云存储中数据泄漏的主动防护关键技术研究

Data leakage is the primary security problem in current generalized application processes of cloud storage. Due to the open and sharing particularity of cloud storage, traditional boundary based security technologies are difficult to meet the needs of data leakage prevention in cloud storage. Data encryption retrieval technique and cryptographic access control technology, etc. are proposed in recent years. They assure that data sharing is controlled to a great degree even the server provider is unlikelihood, but lack effective protection for data sharing usage and leakage threat in data transfer process. Analyzing the flow characteristic of data and typical leakage threat characteristic in cloud storage, this project establishes an active data leakage protection model. This model is centered on the security expectation of data owner, including the server based on the authorized dynamic isolation to provide a secure and reliable storage services, and the client through the fine-grained usage control to ensure that data is accessed and used in accordance with the owner expectation. At the same time, we establish a reliable data transmission and dynamic strategy perception channel between the server and the client to protect data continuously in the whole sharing transfer process including creating, publishing, accessing, using and permission recycling. The active protection model studied in this project is expected to provide a theoretical basis and security guarantee for establishing a more secure and reliable cloud storage architecture.

数据泄漏是当前云存储推广应用过程中面临的首要安全威胁。由于云存储的开放性和共享性，传统基于边界的安全技术难以适应云存储中数据泄漏防护的需求。近年来提出的数据加密检索和密文访问控制等技术，在很大程度上保证了服务商不可信条件下的数据受控共享，但目前对共享数据的使用过程以及数据在整个流转过程中的泄漏威胁还缺少必要的手段。本课题在分析云存储中数据流动以及典型泄漏威胁特点的基础上，建立数据泄漏的主动防护模型。该模型以数据和所有者的安全预期为核心，在服务端通过基于授权的动态隔离提供安全可信的存储服务，用户端通过细粒度的使用控制确保数据按照所有者预期被访问和使用，并在服务端和用户端之间建立可信的数据传输和策略动态感知通道，从而建立起数据从创建、发布、访问、使用到权限回收整个共享流转过程的连续防护。本项目研究的主动防护模型，可望为建立更加安全可信的云存储体系结构提供理论基础和安全保证。

本项目在分析典型云存储系统中数据流动和典型泄漏威胁特点的基础上，构建应用可感知策略对用户的内容数据进行保护，并基于TTS构建了一个可信管理框架；基于JVM虚拟机和可信代理实现云计算环境下应用的动态隔离和评估认证；结合控制流和信息流的完整性防护，实现上下文敏感的控制流完整性防护和间接路径转移约束增强；结合机器学习和典型的规避特征分析，实现JavaScript恶意代码检测防规避增强技术，从而从可信防护到动态隔离再到典型攻击防护增强，形成相对完善的数据泄漏防护体系。.课题组按照研究计划推进研究工作，完成了课题拟定目标，在云存储可信管理框架、基于用户策略的数据保护、控制流完整性保护、数据包受控分发共享等方面取得了多个关键技术突破，部分成果在国防科技大学教学网以及面向麒麟操作系统的软件包在线分发升级系统中进行了实际应用。课题组共在国内外学术期刊、学术会议上发表学术论文16篇，其中SCI检索2篇、EI检索10篇。培养博士研究生2人，硕士研究生4人。