| The proliferation of sensitive data on secondary storage devices has led to a significant increase in incidents of compromising or misusing such data, whether unintentionally or deliberately. Secure file systems have been designed and deployed to partly address this problem. Unfortunately, such file systems have not been generally deployed due to the lack of performance, functionality, and ease of use. We introduce the design and implementation of ext4fsec, a secure file system within the Linux ext4fs framework, to support a wide variety of security needs, including the securing of filesystem metadata and file contents at the level of individual files. We differ from existing approaches in the separation of metadata and contents on independent storage devices, for improving the overall security of our design and for overall performance gains that help in masking out the overhead of our security mechanisms. Our experimental results show that ext4fsec with a full complement of security features matches that of the standard ext4fs file system without encryption and it also betters the performance realized with driver level encryption in ext4fs. |
