EAGER: Enabling Secure Data Recovery for Mobile Devices against Malicious Attacks

智能手机和平板电脑等主流移动计算设备目前依赖远程备份来实现故障时的数据恢复。例如，iPhone定期将最新的快照存储到iCloud，如果需要，可以恢复该快照。然而，这种通常使用的“设备外”备份机制受到一个基本限制，即远程服务器中的备份并不总是与存储在本地设备中的数据同步。因此，当移动设备遭受恶意软件攻击时，只能使用远程备份将其恢复到历史状态，而不是恰好在攻击发生之前的确切状态。数据对组织和个人都非常有价值，因此在恶意软件攻击后，将数据恢复到准确的点(即损坏点)是至关重要的，直到它们被破坏。然而，这是一个具有挑战性的问题。该项目解决了移动设备中的这个问题，其结果可能会使数十亿移动用户受益。该项目还为研究生提供培训机会，特别是来自代表人数不足的少数群体的研究生。该项目的一个主要目标是使移动设备能够在恶意软件攻击后恢复到破坏点。正在考虑的恶意软件是可以危害操作系统并获得操作系统级权限的操作系统级恶意软件。为了实现这一目标，该项目将传统的设备外数据备份和恢复与一种新颖的设备内数据恢复相结合。1)设计了一种运行在闪存转换层(FTL)中的新型恶意软件检测器，FTL是介于操作系统和闪存硬件之间的固件层。基于FTL的恶意软件检测器可确保提交到远程服务器的数据不会被操作系统级恶意软件篡改。2)开发一种新的方法，确保操作系统级恶意软件不能破坏尚未提交到远程服务器的数据更改(即，增量)。这是通过使用闪存的特殊硬件功能在闪存中隐藏增量来实现的，即异地更新和强大的物理隔离。3)开发一种用户友好的方法，允许用户方便高效地检索隐藏在闪存中的增量，以便在恶意软件攻击后进行数据恢复。该奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

Mainstream mobile computing devices, such as, smart phones and tablets, currently rely on remote backups for data recovery upon failures. For example, an iPhone periodically stores a recent snapshot to iCloud, that can get restored if needed. Such a commonly used "off-device" backup mechanism, however, suffers from a fundamental limitation, namely, the backup in the remote server is not always synchronized with data stored in the local device. Therefore, when a mobile device suffers from a malware attack, it can only be restored to a historical state using the remote backup, rather than the exact state right before the attack occurs. Data are extremely valuable for both organizations and individuals, and thus after the malware attack, it is of paramount importance to restore the data to the exact point (i.e., the corruption point) right before they are corrupted. This, however, is a challenging problem. The project addresses this problem in mobile devices and its outcome could benefit billions of mobile users. The project also provides opportunities for training for graduate students specially from underrepresented minority groups. A primary goal of the project is to enable recovery of mobile devices to the corruption point after malware attacks. The malware being considered is the OS-level malware which can compromise the OS and obtain the OS-level privilege. To achieve this goal, the project combines both the traditional off-device data backup and recovery and a novel in-device data recovery. Especially, the following research activities are undertaken: 1) Designing a novel malware detector which runs in flash translation layer (FTL), a firmware layer staying between OS and flash memory hardware. The FTL-based malware detector ensures that data being committed to the remote server will not be tampered with by the OS-level malware. 2) Developing a novel approach which ensures that the OS-level malware is not able to corrupt data changes (i.e., delta) which have not yet been committed to the remote server. This is achieved by hiding the delta in the flash memory using flash storage's special hardware features, i.e., out-of-place update and strong physical isolation. 3) Developing a user-friendly approach which can allow users to conveniently and efficiently retrieve the delta hidden in the flash memory for data recovery after malware attacks.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.