EAGER: Enabling Secure Data Recovery for Mobile Devices against Malicious Attacks

主流的移动计算设备，如智能手机和平板电脑，目前都依赖于远程备份，以便在故障时恢复数据。例如，iPhone定期将最近的快照存储到iCloud，如果需要，可以恢复。然而，这种常用的“设备外”备份机制存在一个基本限制，即远程服务器中的备份并不总是与存储在本地设备中的数据同步。因此，当移动设备遭受恶意软件攻击时，只能通过远程备份将其恢复到历史状态，而不能恢复到攻击发生前的确切状态。数据对于组织和个人来说都是非常有价值的，因此在恶意软件攻击之后，将数据恢复到它们被破坏之前的精确点（即损坏点）是至关重要的。然而，这是一个具有挑战性的问题。该项目解决了移动设备中的这一问题，其成果可能使数十亿移动用户受益。该项目还为研究生提供培训机会，特别是来自代表性不足的少数群体的研究生。该项目的主要目标是使移动设备在受到恶意软件攻击后恢复到损坏点。这里考虑的恶意软件是操作系统级别的恶意软件，它可以入侵操作系统并获得操作系统级别的特权。为了实现这一目标，该项目将传统的设备外数据备份和恢复与新颖的设备内数据恢复相结合。主要进行了以下研究工作：1)设计了一种运行在flash转换层（FTL）中的新型恶意软件检测器，FTL是位于操作系统和闪存硬件之间的固件层。基于ftl的恶意软件检测器确保提交给远程服务器的数据不会被操作系统级恶意软件篡改。2)开发一种新方法，确保操作系统级恶意软件无法破坏尚未提交给远程服务器的数据更改（即delta）。这是通过使用闪存的特殊硬件特性（即，位置外更新和强物理隔离）将增量隐藏在闪存中实现的。3)开发一种用户友好的方法，可以让用户方便有效地检索隐藏在闪存中的增量，用于恶意软件攻击后的数据恢复。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

Mainstream mobile computing devices, such as, smart phones and tablets, currently rely on remote backups for data recovery upon failures. For example, an iPhone periodically stores a recent snapshot to iCloud, that can get restored if needed. Such a commonly used "off-device" backup mechanism, however, suffers from a fundamental limitation, namely, the backup in the remote server is not always synchronized with data stored in the local device. Therefore, when a mobile device suffers from a malware attack, it can only be restored to a historical state using the remote backup, rather than the exact state right before the attack occurs. Data are extremely valuable for both organizations and individuals, and thus after the malware attack, it is of paramount importance to restore the data to the exact point (i.e., the corruption point) right before they are corrupted. This, however, is a challenging problem. The project addresses this problem in mobile devices and its outcome could benefit billions of mobile users. The project also provides opportunities for training for graduate students specially from underrepresented minority groups. A primary goal of the project is to enable recovery of mobile devices to the corruption point after malware attacks. The malware being considered is the OS-level malware which can compromise the OS and obtain the OS-level privilege. To achieve this goal, the project combines both the traditional off-device data backup and recovery and a novel in-device data recovery. Especially, the following research activities are undertaken: 1) Designing a novel malware detector which runs in flash translation layer (FTL), a firmware layer staying between OS and flash memory hardware. The FTL-based malware detector ensures that data being committed to the remote server will not be tampered with by the OS-level malware. 2) Developing a novel approach which ensures that the OS-level malware is not able to corrupt data changes (i.e., delta) which have not yet been committed to the remote server. This is achieved by hiding the delta in the flash memory using flash storage's special hardware features, i.e., out-of-place update and strong physical isolation. 3) Developing a user-friendly approach which can allow users to conveniently and efficiently retrieve the delta hidden in the flash memory for data recovery after malware attacks.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.