SBIR Phase I: Distributed Secure Enclave For Modern Enterprise Networks And Critical Information Systems

小型企业创新研究(SBIR)项目更广泛的影响/商业潜力是保护关键基础设施和企业信息系统免受各级恶意数字对手的攻击。关键信息系统，如那些促进基本服务或维护高度敏感/有价值的数字资产的系统，是高度复杂的对手的重要潜在目标。因此，这些系统中的漏洞构成了严重的安全威胁。拟议的项目将开发一种保护关键信息系统的新方法，为不太复杂的用户提供更高的保护和可访问性。这个SBIR第一阶段项目建议构建和评估一个原型，该原型实现了分布式安全飞地的核心功能，能够充当零信任安全基础设施的分散、容忍入侵的信任根。通过在封闭/允许的分布式分类帐(DL)网络中结合分布式密码学和允许入侵的分布式系统的优点，这种平台将具有作为分散的记录系统和密钥托管服务运行的能力。一旦这些能力得到验证，就可以扩展到提供关键的企业安全服务，如秘密存储/管理、数据/文档加密、证书/密钥管理、身份和访问管理(IDAM)、安全通信服务以及许多其他可证明是安全的方式--包括在复杂对手在场的情况下。通过构建和正式评估这项技术的功能原型，该拟议项目不仅旨在证明这一特定安全解决方案的技术功效，还旨在展示在企业内将数字图书馆技术应用于实际应用的新范例。该奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

The broader impact/commercial potential of this Small Business Innovation Research (SBIR) project is to protect critical infrastructure and enterprise information systems against malicious digital adversaries at all levels. Critical information systems, such as those which facilitate essential services or maintain highly sensitive/valuable digital assets, represent significant potential targets for highly sophisticated adversaries. Consequently, vulnerabilities in these systems present grave security threats. The proposed project will develop a new method for securing critical information systems that offers both higher protection and accessibility for less sophisticated users. This SBIR Phase I project proposes to construct and evaluate a prototype implementing core functionality for a Distributed Secure Enclave capable of acting as a decentralized, intrusion-tolerant root of trust for zero-trust security infrastructure. By combining advancements from distributed cryptography and intrusion tolerant distributed systems within a closed/permissioned Distributed Ledger (DL) network, such a platform will have the ability to operate both as a decentralized system of record and cryptographic key escrow service. These capabilities, once proven, could then be extended to provide critical enterprise security services such as secret storage/management, data/document encryption, certificate/key management, identity and access management (IdAM), secure communication services, and many others in a manner that is provably secure—including in the presence of sophisticated adversaries. By constructing and formally evaluating a functional prototype of this technology, this proposed project aims not only to prove the technical efficacy of this particular security solution, but also to demonstrate a novel paradigm for applying DL technologies for practical applications within the enterprise.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.