TWC: Small: Auditing PII in the Cloud with CloudFence

该项目将调查，原型设计和评估CloudFence，这是一个拟议的框架，允许用户通过云提供商托管的干预，独立审计第三方在线服务对其私人数据的处理。具体来说，PI将研究用于对“感兴趣的信息”进行细粒度跟踪的新技术。（如由云服务的用户以灵活的、上下文敏感的方式定义的）向（a）向终端用户提供云对其信息的处理的增加的透明度，以及（B）使得能够周期性地（或甚至连续）审计所述处理，由用户或代表她的代理人进行。潜在的假设是，可以跨云创建通用的、应用程序不可知的信息跟踪机制，该机制可以在遗留应用程序和新开发的应用程序上操作，使得用户可以利用他们对基础设施提供商的信任，而不会对所述提供商施加不合理的约束（例如，不需要手动检查应用程序）。该项目将采用系统方法，旨在通过将CloudFence应用于PI部门管理云计算基础设施时遇到的真实的问题来证明CloudFence的可行性、有效性和局限性;工作的很大一部分将用于系统评估。这项工作的成果包括：（a）云环境中信息审计的新架构框架;（B）演示概念的软件原型;（c）会议和期刊出版物和报告;以及（d）专注于云和Web安全的网络安全实验室。

This project will investigate, prototype and evaluate CloudFence, a proposed framework that allows users to independently audit the treatment of their private data by third-party online services, through the intervention of the cloud provides hosting said services. Specifically, the PI will investigate, novel techniques for conducting fine-grained tracking of ``information of interest'' (as defined by the user of the cloud service, in a flexible, context-sensitive manner) toward (a) providing increased transparency to end users of the handling of their information by the cloud, and (b) enabling the periodic (or even continuous) auditing of said handling, either by the user or an agent acting on her behalf. The underlying hypothesis is that it is possible to create a general-purpose, application-agnostic information tracking mechanism across the cloud that can operate on both legacy and newly developed applications, such that users can leverage their trust on the infrastructure provider without imposing unreasonable constraints on said provider (e.g., not requiring manual inspection of applications). The project will take a systems approach, aiming to demonstrate the feasibility, effectiveness, and limitations of CloudFence by applying it to real problems encountered in managing the cloud computing infrastructure of the PI's department; a significant part of the effort will go toward system evaluation. Tangible results of the effort include (a) a new architectural framework for information auditing in a cloud environment, (b) software prototypes demonstrating the concepts, (c) conference and journal publications and reports, and (d) a network security lab focusing on cloud and web security.