# Protecting File Activities via Deception for ARM TrustZone

Liwei Guo<EMAIL_ADDRESS>University of VirginiaUSA ,  Kaiyang Zhao
<EMAIL_ADDRESS>Carnegie Mellon UniversityUSA ,  Yiying Zhang
<EMAIL_ADDRESS>University of California, San DiegoUSA and  Felix Xiaozhu Lin
<EMAIL_ADDRESS>University of VirginiaUSA

###### Abstract.

A TrustZone TEE often invokes an external filesystem. While filedata can be
encrypted, the revealed file activities leak secrets. To hide the file
activities from the filesystem and its OS, we propose $Enigma$, a deception-
based defense injecting sybil file activities as the cover of actual file
activities.

$Enigma$ contributes three new designs. (1) To make the deception credible,
the TEE generates sybil calls by replaying file calls from the TEE code under
protection. (2) To make sybil activities cheap, the TEE requests the OS to run
$K$ filesystem images simultaneously. Concealing the disk, the TEE backs only
one image with the actual disk while backing others by only storing their
metadata. (3) To protect filesystem image identities, the TEE shuffles the
images frequently, preventing the OS from observing any image for long.

$Enigma$ works with unmodified filesystems shipped with Linux. On a low-cost
Arm SoC with EXT4 and F2FS, our system can concurrently run as many as 50
filesystem images with 37% disk overhead (less than 1% of disk overhead per
image). Compared to common obfuscation for hiding addresses in a flat space,
$Enigma$ hides file activities with richer semantics. Its cost is lower by one
order of magnitude while achieving the same level of probabilistic security
guarantees.

##  1\. Introduction

TrustZone is the trusted execution environment (TEE) on Arm CPUs. To use
TrustZone, developers encapsulate security-sensitive code as trustlets, which
are isolated in the secure world and shielded from an untrusted OS
(trustshadow, ; tzslicer, ).

#### File services for TEE

Many trustlets store security-sensitive data as files, such as sensor readings
and login credentials. As shown in Figure 1(a), trustlets often export file
calls (e.g. open/read/write/close) to the OS which hosts a modern filesystem.
Doing so gives trustlets access to modern file features such as crash
consistency and flash optimizations from various mature filesystems; meanwhile
the filesystem code does not have to be pulled into the TEE, keeping the TEE
lean.

#### Question & challenges

Reliance on an external filesystem suffers from a key drawback: leak of file
activities. Although a trustlet can encrypt file contents for confidentiality
and integrity, it has to send file activities in the clear. The activities
include file operation types (e.g. read, write, seek, and create),
sizes/offsets, and access occurrence (e.g. “the trustlet just created a
file”). From the received file activities, the OS can infer a truslet’s
secrets such as input data (obliviate, ; sgx-lkl, ). Section 2.3 will show
evidence.

In general, access activities can be obfuscated by injecting sybil activities
(kanon, ; sybilquery, ; kloakdb, ). When it comes to file activities, existing
solutions are inadequate. (1) Popular obfuscation techniques, e.g. ORAM (oram,
), focus on hiding data access addresses in a flat, memory-like space. While
they can generate random offsets within a file (obliviate, ), they cannot
generate file operations with rich semantics, e.g. “read /a/index at offset
42; then open /b/data and write at offset 1024”. (2) How to make sybil file
activities credible? Merely making them legal, e.g. no out-of-bound reads, is
not enough to deceive an OS that has prior knowledge of the true file
activities. (3) How to minimize the cost of sybil activities, which often
amplifies the actual activities significantly? For instance, a file backed by
ORAM-like disk blocks consumes up to 10$\times$ more space and slows down
access by at least one order of magnitude (obliviate, ).

$Enigma$ is a deception mechanism that hides file activities for a TrustZone
TEE. It centers on two insights. First, while invoking an external filesystem,
the TEE conceals the underlying physical disk111This paper uses disks to refer
to storage hardware including flash.. This allows the TEE to inject numerous
sybil file calls but discard their disk activities covertly with little cost.
Second, to make sybil activities credible, the TEE should borrow knowledge
from the trustlet under protection.

Figure 1. An overview of this work

#### 1\. Sybil filesystems with covert emulation

Sybil activities are expensive as they pollute the actual data on disk. We
therefore instantiate multiple filesystem images: one actual image, to which
the TEE sends actual file calls; and many sybil images, to which the TEE sends
sybil calls. This is shown in Figure 1(b). The separation of filesystem images
allows the TEE to fulfill their disk requests differently: performing all the
disk requests from the actual image; silently dropping filedata accesses from
the sybil images. Essentially, the TEE emulates storage for sybil images with
only their metadata, reducing their overheads to just enough for deceiving the
OS. The TEE further implements measures against OS probing the internals of
such covert emulation.

#### 2\. Protecting filesystem identity via shuffling

As the OS observes longer history of file activities, it poses an increasing
threat. For instance, the OS can determine which image may be actual by
comparing the current and the past file activities on an image. If the OS
succeeds, it uncovers all the actual file activities in retrospect and in the
future.

Our defense is to prevent the OS from observing file activities on any
filesystem image for long. In the spirit of moving target defense (MTD (mtd-
book, )), TEE periodically shuffles filesystem images that have identical OS-
visible states. Not knowing the shuffling scheme, the OS can only track an
image’s activities for a short period of time, less than several seconds in
our implementation. TEE does shuffling efficiently by only updating metadata
references, not the metadata itself or filedata.

#### 3\. Generating credible activities calls via replay

The TEE should issue sybil file calls close to what the trustlet would issue;
it cannot draw sybil calls, for example, from generic file traces. The TEE can
only deceive the OS when it knows the trustlet better than the OS. The
challenge is that the TEE can hardly model a trustlet’s behaviors or assess
how much the OS already knows about the trustlet.

Our idea is for the TEE to replay file traces pre-recorded from the very
trustlet to be protected. The file traces hence form a tight envelope of the
trustlet’s actual file activities. $Enigma$ provides support for developers to
collect file call segments and for the TEE to produce an unbounded stream of
sybil calls at run time.

#### Results

By constraining lightweight modifications to generic subsystems and
interfaces, Enigma eschews heavy internal changes to individual filesystems
and works with unmodified EXT4 and F2FS, reusing over 60K SLOC filesystem-
specific implementations. Through a study of six diverse trustlets from which
we collect over 200K file calls through testing, we show $Enigma$ is practical
to deploy and effectively hides the file activities that leak trustlet
secrets.

$Enigma$ provides the following guarantees: (1) Against random guess attacks:
the probability of a successful guess is 1/K; the successes of individual
attacks are independent. (2) Against an external, persistent observer: the
maximum period of continuously observing any filesystem image is T. Both K and
T are user-configurable.

On a low-cost ARM board (RaspberryPi 3) running 20 concurrent filesystem
images, $Enigma$ incurs 2.2$\times$ access slowdown and consumes 25%
additional disk space (with 1.5 MB per sybil image on average); with as many
as 50 concurrent filesystem images, $Enigma$ incurs 3.9$\times$ access
slowdown and 37% additional disk space.

#### Contributions

This paper presents $Enigma$, a novel mechanism that generates credible, rich
sybil file activities at low cost. $Enigma$ contributes the following new
designs:

  * •

Sybil filesystem images emulated with only their metadata, which makes strong
deception with numerous sybil file activities affordable.

  * •

Continuous shuffling of filesystem identities, which prevents an external
observer from collecting long histories of file activities, sybil or actual.

  * •

Replaying file call segments recorded from the trustlet under protection,
which effectively deceives a knowledgeable observer.

For a TrustZone TEE, $Enigma$’s deception approach opens the door to using
more untrusted external OS services.

##  2\. Motivations

###  2.1. TrustZone and its file services

#### TEE secure storage

Arm TrustZone statically partitions an SoC’s physical memory and IO devices
between normal world and a secure world (i.e. TEE) (santos, ). The TEE can
isolate storage medium, e.g. a SD card or a flash partition, from the normal
world OS. The resource partitioning differs from Intel SGX where memory is
mapped to TEE dynamically and the OS controls IO hardware.

