Securing Data Storage

保护数据存储

• 批准号: RGPIN-2018-04237
• 负责人: Reardon, Joel
• 金额: $ 2.04万
• 依托单位: University of Calgary
• 依托单位国家: 加拿大
• 项目类别: Discovery Grants Program - Individual
• 财政年份: 2020
• 资助国家: 加拿大
• 起止时间: 2020-01-01 至 2021-12-31
• 项目状态: 已结题
• 来源: https://www.nserc-crsng.gc.ca/ase-oro/Details-Detailles_eng.asp?id=712783
• 关键词: Securing; Data; Storage

Computer users store immense amounts of personal data and intellectual property across a variety of storage media (SD cards, USB sticks, laptops, attachments in e-mails, etc.), and these users are not given any guarantees about storage security. Some techniques, like encryption, are used in some places or to secure transmissions, but they are an aspect of what stores the data and not a policy tied to the data. There exists a variety of techniques for improving storage, such as encryption, secure deletion, deniable storage, history independence, and storage virtualization. Despite that, they are frequently not used together and none are widely used in practice. While this is sub-optimal for some users, it completely fails the world's more-extreme users working in hostile environments, such as military, journalists, and political dissidents. This work will raise the minimum standard for storage security by providing security as part of standard file systems. The research program has two broad components. One focuses on improving the security of portable flash-based storage to act as a first line of defense. Flash memory is widely used but it has a characteristic nuance: data cannot be overwritten. Instead new data is written out of place, and deletion can only happen at a large granularity. This has significant implications on the algorithms and file systems that store, read, and delete data. It also severely complicates several security features that would normally be easily provided. Building on a deep understanding of the challenges in designing flash file systems, this work will design a next-generation flash file system with the goals of harmonizing encryption, secure deletion, deniability, and other features without a significant cost in the usability and performance of the resulting file system. The second component is developing usable techniques to allow users to specify storage policy for data without having to specify the particular storage medium to use. Currently, users put files on USB sticks to make them portable, or e-mail it to themselves to access it on other computers. Users frequently make ad hoc backups, and store data in multiple places without a clear understanding of how, or even where, the data is stored. Current techniques people use to safeguard their data are inconvenient, insecure, unreliable, or unusable. We will create a Virtual Storage Device (VSD) to address these problems. The VSD will be a router for data to and from storage endpoints, allowing users to focus on the storage properties that they desire, such as security, speed, reliability, and cost. The VSD will abstract the physical properties of storage media (e.g., where they are located and how they are connected) from the policy and risk attributes that are meaningful to the user. Users will access, work on, and compute with their data ubiquitously as the data storage is separated from the physical computation devices.

计算机用户存储了大量的个人数据和知识 跨各种存储介质（SD卡，USB记忆棒，笔记本电脑， 电子邮件中的附件等），这些用户没有得到任何保证 关于存储安全。一些技术，如加密，被用于一些 地方或安全传输，但它们是存储 数据，而不是与数据相关的策略。 存在用于改进存储的各种技术，诸如加密、安全加密、加密和解密。 删除、可否认存储、历史独立性和存储虚拟化。 尽管如此，它们经常不一起使用，并且没有一个被广泛用于 实践虽然这对一些用户来说是次优的，但它完全失败了世界上的 在敌对环境中工作的更极端的用户，如军队，记者， 和政治异见人士。这项工作将提高存储安全的最低标准 作为标准文件系统的一部分提供安全性。 该研究计划有两个广泛的组成部分。一个重点是改善 便携式闪存存储的安全性作为第一道防线。 闪存被广泛使用，但它有一个特征性的细微差别：数据不能被 被覆盖了相反，新的数据被写得不合适，删除只能 发生在大粒度上。这对我们的未来有重大影响。 存储、读取和删除数据的算法和文件系统。它也严重 使几个安全特性变得复杂， 提供了基于对闪存设计挑战的深刻理解 文件系统，这项工作将设计一个下一代闪存文件系统与 协调加密、安全删除、可否认性和其他功能的目标 而不会在所得到的文件的可用性和性能方面产生显著的成本 系统 第二个组成部分是开发可用的技术，允许用户指定 用于数据的存储策略，而不必指定特定的存储介质 使用.目前，用户将文件放在U盘上，使其便携，或 通过电子邮件发送给他们自己以便在其他计算机上访问。用户经常 临时备份，并将数据存储在多个位置，而不清楚 数据是如何存储的，甚至是存储在哪里。目前人们使用的技术 不方便、不安全、不可靠或不可用。我们将 创建虚拟存储设备（VSD）来解决这些问题。VSD将 作为数据进出存储端点的路由器，使用户能够专注于 他们所需的存储属性，如安全性、速度、可靠性， 成本VSD将抽象存储介质的物理属性（例如，哪里 它们的位置以及它们的连接方式） 对用户有意义的东西。用户将访问、使用和计算 由于数据存储与物理存储分离， 计算设备。