跟踪此数据的历史。不幸的是，技术并没有与这些实际问题保持同步，必须解决一些系统和安全研究挑战，以使这一愿景成为现实。在理解数据的起源和使用该数据历史记录来执行安全策略之间存在自然且不足的联系。为了利用此连接，该项目正在开发一个全面的一般框架，用于自动跟踪云计算环境中数据的历史和执行相关的安全策略。该研究重点是三个关键的研究挑战。首先，该项目通过检查来宾操作系统（OS）和应用程序来调查虚拟化技术的新应用来透明地推断数据出处。其次，该项目正在开发以云规模安全存储，管理和查询出处数据的技术。最后，该项目结合了前两种技术，以透明，协作地执行整个云和最终用户系统的安全策略。该原型系统旨在允许单个用户和组织快速采用新技术平台，从云到新颖的最终用户系统，而不必担心这些新系统与安全策略和法规合规性问题的交互。