#### TEE needs file services

Mobile/embedded devices produce and store security-sensitive data such as user
health logs and audios samples. TEE can isolate sensitive data from high-risk
software such as the OS, for which TEE needs a modern filesystem to keep the
data persistent. For instance, journaling (journaling-fs, ) prevents data
corruption, which is not uncommon on battery-powered smart devices; wear-
leveling extends flash lifespan (wear-leveling-survey, ), which is key to
flash longevity as IoT devices or their flash can be difficult to replace.

Unfortunately, modern filesystems are complex, making them unsuitable to run
within the TEE. First, a modern filesystem has substantial code. For instance,
EXT3/4 and F2FS have 35K and 17K SLOC respectively. They would significantly
bloat TEE’s trusted computing base (TCB), e.g. the popular OPTEE which only
has around 25K SLOC. Filesystem vulnerabilities (fs_evo, ; kernel_bug, ) then
become attack vectors against the TEE. Second, lifting-and-shifting a modern
filesystem to TEE requires tedious effort. Not only the filesystem but also
extensive kernel APIs must be ported, e.g. VFS, page allocation, and
workqueues. Trimming the filesystem code for TEE is error-prone, for which
developers need to thoroughly understand filesystem logic and test rigorously.
Maintaining a filesystem’s separate versions for OS and TEE complicates
distributing security updates and patches, which may give rise to a fragmented
ecosystem.

For these reasons, forwarding file calls to the OS is a common practice of
trustlets.

###  2.2. The Linux storage stack

Our design exploits the following OS storage features.

#### The stack layers

At the top of the stack, the virtual filesystem (VFS) is a filesystem-agnostic
frontend receiving filesystem calls, such as read or write, from filesystem
clients. VFS dispatches filesystem calls to concrete filesystem
implementations; VFS also caches recent file access. A filesystem translates
the file calls to disk requests, e.g. block read/write, and submits the
requests to an underlying block layer.

#### Filedata vs. Metadata

A filesystem’s all on-disk state constitutes its image. The image consists of
filedata as user contents and metadata which describes the file and the
filesystem. Common metadata examples are inodes, directory structures, and
block maps. Metadata often constitutes a small fraction of filesystem image, a
premise to be tested in Section 8. To execute a file call, a filesystem often
examines the metadata, e.g. reading inodes of a file in order to locate the
disk blocks.

###  2.3. The attacks

#### Threat model

We trust the software in TEE. Both the TEE’s file contents and file activities
may expose its secret. The file activities are driven by TEE software only and
not by untrusted entities, e.g. a normal-world app communicating with the TEE.
The filedata and file/directory names can be encrypted by the TEE.

The OS hosts a filesystem for the TEE. The OS is:

  * •

Curious. The OS probes the TEE’s secrets passively and actively. (1) It
monitors the TEE’s file activities, including file calls, disk requests, data
move, and timing of these activities; (2) it inspects a filesystem’s in-kernel
state; (3) it may deviate the filesystem logic to request disk reads or
writes.

  * •

Knowledgeable. The OS knows the sequences of file calls that the trustlet may
issue.

  * •

With unbounded memory. The OS can memoize the full histories of file calls and
disk requests it has ever observed. Following the TrustZone convention (tz-hw-
sec, ), we deem hardware attacks (e.g. bus snooping) and their side channels
out of scope.

#### Side channels through file activities

A file call exposes the following information that cannot be easily
obfuscated: file call types (posix-guide, ); accessed file paths, in
particular the relative location in a directory tree; arguments, e.g. sizes,
offsets, and flags. A trace of file calls is known to leak the caller’s secret
(obliviate, ; controlledChannel, ; access-patten-privacy, ).

We identify three common side channels from file traces: (1) Occurrence: the
events that a trustlet access files; (2) File paths; (3) Access patterns: the
combination of access offsets, sizes, and flags in a sequence of file calls.

#### Trustlets & attacks

We motivate our designs with the following trustlets, including their side
channels and secrets. Table 2 shows a detailed summary.

  * •

Databases for embedded environments such as SQLite manage on-device user data
(android-fs-usage, ). Prior work shows a database’s file access patterns
depend on queries (obliviate, ; access-patten-privacy, ; oblidb, ). For
instance, given a database’s schema and a sequence of file offsets, the OS can
learn a query’s secret: read 64 bytes at offset 0 and read 128 bytes at offset
4096 gives away page-align predicate columns (e.g. “user physical activities”)
and the rows selected (e.g. “hours when the user is sleeping”).

  * •

Fulltext search is for on-device QA over emails or messages (deqa, ). Given a
keyword, an engine reads a binary index file, locates file offsets where the
keyword appears, and reads in contextual lines. From the access offsets, the
OS can infer the secret: the keyword and the hit locations (access-patten-
privacy, ).

  * •

Model loading. A trustlet loads a neural network model from a file, for which
it may issue thousands of file calls to read and parse model layers. As
reported by prior work (nn-access-pattern, ) and verified by us on
TensorflowLite (tensorflow-web, ), from the file path and offsets the OS can
learn the secret: the loaded model.

  * •

Video surveillance. A trustlet on a camera detects video events of interest,
e.g. motion or vehicles, and saves video frames of interest. The OS observes
file writes and learns the secret: occurrences of events being detected.

  * •

Data historian. A trustlet on a robot collects sensor messages to a ROSBag
file (rosbag, ). The messages are of variable lengths depending on sensor
types (e.g. point clouds and sound samples) as well as data contents (e.g. a
point cloud’s density). From the write sizes, the OS can learn the secret:
sensor types, data contents, and hence the robot’s activities.

  * •

Credential manager. A trustlet loads one of multiple key files for
authentication with a remote server. From the file path, the OS can infer the
secret: the loaded key, which corresponds to user identity (e.g. a specific
private key) or server identity (e.g. a specific CA certificate).

###  2.4. System Overview

Figure 2. The system architecture, showing the filedata/metadata separation
and the physical disk layout

Figure 2 shows the system architecture.

#### Initialization

With secure IO, the TEE isolates the physical disk and exposes $K$ virtual
disks to the normal world. From the OS’s perspective, a virtual disk is no
different than a physical block device, except that the OS submits block
requests to the TEE. The TEE requests the OS to initialize $K$ images with the
same filesystem implementation on the $K$ virtual disks.

#### Operation

As a trustlet emits a stream of actual file calls, the TEE generates
additional K-1 streams of sybil calls 1 by replaying pre-recorded file call
segments (§5). The TEE sends the actual file calls to the actual filesystem
image and the sybil calls to their respective sybil images.

The OS runs K filesystem images with an unmodified filesystem implementation
(although the kernel’s generic storage subsystem is lightly modified, see
Section 6). At the end of each file call execution, the OS submits disk
read/write requests to their corresponding virtual disks in the TEE 2. The TEE
omits all filedata accesses from the sybil filesystem images and only executes
their metadata accesses 3, which is needed by the filesystem logic. The TEE
periodically unmounts filesystem images, shuffles the virtual disks backing
them, and remounts the images on the shuffled virtual disks.

To probe the virtual disk internals, the OS will attempt to: (1) read
filedata. (2) tamper with filedata. (3) measure delays of disk access. The TEE
implements mechanisms to block these attempts.

#### What the OS can and cannot see?

The OS sees K virtual disks exported by the TEE, on which K filesystem images
are mounted. It does not know which image is actual.

The OS sees K streams of file calls sent to the K images. In each stream, the
OS can see all file calls in the clear, including their types and arguments.
The OS cannot access filedata referenced in file calls. The patterns of file
calls fit in the OS’s prior knowledge about the trustlet’s file activities.
All streams show similar statistics, including throughputs of file calls and
bytes read and written.

To execute file calls, the OS can freely access metadata (e.g. inode) on
virtual disks but not filedata, as such attempts are blocked by TEE; the
delays in accessing metadata are the same across all virtual disks.

From time to time, the OS sees: the TEE unmounts some images and takes some
virtual disks offline; the TEE puts online new virtual disks with random
names. The OS cannot associate any new virtual disks to those disappeared.

#### Limitations

To simplify security reasoning, we consider that one actual filesystem image
is exclusively used by one trustlet; concurrent trustlets use separate
filesystem images.

##  3\. Sybil images with covert emulation

We seek to minimize the cost of sybil images so that $Enigma$ can afford a lot
of them for strong protection.

