Design choices for productive, secure, data-intensive research at scale in the cloud
Diego Arenas, Jon Atkins, Claire Austin, David Beavan, Alvaro Cabrejas Egea, Steven Carlysle-Davies, Ian Carter, Rob Clarke, James Cunningham, Tom Doel, Oliver … 展开作者
Diego Arenas, Jon Atkins, Claire Austin, David Beavan, Alvaro Cabrejas Egea, Steven Carlysle-Davies, Ian Carter, Rob Clarke, James Cunningham, Tom Doel, Oliver Forrest, Evelina Gabasova, James Geddes, James Hetherington, Radka Jersakova, Franz Kiraly, Catherine Lawrence, Jules Manser, Martin T. O'Reilly, James Robinson, Helen Sherwood-Taylor, Serena Tierney, Catalina A. Vallejos, Sebastian Vollmer, Kirstie Whitaker
We present a policy and process framework for secure environments for productive data science research projects at scale, by combining prevailing data security threat and risk profiles into five sensitivity tiers, and, at each tier, specifying recommended policies for data classification, data ingress, software ingress, data egress, user access, user device control, and analysis environments. By presenting design patterns for security choices for each tier, and using software defined infrastructure so that a different, independent, secure research environment can be instantiated for each project appropriate to its classification, we hope to maximise researcher productivity and minimise risk, allowing research organisations to operate with confidence.
Increasing incidents of security compromises and privacy leakage have raised serious privacy concerns related to cyberspace. Such privacy concerns have been instrumental in the creation of several regulations and acts to restrict the availability and use of privacy-sensitive data. The secure computation problem, initially and formally introduced as secure two-party computation by Andrew Yao in 1986, has been the focus of intense research in academia because of its fundamental role in building many of the existing privacy-preserving approaches. Most of the existing secure computation solutions …
The emerging ad hoc clouds form a new cloud computing paradigm by leveraging untapped local computation and storage resources. An important application application over ad hoc clouds is outsourcing computationally intensive problems to nearby cloud agents to solve in a distributed manner.
In Wireless sensor networks (WSNs), All communications between different nodes are sent out in a broadcast fashion. These networks are used in a variety of applications including military, environmental, and smart spaces. Sensors are susceptible to various types of attack, such as data modification, data insertion and deletion, or even physical capture and sensor replacement. Hence security becomes important issue in WSNs. However given the fact that sensors are resources constrained, hence the traditional intensive security algorithms are not well suited for WSNs. This makes traditional secur…
University Hospital Tübingen（图宾根大学医院）；University of Tübingen（图宾根大学）
The need for data privacy and security -- enforced through increasingly strict data protection regulations -- renders the use of healthcare data for machine learning difficult. In particular, the transfer of data between different hospitals is often not permissible and thus cross-site pooling of data not an option. The Personal Health Train (PHT) paradigm proposed within the GO-FAIR initiative implements an 'algorithm to the data' paradigm that ensures that distributed data can be accessed for analysis without transferring any sensitive data. We present PHT-meDIC, a productively deployed open-…
There is an urgent demand for privacy-preserving techniques capable of supporting compute and data intensive (CDI) computing in the era of big data. However, none of existing TEEs can truly support CDI computing tasks, as CDI requires high throughput accelerators like GPU and TPU but TEEs do not offer security protection of such accelerators. This paper present HETEE (Heterogeneous TEE), the first design of TEE capable of strongly protecting heterogeneous computing with unsecure accelerators. HETEE is uniquely constructed to work with today's servers, and does not require any changes for exist…
Disk encryption is frequently used to secure confidential data on mobile devices. However, the high energy cost of disk encryption poses a heavy burden on those devices with limited battery capacity especially when a large amount of data needs to be protected by disk encryption. To address the challenge, we develop a new kernel-level disk encryption software, Populus. Almost 98% of Populus's encryption/decryption computation is not related with the input plaintext/ciphertext, so we accomplish the computation in advance during initialization when a consistent power supply is available. We condu…
Unnoticed by most people, Industrial Control Systems (ICSs) control entire productions and critical infrastructures such as water distribution, smart grid and automotive manufacturing. Due to the ongoing digitalization, these systems are becoming more and more connected in order to enable remote control and monitoring. However, this shift bears significant risks, namely a larger attack surface, which can be exploited by attackers. In order to make these systems more secure, it takes research, which is, however, difficult to conduct on productive systems, since these often have to operate twent…
