SGX-FS: Hardening a File System in User-Space with Intel SGX

Burihabwa, Dorian; Felber, Pascal; Mercier, Hugues; Schiavoni, Valerio

doi:10.1109/cloudcom2018.2018.00027

Cited by 14 publications

(7 citation statements)

References 12 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Esteves et al [25] also presented a stackable file system framework that uses the isolated execution provided by Intel SGX to extend the SafeFS architecture, a FUSE-based framework that enables the construction of secure distributed file systems. Data sealing is also combined with FUSE to protect in-memory and persistent storage [11].…”

Section: File and Disk Encryption With Intel Sgxmentioning

confidence: 99%

Trusted Client-Side Encryption for Cloud Storage

Rocha

Valadares

Perkusich

et al. 2021

Communications in Computer and Information Science

View full text Add to dashboard Cite

Nowadays, users are delegating the data storage to cloud services, due to the virtually unlimited storage, change history, broadband connection, and high availability. Despite the benefits and facilities, it is necessary to pay extra attention to data confidentiality and users' privacy, as numerous threats aim to collect such information in an unauthorized manner. An approach to ensure data confidentiality is the use of client-side encryption, with the user taking control of the encryption keys and defining which files or data will be encrypted. This scheme is already explored by many applications on personal computers and also as a native feature in some smartphone operating systems, but are still susceptible to certain types of attacks. Aiming to improve the security of the client-side encryption approach, we propose to apply the Intel Software Guard Extensions (SGX) to perform data sealing, creating a secure vault that can be synchronized with any cloud storage service, while relying on the SGX to protect the key handling. To validate our proposal, we build a proof of concept based on the Cryptomator application, an open-source client-side encryption tool specially designed for cloud storage services. Our results show an overall performance better than the original Cryptomator application, with stronger security premises. Thus, our solution proved to be feasible and can be expanded and refined for practical use and integration with cloud synchronization services.

show abstract

Section: File and Disk Encryption With Intel Sgxmentioning

confidence: 99%

Trusted Client-Side Encryption for Cloud Storage

Rocha

Valadares

Perkusich

et al. 2021

Communications in Computer and Information Science

View full text Add to dashboard Cite

show abstract

“…In [22], the authors propose an SGX-enabled framework that system developers can use to implement FUSE-based file systems that are deployed entirely in a single enclave. Briefly, this work proposes a new module that intercepts FUSE library calls and redirects these to run in an SGX enclave.…”

Section: Related Workmentioning

confidence: 99%

TrustFS: An SGX-Enabled Stackable File System Framework

Esteves

Macedo

Faria

et al. 2019

2019 38th International Symposium on Reliable Distributed Systems Workshops (SRDSW)

View full text Add to dashboard Cite

Data confidentiality in cloud services is commonly ensured by encrypting information before uploading it. However, this approach limits the use of content-aware functionalities, such as deduplication and compression. Although this issue has been addressed individually for some of these functionalities, no unified framework for building secure storage systems exists that can leverage such operations over encrypted data.We present TRUSTFS, a programmable and modular stackable file system framework for implementing secure content-aware storage functionalities over hardware-assisted trusted execution environments. This framework extends the original SAFEFS architecture to provide the isolated execution guarantees of Intel SGX. We demonstrate its usability by implementing an SGXenabled stackable file system prototype while a preliminary evaluation shows that it incurs reasonable performance overhead when compared to conventional storage systems. Finally, we highlight open research challenges that must be further pursued in order for TRUSTFS to be fully adequate for building production-ready secure storage solutions.

show abstract

“…Finally, we look at how storage overhead can be tamed beyond with better compression gains than classic data reduction techniques without sacrificing on performance. [32,34,31] Chapter 4 First and fully functional implementation of STeP [17,141] Chapter 5 Implementation and evaluation of a framework for stackable user-space file systems [207,33] Chapter 6 Integration and evalution of a data deduplication scheme in user-space file system [183] 1.…”

Section: Taming Storage Overhead With Practical and Efficient Data Rementioning

confidence: 99%

“…• Sgx-Fs [33] a user-space in-memory file system offering insights into the trade-offs of delegating the encryption work to a specific Trusted Execution Environment: Intel SGX [120]. This work was supervised by Pascal Felber and Valerio Schiavoni with the collaboration Hugues Mercier.…”

Section: Contributionsmentioning

confidence: 99%

“…The sealing mechanism enables developers to encrypt data using a key derived from keys in the processor's fuse array that are unique to the enclave or signer of the enclave and cannot be accessed by the OS. In order to measure the cost of running this kind of computation inside an enclave, we built Sgx-Fs [33].…”

Section: Data Processing In Trusted Execution Environmentsmentioning

confidence: 99%

See 1 more Smart Citation

Erasure coding for distributed storage systems

Burihabwa¹

Self Cite

View full text Add to dashboard Cite

Cloud storage has durably entered the stage as go-to solution for business and personal storage. Virtually extending storage capabilities to infinity, cloud storage enables companies and individuals to focus on content creation without fear of running out of space or losing data. But as users entrust more and more data to the cloud, they also have to accept a loss of control over the data they o˜oad to the cloud. At a time when online services seem to be making a significant part of their profits by exploiting customer data, concerns over privacy and integrity of said data naturally arise. Are their online documents read by the storage provider or its employees? Is the content of these documents shared with third party partners of the storage provider? What happens if the provider goes bankrupt? Whatever answer can be o˙ered by the storage provider, the loss of control should be cause for concern. But storage providers also have to worry about trust and reliability. As they build distributed solutions to accommodate their customers’ needs, these concerns of control extend to the infrastructure they operate on. Conciliating security, confidentiality, resilience and perform-ance over large sets of distributed storage nodes is a tricky balancing act. And even when a suitable balance can be found, it is often done at the expense of increased storage overhead. In this dissertation, we try to mitigate these issues by focusing on three aspects. First, we study solutions to empower users with flexible tooling ensuring security, integrity and redundancy in distributed storage settings. By leveraging public cloud storage o˙erings to build a configurable file system and storage middleware, we show that securing cloud-storage from the client-side is an e˙ective way maintaining control. Second, we build a distributed archive whose resilience goes beyond standard redundancy schemes. To achieve this, we implement Recast, relying on a data entanglement scheme, that encodes and distributes data over a set of storage nodes to ensure durability at a manageable cost. Finally, we look into o˙setting the increase in storage overhead by means of data reduction. This is made possible by the use of Generalised Deduplication, a scheme that improves over classical data deduplication by detecting similarities beyond exact matches.

show abstract

SGX-FS: Hardening a File System in User-Space with Intel SGX

Cited by 14 publications

References 12 publications

Trusted Client-Side Encryption for Cloud Storage

Trusted Client-Side Encryption for Cloud Storage

TrustFS: An SGX-Enabled Stackable File System Framework

Erasure coding for distributed storage systems

Contact Info

Product

Resources

About