TWC: Small: Auditing PII in the Cloud with CloudFence

TWC：小型：使用 CloudFence 审核云中的 PII

• 批准号: 1222748
• 负责人: Angelos Keromytis
• 金额: $ 50万
• 依托单位: Columbia University
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2012
• 资助国家: 美国
• 起止时间: 2012-09-01 至 2017-08-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1222748&HistoricalAwards=false
• 关键词: TWC; Small; Auditing; PII; Cloud

This project will investigate, prototype and evaluate CloudFence, a proposed framework that allows users to independently audit the treatment of their private data by third-party online services, through the intervention of the cloud provides hosting said services. Specifically, the PI will investigate, novel techniques for conducting fine-grained tracking of ``information of interest'' (as defined by the user of the cloud service, in a flexible, context-sensitive manner) toward (a) providing increased transparency to end users of the handling of their information by the cloud, and (b) enabling the periodic (or even continuous) auditing of said handling, either by the user or an agent acting on her behalf. The underlying hypothesis is that it is possible to create a general-purpose, application-agnostic information tracking mechanism across the cloud that can operate on both legacy and newly developed applications, such that users can leverage their trust on the infrastructure provider without imposing unreasonable constraints on said provider (e.g., not requiring manual inspection of applications). The project will take a systems approach, aiming to demonstrate the feasibility, effectiveness, and limitations of CloudFence by applying it to real problems encountered in managing the cloud computing infrastructure of the PI's department; a significant part of the effort will go toward system evaluation. Tangible results of the effort include (a) a new architectural framework for information auditing in a cloud environment, (b) software prototypes demonstrating the concepts, (c) conference and journal publications and reports, and (d) a network security lab focusing on cloud and web security.

该项目将对CloudFence进行调查、制作原型和评估CloudFence，这是一个拟议的框架，允许用户通过云提供的干预独立审计第三方在线服务对其私人数据的处理。具体地说，PI将研究新的技术，用于对“感兴趣的信息”(由云服务的用户以灵活、上下文敏感的方式定义)进行细粒度跟踪，以(A)向最终用户提供云处理其信息的更高透明度，以及(B)由用户或代表其行事的代理对所述处理进行定期(甚至连续)审计。潜在的假设是，可以创建跨云的通用的、与应用无关的信息跟踪机制，该机制可以在遗留应用和新开发的应用上操作，使得用户可以利用他们对基础设施提供商的信任，而不对所述提供商施加不合理的约束(例如，不需要手动检查应用)。该项目将采用系统方法，旨在通过将CloudFence应用于PI部门在管理云计算基础设施时遇到的实际问题来证明CloudFence的可行性、有效性和局限性；工作的很大一部分将用于系统评估。这项工作的具体成果包括：(A)云环境中信息审计的新架构框架；(B)演示概念的软件原型；(C)会议和期刊出版物和报告；(D)侧重于云和网络安全的网络安全实验室。