###  3.1. Metadata-only sybil images

The first question is what are the minimum disk requests for maintaining a
sybil image? We exploit a filesystem invariant: a filesystem only relies on
its metadata to function properly (e.g. to read or update inodes) (david, ).
Note that the filedata/metadata division in a modern filesystem can sometimes
be ambiguous, for which we will describe treatment (§6). $Enigma$ therefore
enforces that the code of filesystem and OS only access metadata content and
its access status (e.g. write completion), but not those of the filedata.

The second question is how to hide the fact that TEE only stores metadata for
sybil images? The TEE conceals the physical disk from the OS using the
TrustZone’s secure IO (Section 2). Note that the OS still manages insecure
storage devices out of TEE. As shown in Figure 2, the TEE directly backs the
actual image with a contiguous physical disk region. This preserves the
locality of actual disk accesses. The TEE stores the metadata for all sybil
images in a single binary blob. To save disk space, it compresses the metadata
with copy-on-write (CoW). CoW is effective because the sybil images are
mutated by file calls from the same trustlet and are likely to share similar
metadata.

We next describe the OS’s probing attacks against the covert emulation, as
well as our defense.

###  3.2. Isolating filedata paths

Threat: Knowing sybil filesystems contain only metadata, the OS submits disk
read requests for filedata on virtual disks; it knows the disk as sybil if no
data comes out.

Defense: TEE mitigates the threat by isolating the filedata path, which keeps
the OS oblivious to if filedata disk requests are actually executed on disk,
or when such requests are completed. The isolation is as follows.

1\. The filedata path: trustlet $\leftrightarrow$ disk. Filedata flows between
a trustlet and the physical disk without leaving the TEE. As shown in Figure
2, a trustlet makes file calls with opaque references of filedata buffers
(e.g. “read from offset 10 to buffer $<$a 64-bit int$>$”) ( 1); the OS
executes the file calls and issues disk requests containing these opaque
references ( 2); the TEE receives the disk ops, maps the opaque references
back to the filedata buffers, and moves the filedata between the trustlet and
the disk ( 4) without going through the OS. To prevent fabrication, each
opaque reference is a 64-bit integer and used one time only (opaque, ;
streambox-tz, ).

2\. The metadata path: OS $\leftrightarrow$ disk. Metadata flows between the
OS and the TEE’s disk. As shown in Figure 2 ( 3): the filesystem code
generates disk requests for metadata (e.g. “write to an inode at block 42”),
which contains cleartext references to OS buffers. The TEE executes the
requests and copies metadata between the TEE and the supplied OS buffers. The
TEE notifies the OS of metadata access completion. The TEE never examines
metadata or takes any action based on the metadata content.

###  3.3. Rejecting OS access to filedata

Threat: The filesystem code, by design, may rightfully repurpose disk blocks
without notifying the underlying disk. For instance, after flushing the redo
log (metadata), EXT4 may store filedata to the underlying blocks
(ext4-forensic, ). A malicious OS may tamper with the repurposed filedata
blocks, breaking filedata integrity and/or revealing the identity of sybil
images (i.e. those containing no proper filedata after filedata writes).

Defense: The TEE rejects OS from accessing filedata. To do so, it tracks
filedata blocks on the physical disk and keeps the filedata/metadata dichotomy
up to date.

Without requiring intimate filesystem knowledge, TEE enforces a simple policy:
allow the OS to only read back disk blocks it previously wrote to. When a
block is written initially, the TEE tags the block as “metadata” or “filedata”
depending on whether the written data comes from an OS buffer or a trustlet
buffer. The TEE accommodates block repurposing: in case data is written from
an OS buffer to a “filedata” block, the TEE erases the block so no existing
content is leaked, changes its tag as “metadata”, and grants the access.

Some filesystems may inline filedata in metadata blocks for efficiency, e.g.
EXT4 may inline files smaller than 160B. The TEE tags these blocks as “mixed”
and tracks inlined filedata ranges. As a result, the TEE allocates disk space
for inlined filedata on sybil images, which incur less than 1% of the space
overhead in our measurement.

###  3.4. Defense against timing attacks

Threat: The OS measures disk delays of metadata access. Since a sybil image’s
metadata is stored more compacted than the actual image, the OS may see lower
access delays.

Defense: The TEE pads delays of metadata access so that the OS sees uniform
delays. Note that it does not have to pad delays for filedata access, the
completion notifications for which bypass the OS as shown in Figure 2.

The TEE delays each metadata access to all filesystems to be longer than most
(e.g. 99%) of the actual delays, a value determined by profiling when
filesystem is mounted. Delaying is practical for two reasons. i) Metadata
accesses only constitute a small fraction of all disk access. ii) The actual
access delays on embedded flash show low variation because the storage has
limited internal buffering. We will show timing side channel reduction and
overhead in evaluation.

##  4\. Filesystem identity shuffling (FIDS)

TEE obfuscates file call histories in the spirit of moving target defense
(mtd-book, ). This is because an OS collecting long histories of file calls
poses two threats. (1) The OS is more capable of attacks. It can uncover
filesystem identities by reasoning about the histories. (2) The OS, if
accidentally discerns, the actual filesystem, creates higher damage. It learns
all the actual file calls in the past and in the future.

###  4.1. The mechanism

Critically, FIDS follows an egalitarian principle. The TEE frequently shuffles
identities of all filesystems, sybil and actual. A filesystem image’s OS-
visible state is $\langle v,M\rangle$: $v$ is the name of virtual disk that
the image is mounted on; $M$ is the metadata, which is exposed to the OS by
design.

Shuffling. Shuffling prevents the OS from connecting segments of file call
histories. It is performed on a set filesystem images $\\{\langle
v_{1},M\rangle,...,\langle v_{n},M\rangle\\}$ that currently have identical
metadata $M$, where $n$ is the number of filesystems. TEE assigns each backing
virtual disk a new, random name: $\\{\langle
v^{\prime}_{1},M\rangle,...,\langle v^{\prime}_{n},M\rangle\\}$. Since the OS
cannot connect new disk names $v^{\prime}_{i}$ to the old names $v_{i}$, it
cannot connect new filesystem identities to the old ones.

TEE triggers shuffling by time (e.g. an image has not participated in
shuffling for a period of $T$) or by activities (e.g. the image has served $N$
file calls since its last shuffling). Section 8 will evaluate the impact of
$T$, and show that even in the worst case (i.e. accidental filesystem identity
exposure), a practical $T$ (e.g. a few seconds) leaks no significant secrets
of the trustlet.

Forking. Forking keeps shuffling going when all images have distinct metadata.
In case TEE attempts to shuffle an image $\langle v,M\rangle$ but no other
images have metadata $M$, TEE creates an image with metadata $M$ and shuffles
the two images, resulting in $\langle v^{\prime},M\rangle$ and $\langle
v^{\prime\prime},M\rangle$. The OS cannot connect either of the two new
identities to the old image $\langle v,M\rangle$.

Retiring. TEE deletes an image to reclaim its blocks.

The mechanism is inexpensive. First, shuffling and forking only manipulate
references to metadata, not metadata itself nor filedata. Section 6 presents
more details. Second, TEE does not need to execute forking often, as there
often exist abundant images with the same metadata. For instance, a read-most
workload only mutates metadata occasionally.

FIDS operations are visible to the OS, e.g. after mounting, the OS knows
images with identical metadata may have been forked. FIDS, however, does not
leak filesystem identities, because both actual and sybil images can be forked
and shuffled; although the actual image cannot be retired, $Enigma$ ensures
that such a behavior does not leak identity, as will be discussed in §4.3.

###  4.2. Why FIDS works

We use lineage to describe an image’s OS-visible history. A lineage starts
with one of the initial $K$ images. It includes descendant images created by
forking and OS-perceived descendants created by shuffling. Figure 3 shows an
example: the first forking on image B creates two descendant C and D; the
subsequent shuffling of C and D result in images E and F. C–F all belong to
the lineage of B. After shuffling A and F, the resultant G and H belong to
both the lineages of A and B.

