CAREER: Contextual Protection for Private Data Storage and Retrieval

职业：私有数据存储和检索的上下文保护

• 批准号: 1351058
• 负责人: Christopher Kanich
• 金额: $ 59.7万
• 依托单位: University of Illinois at Chicago
• 依托单位国家: 美国
• 项目类别: Continuing Grant
• 财政年份: 2014
• 资助国家: 美国
• 起止时间: 2014-02-01 至 2020-01-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1351058&HistoricalAwards=false
• 关键词: CAREER; Contextual; Protection; Private; Data

This research is building an understanding of what data is useful to attackers and what data is private for its legitimate owners so that security systems can incorporate these values into a data-driven, defense-in-depth approach to securing our digital lives. We are exploiting the fact that both users and attackers must sift through vast amounts of data to find useful information. This system, called contextual data protection, enables users to passively manage their private and potentially lucrative stored data with minimal overhead, adding extra protection to private data which greatly lowers the risk inherent in long lived archives. Simultaneously, we are creating effective defenses for data by improving our understanding of cybercrime, information use habits, and acceptable usability tradeoffs for data access. Building on previous research analyzing the financial successes of spam-based cybercrime, we are developing a methodology and apparatus for understanding the illicit value of stolen information. By understanding what is discoverable and valuable to attackers, we can develop techniques to focus security efforts on lucrative information, thereby preventing cybercriminals from turning a profit. Ultimately, our goal is to create a set of general techniques that use tools from cryptography that defend users' data by exploiting a deeper understanding of its value to both the users and the attackers. This research will shed light on the meaning of information value, ownership, and protection in this era of long-lived digital storage.

这项研究正在建立一种理解，即哪些数据对攻击者有用，哪些数据对其合法所有者是私有的，以便安全系统可以将这些价值纳入到数据驱动的深入防御方法中，以保护我们的数字生活。我们正在利用这样一个事实，即用户和攻击者都必须筛选大量数据才能找到有用的信息。该系统称为上下文数据保护，使用户能够以最小的开销被动地管理他们的私有数据和潜在的有利可图的存储数据，从而为私有数据添加额外的保护，从而大大降低长期归档所固有的风险。与此同时，我们正在通过提高我们对网络犯罪、信息使用习惯和数据访问的可接受可用性权衡的理解，为数据创建有效的防御。在分析基于垃圾邮件的网络犯罪的经济成功的先前研究的基础上，我们正在开发一种方法和设备，以了解被盗信息的非法价值。通过了解什么对攻击者是可发现和有价值的，我们可以开发技术，将安全努力集中在有利可图的信息上，从而防止网络犯罪分子获利。最终，我们的目标是创建一套通用技术，使用密码学中的工具，通过更深入地了解用户和攻击者的价值来保护用户的数据。这项研究将阐明在这个长期存在的数字存储时代信息价值、所有权和保护的意义。