As we are moving towards the Internet of Things (IoT) era, the number of connected physical devices is increasing at a rapid pace. Mobile edge computing is emerging to handle the sheer volume of produced data and reach the latency demand of computation-intensive IoT applications. Although the advance of mobile edge computing on service latency is studied solidly, security and efficiency on data usage in mobile edge computing have not been clearly identified. In this article, we examine the architecture of mobile edge computing and explore the potentials of utilizing mobile edge computing to en…
Quantum key distribution (QKD) has been researched for almost four decades and is currently making its way to commercial applications. However, deployment of the technology at scale is challenging, because of the very particular nature of QKD and its physical limitations. Among others, QKD is computationally intensive in the post-processing phase and devices are therefore complex and power hungry, which leads to problems in certain application scenarios. In this work we study the possibility to offload computationally intensive parts in the QKD post-processing stack in a secure way to untruste…
People and machines are collecting data at an unprecedented rate. Despite this newfound abundance of data, progress has been slow in sharing it for open science, business, and other data-intensive endeavors. Many such efforts are stymied by privacy concerns and regulatory compliance issues. For example, many hospitals are interested in pooling their medical records for research, but none may disclose arbitrary patient records to researchers or other healthcare providers. In this context we propose the Private Data Network (PDN), a federated database for querying over the collective data of mut…
Texas Tech University（德克萨斯理工大学）；University of Jeddah（吉达大学）；Prince Sattam Bin Abdulaziz University（萨塔姆·本·阿卜杜勒阿齐兹亲王大学）
Physical Unclonable Functions (PUFs) are promising security primitives for resource-constrained network nodes. The XOR Arbiter PUF (XOR PUF or XPUF) is an intensively studied PUF invented to improve the security of the Arbiter PUF, probably the most lightweight delay-based PUF. Recently, highly powerful machine learning attack methods were discovered and were able to easily break large-sized XPUFs, which were highly secure against earlier machine learning attack methods. Component-differentially-challenged XPUFs (CDC-XPUFs) are XPUFs with different component PUFs receiving different challenges…
A Method for Securely Transmitting Large Video Files Using Chaotic Compression and Encryption
School of Computer Science, UPES（计算机科学学院，UPES）；Department of Electrical Engineering, Jadavpur University（电气工程系，贾达普尔大学）；School of Computer Science and Engineering, Manipal University Jaipur (MUJ)（计算机科学与工程学，曼尼帕尔大学斋浦尔分校）；Department of Computer Science, Indian Institute of Information Technology Lucknow (IIITL)（计算机系，印度信息技术学院勒克瑙分校）
ETH Zurich（苏黎世联邦理工学院）；Graz University of Technology（格拉茨技术大学）；University of Bologna（博洛尼亚大学）；Know-Center（知识中心）
Near-sensor data analytics is a promising direction for IoT endpoints, as it minimizes energy spent on communication and reduces network load - but it also poses security concerns, as valuable data is stored or sent over the network at various stages of the analytics pipeline. Using encryption to protect sensitive data at the boundary of the on-chip analytics engine is a way to address data security issues. To cope with the combined workload of analytics and encryption in a tight power envelope, we propose Fulmine, a System-on-Chip based on a tightly-coupled multi-core cluster augmented with s…
Blockchain is a linearly linked, distributed, and very robust data structure. Originally proposed as part of the Bitcoin distributed stack, it found a number of applications in a number of fields, most notably in smart contracts, social media, secure IoT, and cryptocurrency mining. It ensures data integrity by distributing strongly encrypted data in widely redundant segments. Each new insertion requires verification and approval by the majority of the users of the blockchain. Both encryption and verification are computationally intensive tasks which cannot be solved with ordinary off-the-shelf…
Proof of Useful Intelligence (PoUI): Blockchain Consensus Beyond Energy Waste
School of Science and Technology（科学与技术学院）；Kwansei Gakuin University（片山大学）；School of Engineering & Computer Science（工程与计算机科学学院）；Victoria University of Wellington（威灵顿维多利亚大学）
Information from surveillance video is essential for situational awareness (SAW). Nowadays, a prohibitively large amount of surveillance data is being generated continuously by ubiquitously distributed video sensors. It is very challenging to immediately identify the objects of interest or zoom in suspicious actions from thousands of video frames. Making the big data indexable is critical to tackle this problem. It is ideal to generate pattern indexes in a real-time, on-site manner on the video streaming instead of depending on the batch processing at the cloud centers. The modern edge-fog-clo…
Digital Agriculture Sandbox for Collaborative Research
Dept. of Computer and Data Sciences（计算机与数据科学系）；Case Western Reserve University（凯斯西储大学）；School of Computer Science（计算机科学学院）；Georgia Institute of Technology（佐治亚理工学院）；Dept. of Planning and Landscape Architecture（规划与景观建筑系）；University of Wisconsin–Madison（威斯康星大学麦迪逊分校）