#### FIDS limits continuous observation

The OS can track the history of any image (e.g. by tagging them with unique
metadata), but only for a continuous period no longer than $T$. This prevents
the OS from collecting large number of samples (e.g. a few thousand (template-
attack, )) and building statistical models for filesystem images, thwarting
template attacks. Consider the actual image B in Figure 3. Without FIDS, B has
a straight-line lineage and its full history of file activities are exposed to
the OS. While FIDS does not change the true history of B (annotated with
$\bigstar$) which is only known to TEE, it makes the history appear uncertain
to the OS. Forking adds branches to B’s lineage; shuffling merges and then
splits lineages. OS can only see a lineage tree that clouds over the actual
history.

#### FIDS confines damage of identity exposure

Assume the OS, via an unexpected channel, discovers image B as actual. Without
FIDS, the OS can track backward in time and reveal all the past file calls on
B; it can track forward to learn all future calls on B. All the actual file
calls are hence leaked. FIDS prevents the OS from backtracking no further than
the most recent shuffling event; earlier than that event, all the images
participating in shuffling become the probable ancestors of B. Similarly, the
OS can forward track no further than the next shuffling/forking event on B.
Section 8 will quantify the resultant uncertainty to the OS.

###  4.3. Defense against extinct lineage attacks

Figure 3. A minimal example of filesystem identity shuffling. As time goes by,
the OS perceives multiple lineages as actual but cannot distinguish them

#### Threat:

While forking and shuffling are egalitarian, retiring cannot be: TEE never
retires the actual image, giving the OS a chance to weaken or break the actual
image’s anonymity. If the descendants of an earlier image X have all retired
(i.e. an extinct lineage), the OS can rule out X from being actual.

Figure 3 shows an example: if the TEE retires image A prior to its renaming
with F, the only remaining lineage is the one from B, which the OS can deem as
the actual. A successful OS pinpointing the actual image thus exposes the
filesystem identity as described above.

#### Defense:

TEE picks images to retire by respecting two invariants: (1) at any moment in
history, there are always $K$ alive lineages stemmed from the initial $K$
images; (2) the retiring event leaves at least $K$ images alive. The first
invariant ensures that the OS’s backtracking cannot rule out any of the
initial image from being actual. The second invariant ensures the strength of
anonymity at any time in history. Both invariants combined, the OS cannot find
a time in the past when there were fewer than $K$ lineages.

To enforce the two invariants, a challenge is to avoid memoizing all FIDS
events which grow unbounded. The TEE implements a simple rule: avoid retiring
an image if it is the last surviving image on a lineage. To do so, the TEE
only keeps K tags: tagging each image with its ancestor as one of the K
initial images and propagating the tag to descendants.

The above design will not result in too many images of which none can be
retired. As long as there are more than K images, there are multiple images
belonging to the same lineage; retiring any will satisfy both invariants
above.

##  5\. Generating sybil file calls

We ensure that TEE generates sybil file calls close to what the trustlet would
actually issue, from which the OS is unable to discern the actual file calls.
The objective is not to match the actual file traces in deployment, but to
generate diverse trace segments that provide strong cover.

###  5.1. Design

First, how to fit sybil file calls in a trustlet’s envelope of file
activities? For instance, a database may show a variety of file access
patterns depending on queries; one pattern can be “read 8 bytes, skip 16
bytes, and read 42 more bytes”. If a stream of file calls do not show any such
pattern that the OS knows must exist in actual file calls, the OS can
determine the stream of file calls as sybil. However, it is difficult for
$Enigma$ to model a trustlet’s file activities or assess how much the OS knows
about the activities.

Our solution is to exploit the knowledge already encoded in a trustlet: the
TEE replays historic file traces from the trustlet to be protected. To this
end, developers exercise the trustlet with a set of inputs and record file
traces during the execution, which we will show in Section 5.2.

Second, how to generate sybil calls that provide
strong protection? Our insight is that the efficacy of sybil calls hinges on
the set of plausible secrets they represent as cover traffic for the actual
secret; we measure such efficacy as the set’s cardinality and entropy
estimation (beirlant1997nonparametric, ). Intuitively, a library of sybil
calls would offer stronger anonymity if the library represents more plausible
secrets and these secrets are uniformly distributed in the space of secrets.

To quantify the set of plausible secrets, we exploit an observation: a
trustlet’s file calls are driven by input events (android-fs-usage, ; bluefs,
), which are associated with the trustlet’s secret. Therefore, we retrofit the
idea of viewing a file trace as independent segments, where each trace segment
encodes a secret value. For instance, the file trace of a database can be
segmented per query and each segment encodes a secret $\langle C,R\rangle$: a
query’s predicate columns ($C$) and its selected rows ($R$).

With the above rationale, $Enigma$ assists developers to collect sybil trace
segments. It requires the developers to (1) provide annotations for segmenting
file traces, e.g. by input events; (2) provide test inputs, such as concrete
database queries; (3) annotate the inputs with plausible secrets they
represent. A test harness exercises the trustlet and records the resultant
trace segments. It reports cardinality and entropy of the current secret set
(beirlant1997nonparametric, ) and makes suggestion towards improving them. The
developers finish collection when they are satisfied with the metrics.

For example, to collect trace from a database trustlet, the developers provide
as input a set of queries, each annotated with a secret $\langle C,R\rangle$
for the query. The set of plausible secrets is therefore $\\{\langle
C_{1},R_{1}\rangle,\langle C_{2},R_{2}\rangle,...\\}$. After running a batch
of queries and collecting the trace segments, the test harness suggests to
increase the secret set entropy by running more queries that select more
diverse columns.

Third, how to replay the segments? TEE replays by sampling from a library of
trace segments; it preserves both the pre-recorded order and arguments of file
calls within a segment. As it runs, it gradually renews the pre-recorded
segments with segments (both sybil and actual) collected in deployment. As a
result, the sybil traces evolve to be even closer to what the trustlet is
issuing in deployment. We further address the following issues. (1) Time the
emission of segments.  TEE emits at random intervals so that sybil file call
throughput and read/write throughputs approximate that of the actual trace.
(2) Delay between file calls.  To prevent timing side channel, the TEE
uniformly pads all the intervals between file calls to the maximum interval it
has observed. (3) Make sybil calls consistent with filesystem images.  The TEE
adjusts sybil calls before replay, for instance, to create files, to truncate
the offsets of out-of-bound access, to redirect access from non-existing
files.

###  5.2. Case study

We study the trustlets in Table 2. Our input for recording should be seen as
examples; developers are likely to have inputs better matching their
deployment, e.g. queries from their deployed databases or logs from their
robots.

Database. We run SQLite on a database of user health activities with 3 columns
in numeric types. We run a suite of queries (sqlite-speedtest, ) and segment
file traces by query. We collected 500 trace segments constituted by 15K file
calls.

FullText. We run Lucy, an embedded search engine (apache-lucy, ) over 2GB of
emails (enron, ). The inputs are 100 searches for top keywords. We segment
file calls by search. The collected 100 segments consist of 100K file calls.

ModelLoad. We run TensorflowLite. Our inputs are 10 sample NN models loaded
for inference. We segment file traces by each model load. We collected 100K
file calls in 10 segments.

VideoEvent. We run an OpenCV motion detector. Our inputs are 100 hours of
street camera videos in Bangor (bangor-webcam, ). We segment file calls by per
video hour and have collected 9K file calls in 100 segments.

Historian. We run the ROSBag drive data historian with 10 different drives
from the autonomous driving dataset (rosbag, ). We instrument the run script
to segment file calls by per test drive. We have collected 9K file calls in 9K
segments.

CredLoader Our test script generates 50 key files and invokes the Openssh
client on these key files for login. We instrument the test script to segment
file calls by each login attempt. We have collected 300 file calls in 100
segments.

##  6\. Implementation

We implement $Enigma$ in 2K SLOC, atop OPTEE and Linux as summarized in Table
3. Of the code, 1K SLOC is for modifying the generic kernel page cache and
block subsystem; filesystem-specific code incurs only less than 50 SLOC of
changes. In another 1K SLOC, we use the MMC driverlet inside TEE (driverlet,
), which provides read/write functions sufficient to our needs. We use a 32-GB
microSD for storage and partition it into two: one is 4GB and used by the
untrusted OS as its rootfs; the other is managed by $Enigma$ as the isolated
physical disk. We next describe implementation details of Enigma – how we
apply lightweight instrumentations to generic kernel subsystems and avoid
heavy modifications to individual filesystems.

