CSR: Medium: CloudTracker: Transparent, Secure Provenance Tracking and Security Policy Enforcement in Clouds

随着公司、政府和个人用户采用越来越多样化的计算平台，从外包云计算到个人笔记本电脑和移动的设备，在这些平台上实施统一的安全策略变得难以实施。同样，法规遵从性和业务审计需要以全面、安全和独立于平台的方式跟踪这些数据的历史。不幸的是，技术还没有跟上这些实际问题的步伐，必须解决几个系统和安全研究的挑战，使这一愿景成为现实。在理解数据的起源和使用数据的历史来执行安全策略之间有一种自然的和未被探索的联系。为了利用这种联系，该项目正在开发一个全面的通用框架，用于自动跟踪数据历史并在云计算环境中执行相关的安全策略。研究重点是三个关键的研究挑战。首先，该项目研究虚拟化技术的新应用，通过检查客户操作系统（OS）和应用程序来透明地推断数据来源。其次，该项目正在开发在云规模上安全存储、管理和查询来源数据的技术。最后，该项目结合了前两种技术，在整个云和最终用户系统中透明地、协同地执行安全策略，原型系统旨在让个人用户和组织快速采用新技术平台，从云到新型最终用户系统，而不必担心这些新系统与安全策略和法规遵从性问题的交互。

As companies, governments, and individual users adopt increasingly diverse computing platforms, from outsourced cloud computations to personal laptops and mobile devices, enforcing uniform security policies across these platforms becomes unwieldy.Similarly, regulatory compliance and business auditing requires tracking the history of this data in a comprehensive, secure, and platform-independent manner. Unfortunately, technology has not kept pace with these practical concerns, and several systems and security research challenges must be addressed to make this vision a reality.There is a natural and under-explored connection between understanding the origins of data and using that data's history to enforce security policies. To leverage this connection, this project is developing a comprehensive, general framework for automatically tracking the history of data and enforcing associated security policies in cloud computing environments. The research focuses on three key research challenges. First, the project investigates novel applications of virtualization technologies to transparently infer data provenance by inspecting a guest operating system (OS) and applications. Second, this project is developing techniques to securely store, manage, and query provenance data at cloud scale. Finally, the project combines the first two technologies to transparently and collaboratively enforce security policies throughout the cloud and end-user systems.The prototype system is designed to allow individual users and organizations to rapidly adopt new technology platforms, from clouds to novel end-user systems, without having to worry about the interaction of these new systems with security policies and regulatory compliance concerns.