Securing Data Storage

计算机用户存储了海量的个人数据和智力 跨各种存储介质(SD卡、U盘、笔记本电脑、 电子邮件中的附件)，而这些用户不会得到任何保证 关于存储安全的问题。一些技术，如加密，被用在一些 位置或保护传输，但它们是存储 数据，而不是与数据绑定的策略。 存在用于改进存储的各种技术，例如加密、安全 删除、可否认存储、历史独立性和存储虚拟化。 尽管如此，它们经常不一起使用，也没有被广泛用于 练习一下。虽然这对一些用户来说不是最优的，但它完全没有达到世界上的 更极端的用户，在恶劣的环境中工作，如军队、记者、 以及持不同政见者。这项工作将提高存储安全的最低标准 通过将安全性作为标准文件系统的一部分来提供。 这项研究计划有两个主要组成部分。一是着力提高 以便携式闪存为基础的安全存储充当第一道防线。 闪存被广泛使用，但它有一个特点：数据不能 被覆盖。取而代之的是，新数据被写入错位，并且删除只能 以大的粒度发生。这对 存储、读取和删除数据的算法和文件系统。它还严重地 使几个通常很容易实现的安全功能复杂化 如果是这样的话。以对闪存设计挑战的深刻理解为基础 文件系统，这项工作将设计下一代闪存文件系统 统一加密、安全删除、可否认性和其他功能的目标 而不会显著降低结果文件的可用性和性能 系统。 第二个组件是开发可用的技术，以允许用户指定 无需指定特定存储介质的数据存储策略 来使用。目前，用户将文件放在U盘上以使其便携，或者 通过电子邮件将其发送给自己，以便在其他计算机上访问它。用户经常制作 临时备份，并在没有明确了解的情况下将数据存储在多个位置 数据是如何存储的，甚至是在哪里存储的。目前人们使用的技术 保护他们的数据不方便、不安全、不可靠或不可用。我们会 创建虚拟存储设备(VSD)来解决这些问题。VSD将会 成为数据进出存储终端的路由器，使用户能够专注于 他们所需的存储属性，如安全性、速度、可靠性和 成本。VSD将抽象存储介质的物理属性(例如，在哪里 它们的位置和连接方式)来自策略和风险属性 对用户有意义的信息。用户将访问、处理和计算 他们的数据无处不在，因为数据存储与物理存储分离 计算设备。

Computer users store immense amounts of personal data and intellectual property across a variety of storage media (SD cards, USB sticks, laptops, attachments in e-mails, etc.), and these users are not given any guarantees about storage security. Some techniques, like encryption, are used in some places or to secure transmissions, but they are an aspect of what stores the data and not a policy tied to the data. There exists a variety of techniques for improving storage, such as encryption, secure deletion, deniable storage, history independence, and storage virtualization. Despite that, they are frequently not used together and none are widely used in practice. While this is sub-optimal for some users, it completely fails the world's more-extreme users working in hostile environments, such as military, journalists, and political dissidents. This work will raise the minimum standard for storage security by providing security as part of standard file systems. The research program has two broad components. One focuses on improving the security of portable flash-based storage to act as a first line of defense. Flash memory is widely used but it has a characteristic nuance: data cannot be overwritten. Instead new data is written out of place, and deletion can only happen at a large granularity. This has significant implications on the algorithms and file systems that store, read, and delete data. It also severely complicates several security features that would normally be easily provided. Building on a deep understanding of the challenges in designing flash file systems, this work will design a next-generation flash file system with the goals of harmonizing encryption, secure deletion, deniability, and other features without a significant cost in the usability and performance of the resulting file system. The second component is developing usable techniques to allow users to specify storage policy for data without having to specify the particular storage medium to use. Currently, users put files on USB sticks to make them portable, or e-mail it to themselves to access it on other computers. Users frequently make ad hoc backups, and store data in multiple places without a clear understanding of how, or even where, the data is stored. Current techniques people use to safeguard their data are inconvenient, insecure, unreliable, or unusable. We will create a Virtual Storage Device (VSD) to address these problems. The VSD will be a router for data to and from storage endpoints, allowing users to focus on the storage properties that they desire, such as security, speed, reliability, and cost. The VSD will abstract the physical properties of storage media (e.g., where they are located and how they are connected) from the policy and risk attributes that are meaningful to the user. Users will access, work on, and compute with their data ubiquitously as the data storage is separated from the physical computation devices.