MlsDisk: Trusted Block Storage for TEEs Based on Layered Secure Logging
summary
MlsDisk implements a layered, log-structured virtual block disk that claims CIFC (confidentiality, integrity, freshness, consistency) for TEEs by decomposing storage into four log-based layers (block IO, KV store, transactional log store, secure journal). It replaces SGX-PFS’s Merkle tree with append-only logs and transactional log operations, ships a Rust cross-platform implementation, and is open source. Evaluation reports 7.3×–21.1× speedups on microbenchmarks and 1.4×–3.6× on trace workloads versus SGX-PFS, and uses transactional log files and decoupled metadata to enable GC and indexing securely.
AI-written summary · about
chapters (9)
- 0:00MlsDisk and TEEs intro
- 1:00TEE security gaps
- 2:05Secure virtual disk limits
- 3:09Secure block storage bottlenecks
- 4:12Logging benefits for security
- 5:17MlsDisk architecture
- 7:08MlsDisk layer breakdown
- 10:24Evaluation results
- 11:48Conclusion and future work
related talks
17mAtomicDisk: A Secure Virtual Disk for TEEs against Eviction Attacks
18mOn Scalable Integrity Checking for Secure Cloud Disks
21mSPEICHER: Securing LSM-based Key-Value Stores using Shielded Execution
14mNimble: Rollback Protection for Confidential Cloud Services
15mTimelock Drive: Isolated Time-Based Defense for Storage Systems
30mTrust No One: Secure Storage With Confidential Containers
13mA Log-Structured Merge Tree-aware Message Authentication Scheme for Persistent...
25mExploring I/O Support for Virtualization-Based Trusted Execution Environment