History Independent File System on an Insecure Flash Device

Abstract

Protecting file system data from adversaries powerful enough to obtain forensic access to a machine is a different challenge in secure system design. Recent work in the secure deletion of files has shown efficient ways to ensure that le contents are unrecoverable, but these methods leave potentially sensitive information in the filesystem metadata and disk structure. To address this, we extend the functionality of secure deletion to achieve the stronger standard of history independence, where an adversary cannot distinguish between the possible histories that led to the filesystem's current state. This work presents a filesystem design that preserves history independence on top of an insecure disk, such as a Solid-State Drive, without assuming the presence of any directly overwriteable memory, and additionally achieves history independent fault tolerance for the file system, which was an open problem in previous work.