#### TEE $\leftrightarrow$ OS interfaces

We instrument two interfaces for communicating between TEE and OS. At them, we
inject SMC instructions and handle world switches.

  1. (1)

TEE $\rightarrow$ OS. Via the interface, $Enigma$ issues file calls (actual
and sybil) to OS. To this end, we instrument filesystem syscalls (e.g.
generic_perform_read) at VFS layer. We modify the data buffer pointer of the
interface (i.e. iov_iter) to pass opaque references pointing to in-TEE buffer
addresses (§3.2) instead of userspace addresses; we further preserve them in
the kernel page struct, which we will describe shortly.

  2. (2)

OS $\rightarrow$ TEE. At the filesystem bottom, we instrumented the block IO
(bio) interface (e.g. submit_bio). It dequeues bios to TEE; when it does so,
we retrieve the opaque references from the page struct pointed by the bio and
pass them back to TEE. We also modify bio callbacks to let the filesystem
execute asynchronously w.r.t. TEE invocations and disable bio merging.

#### Isolating filedata path

While being conceptually independent of each other, filesystems work closely
with kernel memory management (MM) layer. For instance, a filesystem is also
responsible for reading filedata into the page cache, and in coordination with
the MM layer, writes dirty pages (filedata) back to the disk.

To isolate the filedata path described in Section 3.2, we disengage the page
cache layer as follows. We first modify the page cache allocation methods
(e.g. pagecache_get_page) to preserve the opaque references in page cache. By
design, OS must allocate page cache before manipulating data pointed by
foreign addresses (e.g. by userspace or opaque references). At TEE
$\rightarrow$ OS interface when OS allocates pages, we tag all newly allocated
pages and inherit opaque references in their page struct. We then block kernel
attempts to copy from/to opaque references. To do so, we associate the tagged
kernel pages (i.e. contain opaque references) with pre-allocated user pages
which only have dummy filedata, and direct all accesses to tagged pages to
them. With all changes reflected on tagged kernel pages and dummy user pages,
OS is oblivious to opaque references and makes decision based on its intact
logic (e.g. whether to flush dirty pages). This transparently bypasses the
page cache layer without disruptive changes.

As a result of the above modifications: 1) on the filedata write path, OS
allocates kernel pages which preserve opaque references, and copies dummy user
pages (i.e. filedata to write) to them. After filesystem execution, OS
generates bios whose filedata points to these kernel pages. It then submits
the bios to TEE, returning opaque references. 2) on the filedata read path, it
is a mirror process.

#### Block translation tables

A bio request received by the TEE carries a buffer address and a virtual block
number. The latter is translated to a block number for the isolated physical
disk. The TEE does the translation by consulting with its per-image block
translation tables (BTT). A BTT maps an OS-visible virtual block number to a
TEE-visible physical block number. BTT entries are only for metadata blocks.
Filedata block numbers do not need translation – they are either directly
mapped to the physical disk or discarded.

BTTs reduce the cost of manipulating sybil filesystem images. (1) Much of FIDS
becomes BTT operations. To fork an image, the TEE duplicates its BTT without
duplicating the disk blocks. To shuffle two images, the TEE unmounts the
images, shuffle their BTTs, and re-mounts them. To retire an image, the TEE
frees its BTT. (2) The TEE implements CoW by setting BTT entries of identical
metadata blocks pointing to the same physical copy. When any shared disk block
is written to, the TEE allocates a new disk block and updates BTT entries for
all filesystems.

#### Store BTTs securely

The TEE stores encrypted BTTs in the normal world. There are two reasons: 1)
BTTs should enjoy equal confidentiality and reliability as user files; 2)
storing BTTs on an in-TEE filesystem (with crash consistency, etc.) would
defeat our goal of leaving filesystem out of TEE.

Outsourcing BTT storage leaks no secrets: BTT lookups are driven by disk
requests submitted from the OS; the input block numbers are from the OS; the
output block numbers will not be decrypted until they are in the TEE. The TEE
updates BTTs only in an egalitarian fashion. In shuffling filesystem images,
the TEE re-encrypts all their BTT entries. To allocate a new disk block for a
virtual block, the TEE re-encrypts BTT entries corresponding to the virtual
block of all filesystems.

#### Metadata vs. filedata

The following details are from real-world filesystems. (1) Because filesystem
logic needs to access directory contents, $Enigma$ treats directories as
metadata, although they may be implemented as special files by some
filesystems. (2) $Enigma$ treats a journaling filesystem’s journal as
metadata. By default, common journaling filesystems write dirty metadata (e.g.
inodes) to their journals. As an expensive option, they can write filedata to
journals for stronger consistency. In our current implementation we turn the
option off. (3) Some OS functions may read filedata, e.g. exec() will parse
the header of an executable file. These functions, however, are not supposed
to be invoked on TEE-owned files (e.g. OS should not exec() a TEE program
file). TEE can safely reject the read attempts.

##  7\. Security analysis

| Attacks | Defense/mitigation | C | I | A
---|---|---|---|---|---
Passive | Observing file activities |  Sybil filesystems with credible activities §3 & §5 | ✓ | - | -
Observing filedata move |  Isolating filedata path §3.2 | ✓ | - | -
Measure disk timing |  Delay padding §3.4 | ✓ | - | -
Learning history of file activities |  Filesystem identity shuffling §4 | ✓ | - | -
Active | Dropping file calls |  TEE checks file integrity (trustshadow, ) | - | $\circ$ | $\circ$
Dropping (un)mounting requests |  TEE checks filesystem integrity (sprobes, ) | - | $\circ$ | $\circ$
Unsolicited reads from filedata |  Reject OS access §3.3 | ✓ | - | -
Unsolicited writes to filedata |  TEE erases existing filedata §3.3; detect by file check (trustshadow, ) | ✓ | $\circ$ | -
Unsolicited writes to metadata |  TEE not touching metedata §3.2; detect by filesystem check (sprobes, ) | ✓ | $\circ$ | -
Supplying wrong block numbers of filedata |  TEE checks file integrity (trustshadow, ) | - | $\circ$ | -
Fabricated references of filedata |  Strong opaque references §3.1 | ✓ | ✓ | -
Table 1. $Enigma$ thwarts attacks against confidentiality. C: Confidentiality,
I: Integrity, A: Availability. ✓: Attack thwarted, $\circ$: Attack detected -:
Not targeted by the attack

###  7.1. TCB

$Enigma$ keeps substantial OS code out of the TEE: 37K for EXT4, 22K for F2FS,
and 37K for a block layer, as reported by SLOCCount (sloccount, ) in kernel
v4.19. The $Enigma$ runtime only adds 1K SLOC to the TEE and its replay-based
MMC driver adds another 1K SLOC. The TEE exports two interfaces to the OS, for
issuing file calls and for receiving disk requests. Through the two
interfaces, the normal/secure workloads share no state. Following a common
practice (ginseng, ), the TEE passes messages with arguments packed into CPU
registers during world switches, minimizing the risks of data leak. The only
input data to the TEE is metadata. The TEE is secure against invalid or
malformed metadata: 1) the TEE simply moves the metadata between OS buffers
and the physical disk; it never touches the metadata; 2) the TEE sets the
backing memory to be non-executable.

###  7.2. Security guarantees

#### Against random guess attacks

In each attempt, the attackers randomly pick one of $K$ filesystem images and
infer secret based on the file calls on the image. They break the obfuscation
if they either hit the actual image, or hit a sybil image that coincides with
the actual secret. Hence the probability to break $Enigma$ is
$\frac{1}{K}+\frac{K-1}{K}(1/N)$, where $N$ is the number of plausible secrets
represented by the trace library. As developers generate traces towards an $N$
much higher than $K$ (§5.2), e.g. $N$=500 secrets for Database, the above
probability is close to $1/K$.

Section 8 will compare $Enigma$ to ORAM when they provide same probabilistic
guarantees.

