CAREER: Contextual Protection for Private Data Storage and Retrieval

职业：私有数据存储和检索的上下文保护

• 批准号: 1351058
• 负责人: Christopher Kanich
• 金额: $ 59.7万
• 依托单位: University of Illinois at Chicago
• 依托单位国家: 美国
• 项目类别: Continuing Grant
• 财政年份: 2014
• 资助国家: 美国
• 起止时间: 2014-02-01 至 2020-01-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1351058&HistoricalAwards=false
• 关键词: CAREER; Contextual; Protection; Private; Data

This research is building an understanding of what data is useful to attackers and what data is private for its legitimate owners so that security systems can incorporate these values into a data-driven, defense-in-depth approach to securing our digital lives. We are exploiting the fact that both users and attackers must sift through vast amounts of data to find useful information. This system, called contextual data protection, enables users to passively manage their private and potentially lucrative stored data with minimal overhead, adding extra protection to private data which greatly lowers the risk inherent in long lived archives. Simultaneously, we are creating effective defenses for data by improving our understanding of cybercrime, information use habits, and acceptable usability tradeoffs for data access. Building on previous research analyzing the financial successes of spam-based cybercrime, we are developing a methodology and apparatus for understanding the illicit value of stolen information. By understanding what is discoverable and valuable to attackers, we can develop techniques to focus security efforts on lucrative information, thereby preventing cybercriminals from turning a profit. Ultimately, our goal is to create a set of general techniques that use tools from cryptography that defend users' data by exploiting a deeper understanding of its value to both the users and the attackers. This research will shed light on the meaning of information value, ownership, and protection in this era of long-lived digital storage.

这项研究正在理解哪些数据对攻击者有用，哪些数据对其合法所有者来说是私人的，以便安全系统可以将这些价值纳入以数据驱动的，以数据为基础的防御方法中，以确保我们的数字生活。我们正在利用这样一个事实，即用户和攻击者都必须筛选大量数据才能找到有用的信息。该系统称为上下文数据保护，使用户能够用最小的开销来被动地管理其私人且潜在的有利可图的数据，从而为私人数据增加了额外的保护，从而大大降低了长期存在的档案中固有的风险。 同时，我们通过提高对网络犯罪，信息使用习惯以及可接受的可用可用性权衡而为数据访问创造有效的数据防御措施。在先前研究基于垃圾邮件的网络犯罪的财务成功的基础上，我们正在开发一种方法和设备，以理解被盗信息的非法价值。通过了解攻击者可发现和有价值的东西，我们可以开发技术将安全工作集中在有利可图的信息上，从而防止网络犯罪分子转移利润。 最终，我们的目标是创建一组通用技术，该技术使用加密技术来使用工具来捍卫用户数据，以深入了解其对用户和攻击者的价值。这项研究将阐明在这个长期数字存储时代的信息价值，所有权和保护的含义。