SBIR Phase I: Distributed Secure Enclave For Modern Enterprise Networks And Critical Information Systems

这项小型企业创新研究（SBIR）项目的更广泛影响/商业潜力是保护关键基础设施和企业信息系统免受各级恶意数字对手的攻击。关键信息系统，例如那些促进基本服务或维护高度敏感/有价值的数字资产的关键信息系统，是高度复杂的对手的重要潜在目标。因此，这些系统中的漏洞构成了严重的安全威胁。拟议的项目将开发一种保护关键信息系统的新方法，为不太复杂的用户提供更高的保护和可访问性。该SBIR第一阶段项目建议构建和评估一个原型，实现分布式安全飞地的核心功能，该飞地能够作为零信任安全基础设施的分散、入侵容忍信任根。通过在封闭/许可的分布式账本（DL）网络中结合分布式密码学和入侵容忍分布式系统的进步，这样的平台将能够同时作为分散的记录系统和加密密钥托管服务运行。这些功能一旦得到验证，就可以扩展为提供关键的企业安全服务，如秘密存储/管理、数据/文档加密、证书/密钥管理、身份和访问管理（IdAM）、安全通信服务以及许多其他可证明安全的服务，包括在复杂的对手存在的情况下。通过构建和正式评估该技术的功能原型，该提议的项目不仅旨在证明该特定安全解决方案的技术有效性，而且还展示了将DL技术应用于企业内部实际应用的新范例。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

The broader impact/commercial potential of this Small Business Innovation Research (SBIR) project is to protect critical infrastructure and enterprise information systems against malicious digital adversaries at all levels. Critical information systems, such as those which facilitate essential services or maintain highly sensitive/valuable digital assets, represent significant potential targets for highly sophisticated adversaries. Consequently, vulnerabilities in these systems present grave security threats. The proposed project will develop a new method for securing critical information systems that offers both higher protection and accessibility for less sophisticated users. This SBIR Phase I project proposes to construct and evaluate a prototype implementing core functionality for a Distributed Secure Enclave capable of acting as a decentralized, intrusion-tolerant root of trust for zero-trust security infrastructure. By combining advancements from distributed cryptography and intrusion tolerant distributed systems within a closed/permissioned Distributed Ledger (DL) network, such a platform will have the ability to operate both as a decentralized system of record and cryptographic key escrow service. These capabilities, once proven, could then be extended to provide critical enterprise security services such as secret storage/management, data/document encryption, certificate/key management, identity and access management (IdAM), secure communication services, and many others in a manner that is provably secure—including in the presence of sophisticated adversaries. By constructing and formally evaluating a functional prototype of this technology, this proposed project aims not only to prove the technical efficacy of this particular security solution, but also to demonstrate a novel paradigm for applying DL technologies for practical applications within the enterprise.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.