SBIR Phase II: SecureVault Cloud Platform

这个小企业创新研究（SBIR）第二阶段项目将设计和构建一个技术平台，使云基础设施能够在完全计算隐私的情况下运行客户的任务。即使存在对硬件本身进行直接物理访问的恶意意图，云提供商本身也无法访问客户的工作负载。该技术显著提高了云防御能力，并为任何对监管和安全敏感的客户提供强大的计算隐私和法规遵从性保证。这种级别的安全是通过以下方式实现的：(i)为传统基础设施赋予主动透明防御和控制的协作安全层，即云？免疫系统吗?（ii）允许外包任务的完全计算隐私的新机制。免疫系统有自己的控制网络，即使在持续攻击和严重损害的情况下，也能即时共享关键信息，独立反应，进行有意义的操作和快速恢复。它还可以透明地监视和访问服务器运行时，并可以在整个云上进行强烈的反应并立即提供统一的防御。此外，固有的隐私和机密性保证允许安全的计算执行和完全安全的数据托管，即使在对基础设施具有完全物理访问权限的好奇服务提供商受到损害的情况下也是如此。这个项目更广泛的影响/商业潜力将在我们日益依赖互联网和云计算的社会和技术的各个方面体现出来。由于云计算带来了巨大的风险，技术支持的全面安全和隐私保证对于将云计算建立为内部IT的真正可行替代方案至关重要。不幸的是，尽管所有主要的潜在云采用者（包括受到安全、法规遵从性和知识产权限制的金融、政府和医疗保健市场）都迫切需要这些保证，但目前的任何产品或研究工作都无法实现这些保证。因此，这些主要市场根本没有采用云，而不是冒着违反法规遵从性和未经授权访问专有业务逻辑的风险。无数调查显示，安全和隐私一直是阻碍采用的首要问题，市场对此持强烈保留态度。该项目开发了一种颠覆性的技术，弥合了这一差距，使云采用在所有这些市场中都变得安全和有吸引力。因此，它将带来指数级的跨市场增长。最后，启用具有完整计算隐私、法规遵从性和数据机密性的云部署将显著提高企业的敏捷性和竞争力。

This Small Business Innovation Research (SBIR) Phase II project will design and build a technology platform that allows cloud infrastructures to run clients' tasks with full computation privacy. The cloud provider itself is unable to access to customers' workloads even in the presence of malicious-intent direct physical access to the hardware itself. The technology significantly increases cloud defense capabilities, and provides strong computation privacy, and regulatory compliance guarantees to any regulatory- and security-sensitive customers. This level of security is achieved by (i) endowing a traditional infrastructure with a collaborative security layer of active transparent defense and control, a cloud ?immune system?, and (ii) new mechanisms that allow full computation privacy for outsourced tasks. The immune system has its own control network and can instantly share critical information and react independently for meaningful operation and fast recovery even under sustained attack and severe compromise. It also transparently monitors and accesses the server runtimes and can strongly react and immediately present a united defense across the entire cloud. Moreover, inherent privacy and confidentiality assurances allow safe computation execution and data hosting with full security, even in the case of a compromised curious service provider with full physical access to the infrastructure. The broader impact/commercial potential of this project will manifest itself in all dimensions of our increasingly internet and cloud-reliant society and technology. Because clouds introduce significant risks, technology-backed comprehensive security and privacy assurances are essential to establish cloud computing as a truly viable alternative to in-house IT. Unfortunately, these guarantees are not achievable with any of today's offerings or research efforts, despite being direly needed by all major potential cloud adopters, including financial, governmental and healthcare markets, heavily governed by security, regulatory compliance and intellectual property constraints. As a result, rather than risk regulatory compliance breaches, and unauthorized access to proprietary business logic, these major markets have simply not adopted the cloud. Countless surveys outline security and privacy consistently as the top concern preventing adoption, and markets have reacted with strong reservations. This project develops a disruptive technology that bridges this gap and makes cloud adoption secure and attractive in all these markets. As a result it will lead to exponential cross-market growth. Finally, enabling cloud deployment with full computation privacy, regulatory compliance and data confidentiality will significantly increase enterprise agility and competitiveness.