Let the Cloud Watch Over Your IoT File Systems
This addresses security vulnerabilities in IoT device storage, though it is incremental as it builds on existing trusted execution environment technology.
The paper tackles the weak security of on-device storage in smart devices by proposing a novel storage stack architecture that protects file data in a trusted execution environment, outsources file system logic, and uses a cloud replica for verification, showing moderate security overheads in real-world applications.
Smart devices produce security-sensitive data and keep them in on-device storage for persistence. The current storage stack on smart devices, however, offers weak security guarantees: not only because the stack depends on a vulnerable commodity OS, but also because smart device deployment is known weak on security measures. To safeguard such data on smart devices, we present a novel storage stack architecture that i) protects file data in a trusted execution environment (TEE); ii) outsources file system logic and metadata out of TEE; iii) running a metadata-only file system replica in the cloud for continuously verifying the on-device file system behaviors. To realize the architecture, we build Overwatch, aTrustZone-based storage stack. Overwatch addresses unique challenges including discerning metadata at fine grains, hiding network delays, and coping with cloud disconnection. On a suite of three real-world applications, Overwatch shows moderate security overheads.