SBIR Phase II: SecureVault Cloud Platform

这个小型企业创新研究(SBIR)第二阶段项目将设计和构建一个技术平台，允许云基础设施在完全计算隐私的情况下运行客户的任务。即使存在对硬件本身的恶意直接物理访问，云提供商本身也无法访问客户的工作负载。该技术显著增强了云防御能力，并为任何对监管和安全敏感的客户提供强大的计算隐私和监管合规性保证。这种安全级别是通过(I)为传统基础设施赋予主动透明防御和控制的协作安全层、云免疫系统和(Ii)允许外包任务完全计算隐私的新机制来实现的。免疫系统拥有自己的控制网络，即使在持续攻击和严重危害的情况下，也可以立即共享关键信息并独立反应，以实现有意义的操作和快速恢复。它还透明地监控和访问服务器运行时，并可以做出强烈反应，立即在整个云中提供统一的防御。此外，固有的隐私和机密性保证允许完全安全地安全计算执行和数据托管，即使是在受到威胁的好奇服务提供商完全物理访问基础设施的情况下也是如此。该项目更广泛的影响/商业潜力将体现在我们日益依赖互联网和云的社会和技术的各个维度。由于云会带来重大风险，因此以技术为后盾的全面安全和隐私保证对于将云计算建立为真正可行的内部IT替代方案至关重要。不幸的是，这些保证无法通过今天的任何产品或研究工作实现，尽管所有主要的潜在云采用者都迫切需要这些保证，包括金融、政府和医疗保健市场，这些市场受到安全、法规遵从性和知识产权限制的严重制约。因此，这些主要市场根本没有采用云，而不是冒着违反监管规定和未经授权访问专有业务逻辑的风险。无数调查一致地将安全和隐私列为阻止采用的首要问题，市场对此持强烈保留态度。该项目开发了一种颠覆性技术，可以弥合这一差距，并使云在所有这些市场中的采用都安全且具有吸引力。因此，它将导致跨市场的指数式增长。最后，实现完全计算隐私、合规性和数据机密性的云部署将显著提高企业敏捷性和竞争力。

This Small Business Innovation Research (SBIR) Phase II project will design and build a technology platform that allows cloud infrastructures to run clients' tasks with full computation privacy. The cloud provider itself is unable to access to customers' workloads even in the presence of malicious-intent direct physical access to the hardware itself. The technology significantly increases cloud defense capabilities, and provides strong computation privacy, and regulatory compliance guarantees to any regulatory- and security-sensitive customers. This level of security is achieved by (i) endowing a traditional infrastructure with a collaborative security layer of active transparent defense and control, a cloud ?immune system?, and (ii) new mechanisms that allow full computation privacy for outsourced tasks. The immune system has its own control network and can instantly share critical information and react independently for meaningful operation and fast recovery even under sustained attack and severe compromise. It also transparently monitors and accesses the server runtimes and can strongly react and immediately present a united defense across the entire cloud. Moreover, inherent privacy and confidentiality assurances allow safe computation execution and data hosting with full security, even in the case of a compromised curious service provider with full physical access to the infrastructure. The broader impact/commercial potential of this project will manifest itself in all dimensions of our increasingly internet and cloud-reliant society and technology. Because clouds introduce significant risks, technology-backed comprehensive security and privacy assurances are essential to establish cloud computing as a truly viable alternative to in-house IT. Unfortunately, these guarantees are not achievable with any of today's offerings or research efforts, despite being direly needed by all major potential cloud adopters, including financial, governmental and healthcare markets, heavily governed by security, regulatory compliance and intellectual property constraints. As a result, rather than risk regulatory compliance breaches, and unauthorized access to proprietary business logic, these major markets have simply not adopted the cloud. Countless surveys outline security and privacy consistently as the top concern preventing adoption, and markets have reacted with strong reservations. This project develops a disruptive technology that bridges this gap and makes cloud adoption secure and attractive in all these markets. As a result it will lead to exponential cross-market growth. Finally, enabling cloud deployment with full computation privacy, regulatory compliance and data confidentiality will significantly increase enterprise agility and competitiveness.