Figure 4. FIDS diminishes probability of OS distinguishing an image’s history
from histories of other images. Write-most benchmarks are shown. On read-most
benchmarks the probability converges even faster

#### Against observation of file call histories

We measure $P$: the probability that the OS pinpoints the history of a given
filesystem image F. $P$ is reciprocal to the number of images ($M$) that have
histories indistinguishable from F to the view of the OS, due to shuffling (§
4). We model $M$ as a set cardinality: $M=|\bigcup_{i=1}^{r}S_{i}|$, where $r$
is rounds of shuffling, $S_{i}$ is the set of filesystems participating in
$i$-th shuffling round; $M\in[1,K]$.

We study how $P$ changes as a function of shuffling round $r$. In the above
form of $P$, $S_{i}$ depends on the set of filesystem images having identical
metadata. Therefore, we run all benchmarks with varying $K$, collect their
traces, and report the average $P$ as a function of $r$. The results are shown
in Figure 4. In general, as an image participates more rounds of shuffling,
$P$ drops from 1 (OS is certain about its history) to lower values (less
certain). $P$ drops faster with a larger number of images (higher K), because
of richer shuffling opportunities and thus faster increase in uncertainty.

#### Against disk timing side channels

We quantify the mitigation (§3.4). We measure the delays during 100 runs of
filesystem image initialization, consisting of over 400K physical disk
accesses as described. We set the padding threshold to be 1.6 us,
99-percentile of the measured delays.

We then run a filesystem with two versions: (1) Insecure; (2) $Enigma$ with
various paddings. We use mutual information (MI), a common notion of
information theory used in privacy preservation (time-protection, ; trace-
wringing, ), to characterize the correlation between two random variables: (a)
the access timing distribution of 1000 randomly sampled blocks on version 1
(i.e. Insecure) and (b) the access timing distribution of the same set of
blocks on version 2 (i.e. ours with various paddings). Higher MI implies the
higher certainty that the second timings are sampled from an emulated disk.

Our measurement shows a significant MI reduction, from 0.342 bits (i.e.
$Enigma$ w/o padding) to 0.007 bits. Such a level of residue MI is considered
negligible in prior work (time-protection, ), suggesting it is difficult for
the OS to correlate whether a disk is emulated to the observed access delays.

#### Against other attacks

Table 1 shows that $Enigma$ leaks no filedata or activities to an adversarial
OS even when the OS deviates from the filesystem logic or injects malformed
metadata. $Enigma$’s confidentiality is susceptible to hardware side channels,
e.g. through CPU cache. We rely on existing mitigations (time-protection, ).
$Enigma$ defeats filedata integrity attacks by rejecting OS accesses (§ 3.3).
$Enigma$ can detect availability attacks but cannot prevent them, e.g. the OS
powering down the whole device.

##  8\. Evaluation

We seek to answer the following questions on $Enigma$:

  * •

How much is the space overhead? (§8.2)

  * •

How much is the slowdown in file accesses? (§8.3)

  * •

What is the performance impact of FIDS? (§8.4)

###  8.1. Methodology

Trustlets & description | IO Char. | Dataset |  | Access
---
delay
| Side
---
channels
| Comparisons
---
(Baselines)
|  Database. Query on-device
---
database of user health data.
| Single file
---
Rand RW
|  select(1-8) benchmarks from SQLite (sqlite-speedtest, ).
---
Total: 500 queries, 14K file calls. File size: 800KB
| Per
---
query
Sizes & offsets | ORAM
|  Fulltext. Search text files for
---
on-device QA.
| Multi files
---
Rand RD
|  Lucy (apache-lucy, ) on pre-indexed Enron emails (enron, ).
---
Total: 100 queries; 100K file calls. File size: 2 GB
| Per
---
search
Sizes & offsets
|  ModelLoad. Load ML models
---
from files.
| Multi files
---
Rand RD
|  TensorflowLite (tensorflow-web, ) loading 10 neural nets,
---
Total: 80K file calls. File size: 41 MB.
| Load per
---
NN
| Sizes & offsets
---
File paths
|  Historian. Log data bags
---
from multi. sensors on a robot.
| Single file
---
Append
|  ROSBag on EU Long-term dataset (rosbag, ).
---
Total: 36K file calls. File size: 659 MB.
| Log per
---
data bag
Sizes & offsets |  | PadWrite
---
|  VideoEv. Log images of
---
motion events detected.
| Multi files
---
Seq WR
|  50 1080P images in Bangor video (bangor-webcam, ).
---
Total: 9K file calls. File size: 100 KB
| Log per
---
image
Access occurrences |  | InjectCreate
---
|  CredLoader. Load credentials
---
for authentication with servers.
| Multi file
---
Seq RD
| Load 50 key files generated with ssh-keygen.
---
Total: 150 file calls. File size: 0.9 KB.
| Load per
---
key
File paths |  | InjectFiles
---
Table 2. A summary of benchmarks Table 3. The test platform used in evaluation

#### Setup and metrics

Table 3 summarizes our test platform. We choose Rpi3 (rpi3, ) for its good
support for TrustZone. Table 2 summarizes the trustlets as benchmarks and
their traces. In TrustZone, we do not run them but extract their file traces
for replay, making benchmarks simple and reproducible. Note that our benchmark
programs are for reproducing trustlets’ file activities; production trustlets
likely have different, more compact implementations, e.g. by linking to
embedded libraries. We deliberately diversify file behaviors and file sizes.
For each benchmark, we create the smallest disk partition that can accommodate
the benchmark files. Note that the smallest disk sizes supported by F2FS and
EXT4 are 39 MB and 2 MB.

#### Filesystem choices

We pick two mainstream filesystems that exercise $Enigma$ in different ways.

  * •

F2FS is $Enigma$’s reference filesystem. A log-structured filesystem popular
on mobile devices, F2FS extensively optimizes for NAND flash (f2fs, ). For
flash longevity, F2FS allocates blocks on demand and generates compact
metadata. We create the test image with mkfs.f2fs v1.11.0.

  * •

EXT4 is our stress test for $Enigma$. A journaling filesystem, EXT4 issues
dense metadata writes (union-buffer-cache-fast, ). Since $Enigma$ stores
metadata for sybil images, it incurs higher overhead with EXT4. We create the
test image with mkfs.ext4 v1.44.5.

Figure 5. Disk usage (lines) and metadata compression ratio (columns).
$Enigma$’s usage is modestly higher than Insecure and grows gracefully with K
on most benchmarks. X axis: number of filesystem images (K). Note that an
image of F2FS/Ext4 has a minimum size of 2 MB/39MB by design

#### Baselines

First, we consider Insecure which incurs no overhead: the TEE invokes a
filesystem image without any protection. Furthermore, we consider protection
baselines that specifically hide the side channel of each trustlet. As such,
these protections pay no cost for unneeded protection and are therefore
competitive against $Enigma$. They are summarized in Table 2 with details as
follows.

  * •

ORAM (obliviate, ) is the baseline protection for Database, FullText, and
ModelLoad. It mitigates side channels due to access sizes and offsets within a
single file through obfuscation. By design, ORAM guarantees that the
probability of random guesses recovering the file trace is $P=1/2^{LM}$, where
$L$ is the height of ORAM tree and $M$ is number of accesses in the trace
(path-oram, ). Since $Enigma$ provides $P=1/K$, we compare the overheads of
ORAM and $Enigma$ when their guarantees match, i.e. $P=1/2^{LM}=1/K$. We set
$K=50$, ($P=0.02$), the largest number of filesystem images $Enigma$ can run
on our test platform with limited TEE memory. Since ORAM’s $L$ and $M$ must be
integers, we choose the closest value $LM=6$, where $M$ depends on a
benchmark’s trace segments, e.g. $M=3$ for Database.

  * •

PadWrite hides the append sizes for Historian. The TEE pads the size of each
append to be the largest append the benchmark may issue. No sybil files or
calls are injected.

  * •

InjectCreate hides file creation occurrences for VideoEv. The TEE creates the
same number of sybil files as the actual files. The creation times are
independent of the actual creation. Since VideoEv’s file sizes are not secret,
the TEE creates the sybil files with same sizes as the actual.

  * •

InjectFiles hides file paths for CredLoader. The TEE injects the same number
of sybil files as the actual files in the actual image and emits sybil reads
to them. Since CredLoader’s access offsets within files are no secret, the
sybil reads use the actual offsets.

###  8.2. Space overhead

#### Disk overhead

comes from (1) the metadata size per sybil image amplified by (2) the number
of sybil images ($K-1$).

