Non-repudiable disk I/O in untrusted kernels
Virtual ghost: protecting applications from hostile operating systems