Securing Data Storage

点击翻译按钮获取中文摘要

Computer users store immense amounts of personal data and intellectualproperty across a variety of storage media (SD cards, USB sticks, laptops,attachments in e-mails, etc.), and these users are not given any guaranteesabout storage security. Some techniques, like encryption, are used in someplaces or to secure transmissions, but they are an aspect of what stores thedata and not a policy tied to the data.There exists a variety of techniques for improving storage, such as encryption, securedeletion, deniable storage, history independence, and storage virtualization.Despite that, they are frequently not used together and none are widely used inpractice. While this is sub-optimal for some users, it completely fails the world'smore-extreme users working in hostile environments, such as military, journalists,and political dissidents. This work will raise the minimum standard for storage securityby providing security as part of standard file systems.The research program has two broad components. One focuses on improving thesecurity of portable flash-based storage to act as a first line of defense.Flash memory is widely used but it has a characteristic nuance: data cannot beoverwritten. Instead new data is written out of place, and deletion can onlyhappen at a large granularity. This has significant implications on thealgorithms and file systems that store, read, and delete data. It also severelycomplicates several security features that would normally be easilyprovided. Building on a deep understanding of the challenges in designing flashfile systems, this work will design a next-generation flash file system with thegoals of harmonizing encryption, secure deletion, deniability, and other featureswithout a significant cost in the usability and performance of the resulting filesystem.The second component is developing usable techniques to allow users to specifystorage policy for data without having to specify the particular storage mediumto use. Currently, users put files on USB sticks to make them portable, ore-mail it to themselves to access it on other computers. Users frequently makead hoc backups, and store data in multiple places without a clear understandingof how, or even where, the data is stored. Current techniques people use tosafeguard their data are inconvenient, insecure, unreliable, or unusable. We willcreate a Virtual Storage Device (VSD) to address these problems. The VSD willbe a router for data to and from storage endpoints, allowing users to focus onthe storage properties that they desire, such as security, speed, reliability, andcost. The VSD will abstract the physical properties of storage media (e.g., wherethey are located and how they are connected) from the policy and risk attributesthat are meaningful to the user. Users will access, work on, and compute withtheir data ubiquitously as the data storage is separated from the physicalcomputation devices.