TTP: Medium: A Campus Pilot For A Privacy-Enabled Cloud Storage, Search, and Collaboration Portal for Education

TTP：Medium：支持隐私的云存储、搜索和协作教育门户的校园试点

• 批准号: 1562376
• 负责人: Radu Sion
• 金额: $ 99.98万
• 依托单位: Private Machines Inc.
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2016
• 资助国家: 美国
• 起止时间: 2016-09-01 至 2019-08-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1562376&HistoricalAwards=false
• 关键词: TTP; Medium; Campus; Pilot; Privacy

As higher education institutions consider moving services to the cloud to save costs and improve collaboration, significant challenges to successful large-scale adoption still exist. Institutions are unwilling to risk cloud deployment because provable technological defenses have thus far been lacking. Control over sensitive data is relinquished without the institution's knowledge, liability is shifted and data breach risks are significantly increased. Further, regulatory-sensitive data has become an increasingly attractive target. Recent history shows one major breach every few weeks, with an alarming increase in frequency. This project directly addresses this significant challenge by transitioning to practice -- through an educational campus pilot -- searchable cloud storage and collaboration tools with full in-cloud privacy, at-runtime security and no shift in liability for educators and students. The pilot provides secure cloud storage to 24,500 students and 2,500 educators. It constitutes a testbed for deploying secure protocols in a live environment via the participation of researchers and students in its operation. Extensive data dissemination for academic research purposes is an integral part of the pilot. Collected data points serve as significant knowledge repositories not only in the security community but also in the storage and cloud research communities. The project will result in the creation of a significant number of trust and security-related information technology jobs which must remain stateside to maintain the economic and political security of the United States. The project trains students and contributes to the creation of a skilled cyber-security domestic workforce available to fulfill our nation's needs. The project provides new course material and involves underrepresented groups, including at least one female PhD student.The technical underpinnings of the work rely on new mechanisms that ensure data is strongly encrypted before leaving trusted client premises while allowing users to still securely collaborate, query, share, synchronize, search, backup etc. Contrary to conventional wisdom, the project constructs a secure design that is also truly practical, but would not have been feasible with a server-centric approach in which search operations are performed server-side on encrypted data and are computationally expensive and necessarily limited in expressiveness. Instead, the pilot is based on an efficient design in which operations are distributed to client-side logic in a scalable, efficient manner, operating orders of magnitude faster than the equivalent server code on encrypted data. To further optimize processing, the system enables clients to leverage each other's work (such as indexing) in a distributed secure manner, through cloud-mediated conduits and mechanisms. Overall, the system ensures the cloud cannot ever access user data or see user search queries. Ultimately, clients receive all cloud benefits while ensuring full regulatory compliance. Even if the cloud provider is breached, data is fully protected.

由于高等教育机构考虑将服务转移到云中以节省成本并提高协作，因此仍然存在成功采用大规模采用的重大挑战。机构不愿冒险云部署，因为迄今为止缺乏可证明的技术防御能力。在没有机构知识的情况下，对敏感数据的控制将被放弃，责任发生了变化，数据泄露风险大大增加。此外，调节敏感的数据已成为越来越有吸引力的目标。最近的历史显示每隔几周一次一次重大破坏，频率增加。该项目通过过渡到实践（通过教育校园飞行员）的实践直接解决了这一重大挑战，并具有全面的隐私，运转安全性和对教育工作者和学生的责任不转移的可搜索云存储和协作工具。飞行员为24,500名学生和2500名教育工作者提供安全的云存储。它构成了通过研究人员和学生的运作参与在实时环境中部署安全协议的测试台。用于学术研究目的的广泛数据传播是飞行员不可或缺的一部分。收集的数据点不仅是安全社区中的重要知识存储库，而且还可以作为存储和云研究社区的重要知识存储库。该项目将导致建立大量信任和与安全有关的信息技术工作，以维持美国的经济和政治安全。该项目培训学生，并为创建熟练的网络安全家庭劳动力做出贡献，以满足我们国家的需求。该项目提供了新的课程材料，并涉及占至少一名女性博士学位学生的群体。工作的技术基础依赖于确保数据在离开受信任的客户前提之前得到强烈加密的新机制，同时又使用户仍然可以安全地合作，Query，QUERY，QUERY，QUERY，QUERY，QUERY，QUERY，search，搜索，备份等方面的实践相反，这是一个非常适合的练习，这是一个经常性设计的，该项目的设计是稳定的，这是一个确定的，这是一个稳定的设计，这是一个确定的，这是一个确定的，这是一个经常的设计。以服务器为中心的方法，其中在加密数据上执行了服务器端的搜索操作，并且计算昂贵，并且有必要限制表达性。取而代之的是，该试验基于一个有效的设计，在该设计中，操作以可扩展，高效的方式分配给客户端逻辑，比在加密数据上的等效服务器代码快的操作顺序更快。为了进一步优化处理，该系统使客户能够通过云介导的导管和机制以分布式安全的方式利用彼此的工作（例如索引）。总体而言，系统确保云无法访问用户数据或查看用户搜索查询。最终，客户在确保完全法规合规性的同时获得了所有云福利。即使云提供商受到破坏，数据也得到了充分保护。