SaTC: CORE: Small: External Obliviousness in Trusted Execution Environments

在“云”中处理个人数据是一种日益常见的计算应用。例如，健康监测器收集心跳数据并上传到云中，以获得个人医疗保健和福祉。这增加了隐私和数据安全风险。该项目旨在通过在基于最近发布的英特尔SGX(软件保护扩展)处理器的面向安全的云架构中保护数据访问模式，来实现云中可证明的安全。该项目的方法是将用于强处理器-内存隔离的硬件级保护与用于数据不经意计算的算法级保护相结合。这种新的组合被称为外部遗忘，旨在实现大规模数据的强安全计算。该项目包括两个推力：1)建立对常见计算原语的外部不经意编程支持；2)建立数据分析查询的外部不经意软件系统。该项目将产生多个更广泛的影响：外部不经意的新系统建设方法将影响网络安全和系统研究界。新的安全软件可能会将云行业扩展到支持电子医疗中面向安全的应用程序。该项目将导致实践实验模块与住宿课程相结合，并为本科生和代表不足的群体提供全国范围的教育平台。该项目将根据开发的代码库生成业绩评价结果。它们将被发布到在线资源库，并在那里保留3年：https://exo-sgx.github.io.This奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

Processing personal data in "the cloud" is an increasingly common computing application. For example, health monitors collect heartbeat data and upload to cloud for personal healthcare and wellbeing. This increases privacy and data security risks. This project aims to achieve provable security in the cloud by protecting data-access patterns in a security-oriented cloud architecture built on the recently released Intel SGX (Software Guard eXtensions) processor. The approach of the project is to combine hardware-level protection for strong processor-memory isolation with algorithm-level protection for data-oblivious computing. This new combination, termed external obliviousness, is intended to enable strongly secure computation at a large data scale. The project consists of two thrusts: 1) building externally oblivious programming support for common computation primitives, 2) building externally oblivious software systems for data-analytical queries.The project will result in multiple broader impacts: The new system-building method of external obliviousness will influence cyber-security and systems research community. The new secure software will potentially expand the cloud industry into supporting security-oriented applications in electronic healthcare. The project will lead to hands-on lab modules integrated with residential curriculum and a nation-wide education platform for both undergraduate students and under-represented groups. The project will generate performance-evaluation results from the developed codebase. They will be published to the online repository and be maintained there for 3 years: https://exo-sgx.github.io.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.