The Reverse File System: Towards open cost-effective secure WORM storage devices for logging

• URL: http://arxiv.org/abs/2509.17969v1
• Date: Mon, 22 Sep 2025 16:19:08 GMT
• Title: The Reverse File System: Towards open cost-effective secure WORM storage devices for logging
• Abstract summary: Write Once Read Many (WORM) properties for storage devices are desirable to ensure data immutability.<n>We introduce Socarrat, a novel, cost-effective, and local WORM storage solution that leverages a simple external USB device.<n>Socarrat significantly reduces the attack surface and ensures that even privileged attackers cannot modify or erase stored data.
• Score: 0.0
• License: http://creativecommons.org/licenses/by-nc-nd/4.0/
• Abstract: Write Once Read Many (WORM) properties for storage devices are desirable to ensure data immutability for applications such as secure logging, regulatory compliance, archival storage, and other types of backup systems. WORM devices guarantee that data, once written, cannot be altered or deleted. However, implementing secure and compatible WORM storage remains a challenge. Traditional solutions often rely on specialized hardware, which is either costly, closed, or inaccessible to the general public. Distributed approaches, while promising, introduce additional risks such as denial-of-service vulnerabilities and operational complexity. We introduce Socarrat, a novel, cost-effective, and local WORM storage solution that leverages a simple external USB device (specifically, a single-board computer running Linux with USB On-The-Go support). The resulting device can be connected via USB, appearing as an ordinary external disk formatted with an ext4 or exFAT file system, without requiring any specialized software or drivers. By isolating the WORM enforcement mechanism in a dedicated USB hardware module, Socarrat significantly reduces the attack surface and ensures that even privileged attackers cannot modify or erase stored data. In addition to the WORM capacity, the system is designed to be tamper-evident, becoming resilient against advanced attacks. This work describes a novel approach, the Reverse File System, based on inferring the file system operations occurring at higher layers in the host computer where Socarrat is mounted. The paper also describes the current Socarrat prototype, implemented in Go and available as free/libre software. Finally, it provides a complete evaluation of the logging performance on different single-board computers.