As shown in Figure 5, the disk overhead is modest in most benchmarks. Compared
to Insecure, $Enigma$ increases the disk usage by 1%-58% (18% on average) when
$K=5$. When $K$ reaches as high as 50, the disk space of $Enigma$ as compared
to Insecure is 38% on average, which roughly translates to 1% per additional
sybil image.

Our experiments show the efficacy of the metadata CoW compression (§3). For
example, with $K$=20, turning off CoW increases the disk overhead by 2$\times$
on F2FS and 4$\times$ on EXT4. When we further turn off discard of filedata,
the disk overhead is almost linear to $K$.

Table 4. Disk space (MB) needed by baselines. Note that EXT4/F2FS have the
least allowable disk sizes of 2MB/39MB respectively. Figure 5 shows the disk
usage of $Enigma$

#### Comparison with baselines

Table 4 shows their minimal disk usage. ORAM incurs 9$\times$ disk overhead,
3$\times$ to 9$\times$ higher than $Enigma$ with $K=50$, which is consistent
with prior ORAM-based file protection (obliviate, ). This is because ORAM-
based protection must store the whole ORAM tree, several times larger than the
address space (file size) to be protected.

For trustlets that can be protected with simple obfuscation, the baselines may
use less disk space than $Enigma$. For instance, on Historian and VideoEv
which append to a single file, their disk usage is 6% and 18% lower than
$Enigma$ with $K=20$. This is because 1) intensive filedata writes update
metadata frequently, which makes $Enigma$’s compression less effective; 2) the
metadata on many sybil images exceeds the total size of small files (e.g.
5MB).

#### Memory overhead

of $Enigma$ is from storing BTTs and the metadata of sybil images. Such memory
consumption grows with $K$. It is allocated in the normal world only and the
stable consumption is modest, e.g. 26 MB and 18 MB for running ModelLoad on
EXT4 and F2FS when $K=20$, a small fraction of the 1GB DRAM on our board.

###  8.3. File access delays

We measure delays of file access sequences as defined in Table 2. The
rationale is the mobile/embedded trustlets are often event-driven and latency-
sensitive.

Figure 6. File access delays. $Enigma$’s delays are modestly higher than
Insecure and grow gracefully with K on most benchmarks. X axis: number of
filesystem images (K). Delay metrics defined in Table 2

Table 5. File access delays (in ms) by baselines for comparison. $Enigma$’s
results are in Figure 5

Figure 5 shows the results. On most benchmarks, the delays grow gracefully
with $K$. Compared to Insecure with only the actual image: $Enigma$ with
$K=20$ increases the delays by 1.3$\times$-4.5$\times$ (2$\times$ on average),
showing a sublinear growth. $Enigma$ benefits from its elimination of filedata
access for sybil images, which discards 95% of disk requests on average. The
delay of VideoEv does not grow because the TEE issues file calls to images at
different times in order to hide access occurrence; these file calls do not
contend. When $K>20$, $Enigma$’s concurrent execution of filesystemes is bound
by four ARM cores on our board. For Historian and Fulltext on F2FS with $K$ ¿
45, our test board runs out of TEE memory. Note that the delays of
normal/secure world switches (i.e. ns) are negligible compared to the disk IO
delays (i.e. us).

#### Comparisons

Compared to ORAM, $Enigma$’s delays are lower by 8$\times$ – 70$\times$ (on
average 37$\times$). In contrast to $Enigma$ which discards sybil filedata,
ORAM amplifies filedata by tens of times. While a benchmark reads tens of MBs
of data, ORAM amplifies reads by 18$\times$ and adds 20$\times$ extra writes.
This results in 40$\times$ disk IO and saturates our disk bandwidth.

On Historian, $Enigma$’s delay up to 4$\times$ higher than PadWrite. This is
expected, as PadWrite precisely caters to Historian’s append-only pattern and
its side channel. Its only overhead is write of additional filedata. On
CredLoader with F2FS, the delay with $K=50$ is 63% higher than the baseline
InjectFiles. The reason is in F2FS’s low performance in accessing many small
files of this benchmark.

Figure 7. Trustlet throughputs under different FIDS intervals (T). X axis:
number of images (K)

###  8.4. FIDS overhead

#### Costs of FIDS operations

Shuffling and forking do not require data copy or move. Of their delays,
10%–30% comes from BTT manipulation while the remaining comes from stopping
and restarting filesystem images as done by the untrusted Linux kernel. With
EXT4: 1) forking takes 90ms/180ms on a 64MB/2GB disk, respectively. 2)
shuffling two disks of 64MB/2GB each takes 80ms and 130ms, respectively. 3)
retiring an image takes less than 1 ms. Compared to EXT4, F2FS shows 39% – 66%
shorter delays due to its “fastboot” option. Our measurements suggest FIDS
efficiency can benefit from further optimization of the Linux kernel, e.g. by
parallelizing mounting/unmounting of many filesystem images.

#### Impact on trustlet throughputs

Because by design FIDS is executed in the background off the file access path,
we focus on its impacts on a trustlet’s throughputs.

Figure 7 shows three benchmarks where throughput matters. We chose the
intervals based on (android-io, ), which reports low-frequency and bursty file
activities for mobile/edge device; under such intervals, at most 1-2 secrets
may be exposed even in case of accidental filesystem identity leak. We
validate their throughputs are bound by disk IO because the throughputs are
higher when running them on Insecure filesystem. Hence, our test trustlets do
not execute app logic, e.g. database code; they execute file accesses as
quickly as $Enigma$ allows.

Even under strong protection (e.g. $K=20$; FIDS every second), the benchmarks
deliver throughputs appropriate to the IoT/embedded scenarios. Database and
Fulltext can process tens of queries per second and several queries per
second, respectively, sufficient to queries driven by a single user. Historian
can log a few MBs of data per second, which can support a robot’s 1–2 HD video
streams or point clouds at 3–5 FPS (chinchali2019network, ). As the developers
relax the protection, the throughputs improve by 1.5$\times$ to 2$\times$.
Using Insecure increases these throughputs by 2$\times$-10$\times$.

##  9\. Related Work

#### Side-channels & mitigations

Timing side channels are often mitigated by deploying low-res timer
(vattikonda_eliminating_2011, ; mozilla_clamp_2015, ), padding delays (time-
protection, ). We do not focus on them but apply these techniques to mitigate
the side channel of our emulated disk. Access pattern side channels (e.g.
memory (controlledChannel, ; access-patten-privacy, ), file (obliviate, ))
exploit data-dependent execution to infer user input (e.g. queries). They are
often mitigated by distorting the access pattern (e.g. via ORAM (oram, ;
opaque, ; oblidb, )). Motivated by them, we also protect access pattern;
unlike them, we preserve the patterns yet hide them under credible sybil ones.

#### Hide data in plain sight

To hide data that must eventually be released, an old wisdom is to add noise
(noise-addition, ) as deception. Due to its practicality, recent systems start
to adopt it for anonymous location sharing (sybilquery, ), query processing
(kloakdb, ). Compared to them, we are the first to apply it to file services.
Another approach is to continuously reset attacker’s observations on the data
(e.g. ASLR (aslr, ) limits attacker’s observation on address spaces). We echo
its motivations; we deal with filesystem identities (actual vs. sybil), a
different domain.

#### TEE and file services

To enable files services for these apps, some include filesystem code inside
TEE (e.g. through porting (haven, ), libraryOS (graphene-sgx, ), build anew
(besfs, )). Compared to them, we do not include nor invent filesystem code,
instead we take a forwarding approach which reuses unmodified filesystem code.
Some forward file calls as we do (trustshadow, ; shinde_panoply_2017, ). In
comparison, we focus on the ignored side channel caused by such forwarding.
Some exposes to apps a raw block device interface (sbd, ), which is backed by
a file in normal OS for crash consistency. Similar to it, we also store a
backing file in normal OS (i.e. BTTs). Different from it, we store inside TEE
a compact representation of filesystems, similar to David (david, ).

##  10\. Concluding remarks

#### Applicability to SGX

$Enigma$ may hide the file activities of an SGX TEE (enclave) albeit with
different implementation requirements. Unlike a TrustZone TEE, an SGX enclave
lacks the capability of direct disk access. Thus, $Enigma$ may use a
hypervisor to manage disk hardware for the enclave and isolate the disk from
the untrusted OS, similar to (bitvisor, ; twindrivers, ).

