Secure and efficient systems for Integrated Compression and Encryption

随着云计算和移动计算继续得到更广泛的采用，对数据的高效传输和存储的需求也在不断增加。压缩技术被广泛应用于基于Internet的信息系统中，以满足这些需求。与此同时，随着我们的日常生活变得越来越依赖这种数字基础设施，保护数据的安全和隐私变得无处不在。即使系统是由安全的加密算法构建的，如果将压缩与加密一起使用，系统级别的安全性也会受到影响。最近的犯罪和入侵攻击表明，传统的压缩和加密组合很容易受到“压缩侧通道”攻击。唯一有效的补救措施是禁用对SSL/TLS和HTTPS的压缩，几乎90%的网站已经这样做了。对几乎所有互联网连接使用加密的势头也越来越大。这些力量的组合在传输时间和带宽消耗方面提取了机会成本。这项研究将创建一种新的机制范例，用于安全地结合压缩和加密/身份验证，将压缩侧通道泄漏降至最低，并针对硬件中的有效实施进行优化。这项研究将有三个重点：集成压缩和加密的新算法；优化的硬件实现；以及用于设计、优化和分析的工具。研究结果将使加拿大人受益，从使用手机进行金融交易的消费者到使用云计算网络进行海量数据库的公司。根据信息和通信技术理事会最近的一项研究，加拿大的云计算行业落后于加拿大数字经济的其他部分。安全问题是加拿大企业进一步采用云计算的头号障碍。提高移动和云计算的安全性和效率将加速增长，并有助于提高加拿大在云计算领域的地位，以与其在数字经济其他领域的领先地位相媲美。

As cloud computing and mobile computing continue to become more widely adopted, there is an ever increasing demand for efficient transmission and storage of data. Compression is widely used in Internet-based information systems to satisfy these demands. At the same time, as our daily lives become ever more reliant upon this digital infrastructure, protecting the security and privacy of data becomes a pervasive necessity. Even if a system is built from secure cryptographic algorithms, system-level security is compromised if compression is used with encryption. The recent CRIME and BREACH attacks demonstrate that conventional combinations of compression and encryption are susceptible to "compression side-channel" attacks. The only effective remedy is to disable compression for SSL/TLS and HTTPS, which almost 90% of web sites have done. There is also growing momentum to use encryption for almost all Internet connections. The combination of these forces extracts an opportunity cost in transmission time and bandwidth consumption. This research will create a new paradigm of mechanisms for securely combining compression and encryption/authentication that will minimize compression side-channel leakage and be optimized for efficient implementation in hardware. The research will have three thrusts: new algorithms that integrate compression and encryption; optimized hardware implementations; and tools for design, optimization, and analysis. The research results will benefit Canadians from consumers using mobile phones for financial transaction to companies using cloud-computing networks for massive databases. According to a recent study by Information and Communications Technology Council, Canada's cloud computing industry lags behind other parts of the Canadian digital economy. Security concerns are the number one impediment to further adoption of cloud computing by Canadian corporations. Increasing the security and efficiency of mobile and cloud computing will accelerate growth and help raise Canada's standing in cloud computing to match its leadership in other areas of the digital economy.