Securing Data Storage

保护数据存储

• 批准号: RGPIN-2018-04237
• 负责人: Reardon, Joel
• 金额: $ 2.04万
• 依托单位: University of Calgary
• 依托单位国家: 加拿大
• 项目类别: Discovery Grants Program - Individual
• 财政年份: 2019
• 资助国家: 加拿大
• 起止时间: 2019-01-01 至 2020-12-31
• 项目状态: 已结题
• 来源: https://www.nserc-crsng.gc.ca/ase-oro/Details-Detailles_eng.asp?id=682770
• 关键词: Securing; Data; Storage

Computer users store immense amounts of personal data and intellectual***property across a variety of storage media (SD cards, USB sticks, laptops,***attachments in e-mails, etc.), and these users are not given any guarantees***about storage security. Some techniques, like encryption, are used in some***places or to secure transmissions, but they are an aspect of what stores the***data and not a policy tied to the data.******There exists a variety of techniques for improving storage, such as encryption, secure***deletion, deniable storage, history independence, and storage virtualization.***Despite that, they are frequently not used together and none are widely used in***practice. While this is sub-optimal for some users, it completely fails the world's***more-extreme users working in hostile environments, such as military, journalists,***and political dissidents. This work will raise the minimum standard for storage security***by providing security as part of standard file systems.******The research program has two broad components. One focuses on improving the***security of portable flash-based storage to act as a first line of defense.***Flash memory is widely used but it has a characteristic nuance: data cannot be***overwritten. Instead new data is written out of place, and deletion can only***happen at a large granularity. This has significant implications on the***algorithms and file systems that store, read, and delete data. It also severely***complicates several security features that would normally be easily***provided. Building on a deep understanding of the challenges in designing flash***file systems, this work will design a next-generation flash file system with the***goals of harmonizing encryption, secure deletion, deniability, and other features***without a significant cost in the usability and performance of the resulting file***system.******The second component is developing usable techniques to allow users to specify***storage policy for data without having to specify the particular storage medium***to use. Currently, users put files on USB sticks to make them portable, or***e-mail it to themselves to access it on other computers. Users frequently make***ad hoc backups, and store data in multiple places without a clear understanding***of how, or even where, the data is stored. Current techniques people use to***safeguard their data are inconvenient, insecure, unreliable, or unusable. We will***create a Virtual Storage Device (VSD) to address these problems. The VSD will***be a router for data to and from storage endpoints, allowing users to focus on***the storage properties that they desire, such as security, speed, reliability, and***cost. The VSD will abstract the physical properties of storage media (e.g., where***they are located and how they are connected) from the policy and risk attributes***that are meaningful to the user. Users will access, work on, and compute with***their data ubiquitously as the data storage is separated from the physical***computation devices.**

计算机用户通过各种存储介质（SD卡、USB记忆棒、笔记本电脑、电子邮件附件等）存储大量个人数据和知识产权，并且这些用户没有得到关于存储安全性的任何保证。一些技术，如加密，用于某些 * 地方或安全传输，但它们是存储 * 数据的一个方面，而不是与数据相关的策略。存在多种改进存储的技术，例如加密、安全 * 删除、可否认存储、历史独立性和存储虚拟化。*尽管如此，它们经常不一起使用，在 * 实践中也没有广泛使用。虽然这对一些用户来说是次优的，但它完全失败了世界上在敌对环境中工作的更极端的用户，如军队，记者，* 和政治异见人士。这项工作将提高存储安全性的最低标准 *，将安全性作为标准文件系统的一部分。*该研究计划有两个广泛的组成部分。其中一个重点是提高基于闪存的便携式存储的安全性，作为第一道防线。闪存被广泛使用，但它有一个特点：数据不能被覆盖。相反，新的数据被写在不合适的位置，删除只能在大粒度下发生。这对存储、读取和删除数据的 * 算法和文件系统具有重要意义。它还严重地使通常容易提供的几个安全特性复杂化。基于对闪存 * 文件系统设计挑战的深刻理解，本工作将设计下一代闪存文件系统，其目标是协调加密、安全删除、可否认性和其他功能 *，而不会在最终文件 * 系统的可用性和性能方面产生重大成本。**第二个组成部分是开发可用的技术，允许用户指定数据的 * 存储策略，而不必指定要使用的特定存储介质 *。目前，用户把文件放在USB记忆棒上，使它们便携，或 * 电子邮件给自己访问它在其他计算机上。用户经常进行 * 临时备份，并将数据存储在多个地方，而不清楚 * 数据是如何存储的，甚至不清楚数据存储在哪里。目前人们用来保护数据的技术是不方便的、不安全的、不可靠的或不可用的。我们将创建一个虚拟存储设备（VSD）来解决这些问题。VSD将 * 成为数据进出存储端点的路由器，允许用户专注于他们想要的 * 存储属性，例如安全性，速度，可靠性和 * 成本。VSD将抽象存储介质的物理属性（例如，它们的位置 * 以及它们的连接方式）与对用户有意义的策略和风险属性 * 进行比较。由于数据存储与物理 * 计算设备分离，用户将无处不在地访问、处理和计算他们的数据。