Selective versioning in a secure disk system

  • Authors:
  • Swaminathan Sundararaman;Gopalan Sivathanu;Erez Zadok

  • Affiliations:
  • Stony Brook University;Stony Brook University;Stony Brook University

  • Venue:
  • SS'08 Proceedings of the 17th conference on Security symposium
  • Year:
  • 2008

Quantified Score

Hi-index 0.00

Visualization

Abstract

Making vital disk data recoverable even in the event of OS compromises has become a necessity, in view of the increased prevalence of OS vulnerability exploits over the recent years. We present the design and implementation of a secure disk system, SVSDS, that performs selective, flexible, and transparent versioning of stored data, at the disk-level. In addition to versioning, SVSDS actively enforces constraints to protect executables and system log files. Most existing versioning solutions that operate at the disk-level are unaware of the higher-level abstractions of data, and hence are not customizable. We evolve a hybrid solution that combines the advantages of disk-level and file-system--level versioning systems thereby ensuring security, while at the same time allowing flexible policies. We implemented and evaluated a software-level prototype of SVSDS in the Linux kernel and it shows that the space and performance overheads associated with selective versioning at the disk level are minimal.