TEE-aided Write Protection Against Privileged Data Tampering

Abstract

Unauthorized data alteration has been a longstanding threat since the emergence of malware. System and application software can be reinstalled and hardware can be replaced, but user data is priceless in many cases. Especially in recent years, ransomware has become high-impact due to its direct monetization model. State-of-the-art defenses are mostly based on known signature or behavior analysis, and more importantly, require an uncompromised OS kernel. However, malware with the highest software privileges has shown its obvious existence.We propose to move from current detection/recovery based mechanisms to data loss prevention, where the focus is on armoring data instead of counteracting malware. Our solution, Inuksuk, relies on today's Trusted Execution Environments (TEEs), as available both on the CPU and storage device, to achieve programmable write protection. We back up a copy of user-selected files as write-protected at all times, and subsequent updates are written as new versions securely through TEE. We implement Inuksuk on Windows 7 and 10, and Linux (Ubuntu); our core design is OS and application agnostic, and incurs no run-time performance penalty for applications. File transfer disruption can be eliminated or alleviated through access modes and customizable update policies (e.g., interval, granularity). For Inuksuk's adoptability in modern OSes, we have also ported Flicker (EuroSys 2008), a defacto standard tool for in-OS privileged TEE management, to the latest 64-bit Windows.

A Policy-based Versioning SSD with Intel SGX

“…Project Almanac [13] versions all files at the disk level to protect data from privileged malware. Inuksuk [36] uses Intel TXT and self-encryption disk (SED) to protect data by copying it to a protected partition. Inuksuk, like SGX-SSD, can selectively protect files in the disk.…”

DISKSHIELD: A Data Tamper-Resistant Storage for Intel SGX

“…IPFS may detect the data tampered when reading it, but cannot prevent it. Figure 2(b) shows the fresh data attack surface in Inuksuk [30]. Secure Encryption Disk (SED) in Inuksuk is composed of normal partition and secure partition.…”

“…In order to prevent such ransomware and wiper attacks, various studies such as IPFS [9], Pesos Object Store [16], and Inuksuk [30] have been conducted [9,16,30]. These systems make a process space a Trusted Execution Environment (TEE) [27] to defend against the aforementioned data tampering attacks.…”

“…Unlike IPFS, Pesos [16] and Inuksuk [30] use a host's side TEE and a storage device together to protect data. They use a storage device to perform the authentication procedure internally for writing files.…”

“…Inuksuk [30], on the other hand, creates a secure zone on disk and allows users to selectively store files in that secure area. In Inuksuk, the disk can be partitioned into two regions -non-secure and secure zones.…”