Implementing Efficient Management and Security of Removable Storage by FVM

Abstract:

The security usage and management of removable storage devices has become a vital problem for enterprises and individuals. However, the required strict security policies for preventing unauthorized access to sensitive data raise the decrease of usability and flexibility. The main problem rests on the binding between security and application domains which stifles the initiative of the devices on themselves. This paper presents TRS, an efficient active architecture that binds a feather-weight virtual machine (FVM) to the removable storage device. It is designed based on an inside-bound smart card as well as the chip operation system (COS) which builds a trust channel between the FVM and the device. The FVM is set up by a trust chain and provides isolated usage environment for process accessing the device which prevents the obtained data from leakage. Finally, we implement a USB flash disk we call as UTrustDisk based on the hardware structure of Amordisk which is a security product of Nationz Technologies Inc. The results show the average overhead of read and write is 7.5% and 11.5%.

• Periodical: Applied Mechanics and Materials (Volume 197)
• Pages: 467-472
• DOI: https://doi.org/10.4028/www.scientific.net/AMM.197.467
• Online since: September 2012
• Authors: Jun Ma, Jiang Chun Ren, Zhi Ying Wang, Jiang Jiang Wu, Yong Cheng, Song Zhu Mei
• Keywords: Chip Operation System (COS), Data Leakage Prevention (DLP), Feather-Weight Virtual Machine (FVM), Removable Storage Device(RSD), Security, Trust Chain, Virtualisation

References

[1] DLP(a Whitehat Community). Data Leakage Prevention. [2010-10-14] http: /www. dataleakageprevention. co. za.

[2] TRUECRYPT. TrueCrypt Volume[EB/OL]. [2010-10-14]. http: /www. truecrypt. org/docs.

[3] APPLE. FileVault[EB/OL]. [2010-10-14] www. apple. com/macosx/security.

[4] McAfee. Data Loss Prevention[EB/OL]. [2010-10-14] www. mcafee. -com/us/enterprise/products/data_protection/data_loss_prevention/index. html.

[5] VERDASYS. Mobile Data Protection & Remote Media Encryption [EB/OL]. [2010-10-14] www. verdasys. com/Mobile_Data_Protection_Encryption. php.

[6] Michael Fabian. Endpoint Security: Managing USB-based Removable Devices with the Advent of Portable Applications[C]. In InfoSecCD'07: Proceedings Security Curriculum Development, ACM, pp.1-5, (2007).

DOI: 10.1145/1409908.1409935

[7] Burdonov I., Kosachev A., and Iakovenko, Virtualization-based separation of privilege: working with sensitive data in untrusted environment[A]. In Proceedings of the 1st Eurosys Workshop on Virtualization Technology For Dependable Systems(VTDS'09) , Nuremberg, Germany, March 2009, pp.1-6.

DOI: 10.1145/1518684.1518685

[8] J. L. Griffin, T. Jaeger, R. Perez, et al. Trusted Virtual Domains: Toward Secure Distributed Services[A]. 1st IEEE Workshop on Hot Topics in System Dependability, June (2005).

[9] Catuogno L., Löhr H., Manulis M., etc. al. Transparent Mobile Storage Protection in Trusted Virtual Domains[A]. In 23rd Large Installation System Administration Conference (LISA'09), USENIX Association (2009).

[10] Yang Yu, OS-level Virtualization and Its Applications[D], New York: Stony Brook University, (2007).

[11] Nationz Technologies Inc. Amordisk[EB/OL]. [2010-10-14] http: /www. nationz. com. cn/en/Solutions2. aspx?id=38.

[12] Atallah MJ, Bryant ED, Korb JT, and Rice JR. Binding software to specific native hardware in a VM environment: the PUF challenge and opportunity. In Proceedings of the 1st ACM Workshop on Virtual Machine Security (VMSec '08). Alexandria, Virginia, USA, October, 2008: 45-48.

DOI: 10.1145/1456482.1456490

[13] SanDisk. U3 Information[EB/OL]. [2010-10-14] http: /u3. sandisk. com.

[14] MyDigit. USB disk performance test instrument[EB/OL]. [2010-10-5] http: /www. mydigit. cn/mydisktest. htm. (in Chinese).