Non-repudiable disk I/O in untrusted kernels
InkTag: secure applications on an untrusted operating system