Collaborative Research: SaTC: TTP: Medium: Intrusion-Tolerant Outsourced Storage for Cyber-Infrastructure

该项目解决的一般性问题是，在存储数据的在线外包存储服务受到损害的情况下，保护用户的私人、潜在敏感数据，如机密文件、图像、文件和文件夹。如今，用户通常使用密码向此类服务进行身份验证，并且服务存储该密码的单向散列。鉴于密码的弱点，一旦存储服务受到损害，存储密码散列允许离线密码字典攻击，这会暴露用户的密码，因此也暴露了她的所有私人数据。为了提高外包私人数据的保密性，该项目的主要新奇在于设计和开发一个入侵容忍外包存储（ITOS）系统，该系统使用户能够分发她的数据，和/或保护这些数据的加密令牌，在一组受讬人之间，以便即使受讬人的某个子集已被泄露，密码和私人数据也会受到保护。本项目在以往基础工作的基础上，研究：（1）设计可证明安全和高效的ITOS协议，（2）按照其“过渡到实践”的主题，在这些协议的基础上建立ITOS系统的实施、试验部署、评估和技术转让。该系统可以透明地与不同的存储系统集成，包括Google Drive，OneDrive或Dropbox等流行服务。此外，ITOS可以提高一般Web服务的认证安全性。弹性存储系统架构将为大学的研究科学家、学生和工作人员以及使用商业存储服务的日常计算机用户提供更高级别的保护和访问能力。作为该项目一部分开发的开源库将在未来构建容错系统的研究中具有巨大价值。此外，该项目的研究活动将与教育活动相结合，其形式是在可信赖的存储系统、安全数据架构和数据保障等广泛领域开展高级课程开发和学生辅导。高中和K-12学生以及少数民族的积极参与将有助于扩大该项目的范围。关于加强网络认证安全的一般应用，项目组还与对这些协议感兴趣的互联网研究任务组（IRTF）利益相关者密切合作，开展标准化活动。该奖项反映了NSF的法定使命，通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

This project addresses the general problem of protecting a user's private, potentially sensitive data, such as confidential documents, images, files and folders, in the event of the compromise of an online outsourced storage service on which the data is stored. Today, users typically authenticate to such services using a password and the service stores a one-way hash of this password. Given the weaknesses of passwords, storing password hashes allows for an offline password dictionary attack once the storage service is compromised, which exposes user's password and consequently also all her private data. To improve the secrecy of the outsourced private data, the project's main novelty lies in designing and developing an Intrusion-Tolerant Outsourced Storage (ITOS) system, which enables the user to distribute her data, and/or the cryptographic tokens which protect this data, among a set of trustees so that the password and private data remain protected even when a certain subset of the trustees have been compromised.Building upon our previous foundational work, this project investigates: (1) the design of provably secure and highly efficient protocols for ITOS, and (2) implementation, pilot deployment, evaluation and technology transfer of an ITOS system which builds upon these protocols, in line with its “transitioning to practice” theme. The proposed system can be transparently integrated with different storage systems including popular services like Google Drive, OneDrive or Dropbox. Moreover, ITOS can improve the authentication security for general web services. The resilient storage system architecture will offer an improved level of protection and accessibility to the data belonging to research scientists, students and staff at Universities as well as everyday computer users employing commercial storage services. The open-source library developed as part of the project will be of immense value in future research on building fault-tolerant systems. Further, the project’s research activities will be integrated with educational activities in the form of advanced curriculum development and student mentoring in the broad domains of Trustworthy Storage Systems, Secure Data Architectures and Data Assurance. Proactive involvement of high school and K-12 students and minority populations will help broaden the reach of the project. Regarding general application of strengthening web authentication security, the project team is also pursuing standardization activities by closely collaborating with Internet Research Task Force (IRTF) stakeholders with interest in these protocols.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.