Vallum: Privacy, Confidentiality and Access Controlfor Sensitive Data in Cloud Environments Managing sensitive data in shared environments such as public clouds is an enduring challenge. While several approaches exist to protect data at rest such as endtoend encryption, there exist only a few solutions such as homomorphic encryption that offer secure data processing. Unfortunately, these solutions cannot be used in practice as they incur nonnegligible runtime overheads and security risks. Moreover, as the majority of data management systems were designed to operate in private cloud environments, which are under the control of the data owner, they often lack appropriate mechanisms for access control as well as privacy assurance. In this paper we propose Vallum, a data access and protection layer that closes these gaps while enabling users to operate data management systems in shared environments such securely as public clouds. Vallum utilizes Intel SGX and remote attestation to ensure confidentiality and integrity of the data being stored and processed. Furthermore, it provides access protection and privacy assurance through a extensible architecture. Our performance evaluation indicates that the overhead introduced by Vallum makes it viable to be deployed in cloud infrastructures.

TrustFS: An SGXEnabled Stackable File System Framework Data confidentiality in cloud services is commonly ensured by encrypting information before uploading it. However, this approach limits the use of contentaware functionalities, such as deduplication and compression. Although this issue has been addressed individually for some of these functionalities, no unified framework for building secure storage systems exists that can leverage such operations over encrypted data. We present TrustFS, a programmable and modular stackable file system framework for implementing secure contentaware storage functionalities over hardwareassisted trusted execution environments. This framework extends the original SafeFS architecture to provide the isolated execution guarantees of Intel SGX. We demonstrate its usability by implementing an SGXenabled stackable file system prototype while a preliminary evaluation shows that it incurs reasonable performance overhead when compared to conventional storage systems. Finally, we highlight open research challenges that must be further pursued in order for TrustFS to be fully adequate for building productionready secure storage solutions.