基于策略的版本控制SSD与英特尔SGX
A Policy-based Versioning SSD with Intel SGX
摘要：
恶意软件破坏基于软件的版本控制系统并破坏数据。为了应对这种威胁，已经研究了在SSD内部执行版本控制的版本控制固态驱动器（SSD）。SSD是数据版本控制的合适候选者，因为它可以保留以前的版本而无需额外的复制，并以非常小的可信计算基础（TCB）提供高安全性。然而，到目前为止研究的版本控制SSD通常使用完整的磁盘版本控制方法，该方法将所有文件版本保存在一个批次中。本文证明，SSD，提供完整的磁盘版本，可以暴露于数据篡改攻击时，数据的保留时间小于恶意软件的停留时间。为了应对这种威胁，我们提出了SGX-SSD，一个基于策略的每个文件版本控制SSD，只为用户的重要文件保留更深的历史。然而，由于SSD不知道文件语义，并且应该从不受信任的主机计算机安全地接收版本化策略信息，因此在SSD中实现每个文件的版本化是一个巨大的挑战。为解决此问题，SGX-SSD利用英特尔SGX并具有安全主机接口，可安全地从用户接收策略信息（配置值）。同时，为了解决SSD的文件语义不感知问题，设计了一个piggyback模块在主机层给出文件提示，并在SSD中实现了基于策略的选择性版本控制算法。为了验证我们的系统，我们原型SGX-SSD的Jasmine OpenSSD平台在Linux环境下。在实验评估中，我们证明了SGX-SSD提供了强大的安全性，而选择性的每个文件版本控制的额外开销很少。
英文摘要：
Privileged malware neutralizes software-based versioning systems and destroys data. To counter this threat, a versioning solid-state drive (SSD) that performs versioning inside the SSD has been studied. An SSD is a suitable candidate for data versioning because it can preserve previous versions without additional copying, and provide high security with a very small trusted computing base (TCB). However, the versioning SSDs studied so far commonly use a full disk versioning method that preserves all file versions in a batch. This paper demonstrates that SSDs, which provide full disk versioning, can be exposed to data tampering attacks when the retention time of data is less than the malware's dwell time. To deal with this threat, we propose SGX-SSD, a policy-based per-file versioning SSD to keep a deeper history for only the important files of users. However, since the SSD isn't aware of a file semantic, and the versioning policy information should be securely received from the untrusted host computer, implementing the per-file versioning in SSD is a huge challenge. To solve this problem, SGX-SSD utilizes the Intel SGX and has a secure host interface to securely receive policy information (configuration values) from the user. Also, to solve the file semantic unawareness problem of the SSD, a piggyback module is designed to give a file hint at the host layer, and an algorithm for selective versioning based on the policy is implemented in the SSD. To prove our system, we prototyped SGX-SSD the Jasmine OpenSSD platform in Linux environment. In the experimental evaluation, we proved that SGX-SSD provides strong security with little additional overhead for selective per-file versioning.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
