Guardat: enforcing data policies at the storage layer

Authors: Anjo Vahldiek-Oberwagner, Eslam Elnikety, Aastha Mehta, Deepak Garg, Peter Druschel, Rodrigo Rodrigues, Johannes Gehrke, Ansley Post - European Conference on Computer Systems, EuroSys 2015 cited by 27

In today’s data processing systems, both the policies pro-tecting stored data and the mechanisms for their enforce-ment are spread over many software components and con-figuration files, increasing the risk of policy violation due to bugs, vulnerabilities and misconfigurations. Guardat ad-dresses this problem. Users, developers and administrators specify file protection policies declaratively, concisely and separate from code, and Guardat enforces these policies by mediating I/O in the storage layer. Policy enforcement relies only on the integrity of the Guardat controller and any exter-nal policy dependencies. The semantic gap between the stor-age layer enforcement and per-file policies is bridged using cryptographic attestations from Guardat. We present the de-sign and prototype implementation of Guardat, enforce ex-ample policies in aWeb server, and show experimentally that its overhead is low. 1.