Securing Data Storage

点击翻译按钮获取中文摘要

Computer users store immense amounts of personal data and intellectual***property across a variety of storage media (SD cards, USB sticks, laptops,***attachments in e-mails, etc.), and these users are not given any guarantees***about storage security. Some techniques, like encryption, are used in some***places or to secure transmissions, but they are an aspect of what stores the***data and not a policy tied to the data.******There exists a variety of techniques for improving storage, such as encryption, secure***deletion, deniable storage, history independence, and storage virtualization.***Despite that, they are frequently not used together and none are widely used in***practice. While this is sub-optimal for some users, it completely fails the world's***more-extreme users working in hostile environments, such as military, journalists,***and political dissidents. This work will raise the minimum standard for storage security***by providing security as part of standard file systems.******The research program has two broad components. One focuses on improving the***security of portable flash-based storage to act as a first line of defense.***Flash memory is widely used but it has a characteristic nuance: data cannot be***overwritten. Instead new data is written out of place, and deletion can only***happen at a large granularity. This has significant implications on the***algorithms and file systems that store, read, and delete data. It also severely***complicates several security features that would normally be easily***provided. Building on a deep understanding of the challenges in designing flash***file systems, this work will design a next-generation flash file system with the***goals of harmonizing encryption, secure deletion, deniability, and other features***without a significant cost in the usability and performance of the resulting file***system.******The second component is developing usable techniques to allow users to specify***storage policy for data without having to specify the particular storage medium***to use. Currently, users put files on USB sticks to make them portable, or***e-mail it to themselves to access it on other computers. Users frequently make***ad hoc backups, and store data in multiple places without a clear understanding***of how, or even where, the data is stored. Current techniques people use to***safeguard their data are inconvenient, insecure, unreliable, or unusable. We will***create a Virtual Storage Device (VSD) to address these problems. The VSD will***be a router for data to and from storage endpoints, allowing users to focus on***the storage properties that they desire, such as security, speed, reliability, and***cost. The VSD will abstract the physical properties of storage media (e.g., where***they are located and how they are connected) from the policy and risk attributes***that are meaningful to the user. Users will access, work on, and compute with***their data ubiquitously as the data storage is separated from the physical***computation devices.**