Related papers

• Securing Filesystems for Confidential Computing [4.044530583186265]
  Confidential computing protects applications inside Trusted Execution Environments (TEEs)<n>Even with disk encryption, a malicious cloud provider can roll back, replay, fork, or tamper with disk state.<n>We present ShieldFS, a POSIX-compliant that provides end-to-end integrity and freshness for persistent storage in the confidential-computing threat model.
  arXiv  Detail & Related papers  (2026-08-20T11:41:15Z)
• Auditable and Transparent Fully Authenticated Disk Encryption via USB Storage Interposition [0.0]
  Full Disk Encryption (FDE) has become increasingly important in the last decades due to the evident confidentiality concerns.<n>In most systems, encryption is provided by an operating system driver, through which the user can transparently access the encrypted disk.<n>We explore an alternative approach: the use of an intermediate USB device placed between the host system and the external hard disk.
  arXiv  Detail & Related papers  (2026-07-14T12:42:17Z)
• Software-Hardware Binding for Protection of Sensitive Data in Embedded Software [0.0]
  We present a novel protection mechanism that combines hardware fingerprints with Boolean logic.<n>Unlike usual copy-protection approaches, unauthorised copies of the software still run on cloned devices but suboptimally.<n>Our approach does not require additional hardware, relying only on relatively simple updates to the software.
  arXiv  Detail & Related papers  (2026-03-12T09:33:42Z)
• ZipMoE: Efficient On-Device MoE Serving via Lossless Compression and Cache-Affinity Scheduling [56.88966608455977]
  ZipMoE exploits the synergy between the hardware properties of edge devices and the statistical redundancy inherent to MoE parameters.<n>ZipMoE achieves up to $72.77%$ inference latency reduction and up to $6.76times$ higher throughput than the state-of-the-art systems.
  arXiv  Detail & Related papers  (2026-01-29T02:51:59Z)
• Beyond Model Jailbreak: Systematic Dissection of the "Ten DeadlySins" in Embodied Intelligence [36.972586142931256]
  Embodied AI systems integrate language models with real world sensing, mobility, and cloud connected mobile apps.<n>We conduct the first holistic security analysis of the Unitree Go2 platform.<n>We uncover ten cross layer vulnerabilities the "Ten Sins of Embodied AI Security"
  arXiv  Detail & Related papers  (2025-12-06T10:38:00Z)
• From See to Shield: ML-Assisted Fine-Grained Access Control for Visual Data [40.12543056558646]
  This work presents a system architecture for trusted data sharing with policy-driven access control.<n>The proposed architecture integrates automated detection of sensitive regions, post-correction, key management, and access control.<n>We show that our system provides effective PSO detection, increases macro-averaged F1 score (5%) and mean Average Precision (10%), and maintains an average policy-enforced decryption time of less than 1 second per image.
  arXiv  Detail & Related papers  (2025-10-22T09:41:31Z)
• Optimizing Storage Overhead of User Behavior Log for ML-embedded Mobile Apps [49.40237450598784]
  Machine learning (ML) models are increasingly integrated into modern mobile apps to enable personalized and intelligent services.<n>AdaLog is designed to improve the storage efficiency of user behavior log in ML-embedded mobile apps.<n>AdaLog reduces behavior log size by 19% to 44% with minimal system overhead.
  arXiv  Detail & Related papers  (2025-10-15T11:03:17Z)
• Walrus: An Efficient Decentralized Storage Network [6.053171723478456]
  Walrus is a novel decentralized blob storage system that addresses limitations through multiple technical innovations.<n>RedStuff is a two-dimensional erasure coding protocol that achieves high security with only 4.5x replication factor.<n>Walrus also introduces a novel multi-stage epoch change protocol that efficiently handles storage node churn.
  arXiv  Detail & Related papers  (2025-05-08T16:06:41Z)
• THEMIS: Towards Practical Intellectual Property Protection for Post-Deployment On-Device Deep Learning Models [36.02405283730231]
  On-device deep learning (DL) has rapidly gained adoption in mobile apps, offering the benefits of offline model inference and user privacy preservation over cloud-based approaches.<n>It inevitably stores models on user devices, introducing new vulnerabilities, particularly model-stealing attacks and intellectual property infringement.<n>In this paper, we propose THEMIS, an automatic tool that lifts the read-only restriction of on-device DL models by reconstructing their writable counterparts.
  arXiv  Detail & Related papers  (2025-03-31T05:58:57Z)
• Optimizing SSD Caches for Cloud Block Storage Systems Using Machine Learning Approaches [40.13303683102544]
  This paper proposes a novel approach to dynamically optimize the write policy in cloud-based storage systems.<n>The proposed method identifies write-only data and selectively filters it out in real-time, thereby minimizing the number of unnecessary write operations.
  arXiv  Detail & Related papers  (2024-12-29T17:37:18Z)
• ACRIC: Securing Legacy Communication Networks via Authenticated Cyclic Redundancy Integrity Check [98.34702864029796]
  Recent security incidents in safety-critical industries exposed how the lack of proper message authentication enables attackers to inject malicious commands or alter system behavior.<n>These shortcomings have prompted new regulations that emphasize the pressing need to strengthen cybersecurity.<n>We introduce ACRIC, a message authentication solution to secure legacy industrial communications.
  arXiv  Detail & Related papers  (2024-11-21T18:26:05Z)
• VaultFS: Write-once Software Support at the File System Level Against Ransomware Attacks [6.725792100548271]
  We propose VaultFS, a Linux-suited file system oriented to the maintenance of cold-data. Files are supported via the write-once semantic, and cannot be subject to the rewriting (or deletion) of their content up to the end of their protection life time. VastFS offers the possibility to protect the storage against Denial-of-Service (DOS) attacks.
  arXiv  Detail & Related papers  (2024-10-29T12:06:24Z)
• Preventing Rowhammer Exploits via Low-Cost Domain-Aware Memory Allocation [46.268703252557316]
  Rowhammer is a hardware security vulnerability at the heart of every system with modern DRAM-based memory. C Citadel is a new memory allocator design that prevents Rowhammer-initiated security exploits. C Citadel supports thousands of security domains at a modest 7.4% average memory overhead and no performance loss.
  arXiv  Detail & Related papers  (2024-09-23T18:41:14Z)
• USBIPS Framework: Protecting Hosts from Malicious USB Peripherals [0.46040036610482665]
  Universal Serial Bus (USB)-based attacks have increased in complexity in recent years.<n>This paper focuses on building a security framework called USBIPS within Windows OSs to defend against malicious USB peripherals.
  arXiv  Detail & Related papers  (2024-09-19T15:48:52Z)
• FileDES: A Secure Scalable and Succinct Decentralized Encrypted Storage Network [30.775493810737192]
  Decentralized Storage Network (DSN) is an emerging technology that challenges traditional cloud-based storage systems. We propose FileDES, which incorporates three essential elements: privacy preservation, scalable storage proof, and batch verification. Our protocol outperforms the others in terms of proof generation/verification efficiency, storage costs, and scalability.
  arXiv  Detail & Related papers  (2024-03-22T06:41:30Z)
• A high throughput Intrusion Detection System (IDS) to enhance the security of data transmission among research centers [39.65647745132031]
  This paper presents a packet sniffer that was designed using a commercial FPGA development board. The system can support a data throughput of 10 Gbit/s with preliminary results showing that the speed of data transmission can be reliably extended to 100 Gbit/s. It is particularly suited for the security of universities and research centers, where point-to-point network connections are dominant.
  arXiv  Detail & Related papers  (2023-11-10T14:30:00Z)
• Towards Learned Predictability of Storage Systems [0.0]
  Storage systems have become a fundamental building block of datacenters. Despite the growing popularity and interests in storage, designing and implementing reliable storage systems remains challenging. To move towards predictability of storage systems, various mechanisms and field studies have been proposed in the past few years. Based on three representative research works, we discuss where and how machine learning should be applied in this field.
  arXiv  Detail & Related papers  (2023-07-30T17:53:08Z)
• Plinius: Secure and Persistent Machine Learning Model Training [1.1141254085794403]
  We present PLINIUS, a ML framework using Intel SGX enclaves for secure training of ML models and PM for fault tolerance guarantees.<n>Compared to disk-based checkpointing systems, PLINIUS is 3.2x and 3.7x faster respectively for saving and restoring models on real PM hardware.
  arXiv  Detail & Related papers  (2021-04-07T08:35:59Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.