SealFS: Storage-based tamper-evident logging

Soriano-Salvador, Enrique; Guardiola-Múzquiz, Gorka

doi:10.1016/j.cose.2021.102325

Cited by 10 publications

(16 citation statements)

References 34 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The contributions of this paper are: 1 For further details and discussion, see Sect. 4.4 of the original SealFS paper [7].…”

Section: Contributionsmentioning

confidence: 99%

“…There is a vast body of related work. We described the main differences of SealFSv1 and closed related work elsewhere [7]. This is a succint description of the different solutions presented in the literature for logging integrity:…”

Section: Related Workmentioning

confidence: 99%

“…In contrast, we designed and implemented a system that follows an opposite approach [7]. SealFS (from now on, SealFSv1) is a Linux kernel module that implements a stackable file system that enables tamper-evident logging.…”

Section: Introductionmentioning

confidence: 99%

“…The former may waste a lot of storage space and be I/O bound. The latter causes linearly degrading security [1,7] and may be CPU bound.…”

Section: Introductionmentioning

confidence: 99%

“…In our previous work, we provided a quantitative performance analysis of SealFSv1 [7], but we were not able to compare it with ratchets in a controlled way. The SealFSv1 implementation (a Linux kernel module that implements a file system) and the different ratchet implementations were too different for conducting fair comparative experiments in order to answer the previous question.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

SealFSv2: combining storage-based and ratcheting for tamper-evident logging

Guardiola-Múzquiz

Soriano-Salvador

2022

Int. J. Inf. Secur.

Self Cite

View full text Add to dashboard Cite

Tamper-evident logging is paramount for forensic audits and accountability subsystems. It is based on a forward integrity model: upon intrusion, the attacker is not able to counterfeit the logging data generated before controlling the system. There are local and distributed solutions to this problem. Distributed solutions are suitable for common scenarios, albeit not appropriate for autonomous and loosely connected systems. Moreover, they can be complex and introduce new security issues. Traditional local tamper-evident logging systems use cryptographic ratchets. In previous works, we presented SealFS (from now on, SealFSv1), a system that follows a radically different approach for local tamper-evident logging based on keystream storage. In this paper, we present a new version, SealFSv2, which combines ratcheting and storage-based log anti-tamper protection. This new approach is flexible and enables the user to decide between complete theoretical security (like in SealFSv1) and partial linear degradation (like in a classical ratchet scheme), exchanging storage for computation with user-defined parameters to balance security and resource usage. We also describe an implementation of this scheme. This implementation, which showcases our approach, is an optimized evolution of the original Linux kernel module. It implements a stackable file system that enables transparent tamper-evident logging to all user space applications and provides instant deployability. Last, we present a complete performance evaluation of our current implementation and a fair performance comparison of the two opposite approaches for local tamper-evident logging (i.e., storage-based vs. ratcheting). This comparison suggests that, on current systems and general-purpose hardware, the storage-based approach and hybrid schemes perform better than the traditional ratchet approach.

show abstract

“…The contributions of this paper are: 1 For further details and discussion, see Sect. 4.4 of the original SealFS paper [7].…”

Section: Contributionsmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

“…The former may waste a lot of storage space and be I/O bound. The latter causes linearly degrading security [1,7] and may be CPU bound.…”

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

SealFSv2: combining storage-based and ratcheting for tamper-evident logging

Guardiola-Múzquiz

Soriano-Salvador

2022

Int. J. Inf. Secur.

Self Cite

View full text Add to dashboard Cite

show abstract

D-Cloud-Collector: Admissible Forensic Evidence from Mobile Cloud Storage

Vella

Colombo

2022

ICT Systems Security and Privacy Protection

View full text Add to dashboard Cite

Difficulties with accessing device content or even the device itself can seriously hamper smartphone forensics. Mobile cloud storage, which extends on-device capacity, provides an avenue for a forensic collection process that does not require physical access to the device. Rather, it is possible to remotely retrieve credentials from a device of interest through undercover operations, followed by live cloud forensics. While technologically appealing, this approach raises concerns with evidence preservation, ranging from the use of malware-like operations, to linking the collected evidence with the physically absent smartphone, and possible mass surveillance accusations. In this paper, we propose a solution to ease these concerns by employing hardware security modules to provide for controlled live cloud forensics and tamper-evident access logs. A Google Drive-based proof of concept, using the SEcube hardware security module, demonstrates that D-Cloud-Collector is feasible whenever the performance penalty incurred is affordable.

show abstract

VaultBox: Enhancing the Security and Effectiveness of Security Analytics

Trivedi,

Triandopoulos

2023

Lecture Notes in Computer Science

View full text Add to dashboard Cite

SealFS: Storage-based tamper-evident logging

Cited by 10 publications

References 34 publications

SealFSv2: combining storage-based and ratcheting for tamper-evident logging

SealFSv2: combining storage-based and ratcheting for tamper-evident logging

D-Cloud-Collector: Admissible Forensic Evidence from Mobile Cloud Storage

VaultBox: Enhancing the Security and Effectiveness of Security Analytics

Contact Info

Product

Resources

About