Collaborative Research: SaTC: TTP: Medium: Intrusion-Tolerant Outsourced Storage for Cyber-Infrastructure

该项目解决的一般问题是，在存储数据的在线外包存储服务受到损害时，保护用户的私人、潜在敏感数据，如机密文件、图像、文件和文件夹。如今，用户通常使用密码对这类服务进行身份验证，该服务存储该密码的单向哈希。鉴于密码的弱点，一旦存储服务受到危害，存储密码哈希就会允许离线密码字典攻击，从而暴露用户的密码，从而暴露她的所有私人数据。为了提高外包私有数据的保密性，该项目的主要创新之处在于设计和开发了一个容忍入侵的外包存储(ITOS)系统，该系统使用户能够在一组受信者之间分发她的数据和/或保护这些数据的密码令牌，以便即使在受信者的某个子集已经被攻破时，密码和私有数据仍然保持保护。本项目在我们以前的基础工作的基础上，研究了：(1)可证明安全和高效的ITOS协议的设计，以及(2)基于这些协议的ITOS系统的实施、试点部署、评估和技术转让，与其“过渡到实践”的主题相一致。建议的系统可以透明地与不同的存储系统集成，包括流行的服务，如Google Drive、OneDrive或Dropbox。此外，ITOS还可以提高一般Web服务的认证安全性。弹性存储系统架构将为大学的研究科学家、学生和教职员工以及使用商业存储服务的日常计算机用户的数据提供更高水平的保护和访问。作为该项目的一部分开发的开源库将在未来建立容错系统的研究中具有巨大的价值。此外，该项目的研究活动将与教育活动相结合，在值得信赖的存储系统、安全数据体系结构和数据保证等广泛领域以高级课程开发和学生指导的形式进行。高中生和K-12学生以及少数群体的积极参与将有助于扩大该项目的影响范围。关于加强网络身份验证安全的一般应用，项目团队还通过与对这些协议感兴趣的互联网研究任务组(IRTF)利益相关者密切合作，开展标准化活动。该奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

This project addresses the general problem of protecting a user's private, potentially sensitive data, such as confidential documents, images, files and folders, in the event of the compromise of an online outsourced storage service on which the data is stored. Today, users typically authenticate to such services using a password and the service stores a one-way hash of this password. Given the weaknesses of passwords, storing password hashes allows for an offline password dictionary attack once the storage service is compromised, which exposes user's password and consequently also all her private data. To improve the secrecy of the outsourced private data, the project's main novelty lies in designing and developing an Intrusion-Tolerant Outsourced Storage (ITOS) system, which enables the user to distribute her data, and/or the cryptographic tokens which protect this data, among a set of trustees so that the password and private data remain protected even when a certain subset of the trustees have been compromised.Building upon our previous foundational work, this project investigates: (1) the design of provably secure and highly efficient protocols for ITOS, and (2) implementation, pilot deployment, evaluation and technology transfer of an ITOS system which builds upon these protocols, in line with its “transitioning to practice” theme. The proposed system can be transparently integrated with different storage systems including popular services like Google Drive, OneDrive or Dropbox. Moreover, ITOS can improve the authentication security for general web services. The resilient storage system architecture will offer an improved level of protection and accessibility to the data belonging to research scientists, students and staff at Universities as well as everyday computer users employing commercial storage services. The open-source library developed as part of the project will be of immense value in future research on building fault-tolerant systems. Further, the project’s research activities will be integrated with educational activities in the form of advanced curriculum development and student mentoring in the broad domains of Trustworthy Storage Systems, Secure Data Architectures and Data Assurance. Proactive involvement of high school and K-12 students and minority populations will help broaden the reach of the project. Regarding general application of strengthening web authentication security, the project team is also pursuing standardization activities by closely collaborating with Internet Research Task Force (IRTF) stakeholders with interest in these protocols.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.