WORM-SEAL: Trustworthy Data Retention and Verification for Regulatory Compliance

Abstract. As the number and scope of government regulations and rules mandating trustworthy retention of data keep growing, businesses today are facing a higher degree of regulation and accountability than ever. Existing compliance storage solutions focus on providing WORM (Write-Once Read-Many) support and rely on software enforcement of the WORM property, due to performance and cost reasons. Such an approach, however, offers limited protection in the regulatory compliance setting where the threat of insider attacks is high and the data is indexed and dynamically updated (e.g., append-only access logs indexed by the creator). In this paper, we propose a solution that can greatly improve the trustworthiness of a compliance storage system, by reducing the scope of trust in the system to a tamper-resistant Trusted Computing Base (TCB). We show how trustworthy retention and verification of append-only data can be achieved through the TCB. Due to the resource constraints on the TCB, we dev...

• Type: Conference
• Year: 2009
• Where: ESORICS
• Authors: Tiancheng Li, Xiaonan Ma, Ninghui Li
• Keywords: Compliance Storage System, ESORICS 2009, Security Privacy, TCB Workload, Trustworthy Retention