#### Conclusions

$Enigma$ hides file activities of a TrustZone TEE. With $Enigma$, the TEE
generates sybil calls by replaying; the TEE backs only one image with the
actual disk while other images with emulated storage; the TEE prevents the OS
from learning long history of any image. We build $Enigma$ and show that
$Enigma$ works with unmodified file systems, incurs affordable overhead, and
represents a new design point in guarding IoT storage stack. $Enigma$ opens
the door for a TEE to external untrusted OS services.

## References

  * [1] SQLite: Speedtest1.c.  https://sqlite.org/src/file/test/speedtest1.c, 2019.  (Accessed on 08/16/2019).
  * [2] Apache lucy.  http://lucy.apache.org/, 2020.  (Accessed on 11/24/2020).
  * [3] Kernel.org bugzilla - bug list.  https://bugzilla.kernel.org/buglist.cgi?chfield=%5BBug%20creation%5D&chfieldfrom=7d, 2020\.
  * [4] Raspberry pi 3 model b+.  https://www.raspberrypi.org/products/raspberry-pi-3-model-b-plus/, 2021\.  (Accessed on 04/22/2021).
  * [5] Tensorflow.  https://www.tensorflow.org/, 2021.  (Accessed on 04/22/2021).
  * [6] Youtube live streaming: Downtown bangor.  https://www.youtube.com/watch?v=LIQnvi2FmUg, 2021.  (Accessed on 05/06/2021).
  * [7] Nitin Agrawal, Leo Prasath Arulraj, Andrea C. Arpaci-Dusseau, and Remzi H. Arpaci-Dusseau.  Emulating goliath storage systems with david.  In 9th USENIX Conference on File and Storage Technologies, San Jose, CA, USA, February 15-17, 2011, pages 203–216, 2011.
  * [8] Adil Ahmad, Kyungtae Kim, Muhammad Ihsanulhaq Sarfaraz, and Byoungyoung Lee.  OBLIVIATE: A data oblivious filesystem for intel SGX.  In 25th Annual Network and Distributed System Security Symposium, NDSS 2018, San Diego, California, USA, February 18-21, 2018, 2018\.
  * [9] Andrew Baumann, Marcus Peinado, and Galen Hunt.  Shielding applications from an untrusted cloud with haven.  ACM Trans. Comput. Syst., 33(3):8:1–8:26, August 2015.
  * [10] Jan Beirlant, Edward J Dudewicz, László Györfi, Edward C Van der Meulen, et al.  Nonparametric entropy estimation: An overview.  International Journal of Mathematical and Statistical Sciences, 6(1):17–39, 1997.
  * [11] Sandeep Bhatkar, Daniel C. DuVarney, and R. Sekar.  Address obfuscation: An efficient approach to combat a broad range of memory error exploits.  In 12th USENIX Security Symposium (USENIX Security 03), Washington, D.C., August 2003. USENIX Association.
  * [12] Ruth Brand.  Microdata protection through noise addition.  In Inference control in statistical databases, pages 97–116. Springer, 2002.
  * [13] Qingqing Cao, Noah Weber, Niranjan Balasubramanian, and Aruna Balasubramanian.  Deqa: On-device question answering.  In Proceedings of the 17th Annual International Conference on Mobile Systems, Applications, and Services, pages 27–40, 2019.
  * [14] Suresh Chari, Josyula R. Rao, and Pankaj Rohatgi.  Template attacks.  In Burton S. Kaliski Jr., Çetin Kaya Koç, and Christof Paar, editors, Cryptographic Hardware and Embedded Systems - CHES 2002, 4th International Workshop, Redwood Shores, CA, USA, August 13-15, 2002, Revised Papers, volume 2523 of Lecture Notes in Computer Science, pages 13–28. Springer, 2002.
  * [15] Sandeep Chinchali, Apoorva Sharma, James Harrison, Amine Elhafsi, Daniel Kang, Evgenya Pergament, Eyal Cidon, Sachin Katti, and Marco Pavone.  Network offloading policies for cloud robotics: a learning-based approach.  arXiv preprint arXiv:1902.05703, 2019.
  * [16] Shujie Cui, Sana Belguith, Ming Zhang, Muhammad Rizwan Asghar, and Giovanni Russello.  Preserving access pattern privacy in sgx-assisted encrypted search.  In 27th International Conference on Computer Communication and Networks, ICCCN 2018, Hangzhou, China, July 30 - August 2, 2018, pages 1–9. IEEE, 2018.
  * [17] Deeksha Dangwal, Weilong Cui, Joseph McMahan, and Timothy Sherwood.  Safer program behavior sharing through trace wringing.  In Iris Bahar, Maurice Herlihy, Emmett Witchel, and Alvin R. Lebeck, editors, Proceedings of the Twenty-Fourth International Conference on Architectural Support for Programming Languages and Operating Systems, ASPLOS 2019, Providence, RI, USA, April 13-17, 2019, pages 1059–1072. ACM, 2019.
  * [18] Saba Eskandarian and Matei Zaharia.  Oblidb: Oblivious query processing using hardware enclaves, 2017.
  * [19] Kevin D. Fairbanks, Christopher P. Lee, and Henry L. Owen III.  Forensic implications of ext4.  In Frederick T. Sheldon, Stacy J. Prowell, Robert K. Abercrombie, and Axel W. Krings, editors, Proceedings of the 6th Cyber Security and Information Intelligence Research Workshop, CSIIRW 2010, Oak Ridge, TN, USA, April 21-23, 2010, page 22. ACM, 2010.
  * [20] Roy Friedman and David Sainz.  File system usage in android mobile phones.  In Proceedings of the 9th ACM International on Systems and Storage Conference, SYSTOR 2016, Haifa, Israel, June 6-8, 2016, pages 16:1–16:11. ACM, 2016.
  * [21] Qian Ge, Yuval Yarom, Tom Chothia, and Gernot Heiser.  Time protection: The missing OS abstraction.  In Proceedings of the Fourteenth EuroSys Conference 2019, Dresden, Germany, March 25-28, 2019, pages 1:1–1:17, 2019.
  * [22] Xinyang Ge, Hayawardh Vijayakumar, and Trent Jaeger.  Sprobes: Enforcing kernel code integrity on the trustzone architecture.  CoRR, abs/1410.7747, 2014.
  * [23] Jon Geater.  Usable hardware security for android on arm devices.  page 35, 2012.
  * [24] Oded Goldreich and Rafail Ostrovsky.  Software protection and simulation on oblivious rams.  J. ACM, 43(3):431–473, 1996.
  * [25] Le Guan, Peng Liu, Xinyu Xing, Xinyang Ge, Shengzhi Zhang, Meng Yu, and Trent Jaeger.  Trustshadow: Secure execution of unmodified applications with arm trustzone.  In Proceedings of the 15th Annual International Conference on Mobile Systems, Applications, and Services, MobiSys ’17, pages 488–501, New York, NY, USA, 2017. ACM.
  * [26] Liwei Guo and Felix Xiaozhu Lin.  Minimum viable device drivers for ARM trustzone.  In Yérom-David Bromberg, Anne-Marie Kermarrec, and Christos Kozyrakis, editors, EuroSys ’22: Seventeenth European Conference on Computer Systems, Rennes, France, April 5 - 8, 2022, pages 300–316. ACM, 2022\.
  * [27] Daniel M. Hein, Johannes Winter, and Andreas Fitzek.  Secure block device - secure, flexible, and efficient data storage for ARM trustzone systems.  In 2015 IEEE TrustCom/BigDataSE/ISPA, Helsinki, Finland, August 20-22, 2015, Volume 1, pages 222–229. IEEE, 2015.
  * [28] Weizhe Hua, Zhiru Zhang, and G. Edward Suh.  Reverse engineering convolutional neural networks through side-channel information leaks.  In Proceedings of the 55th Annual Design Automation Conference, DAC 2018, San Francisco, CA, USA, June 24-29, 2018, pages 4:1–4:6. ACM, 2018\.
  * [29] Sushil Jajodia, Anup K. Ghosh, Vipin Swarup, Cliff Wang, and Xiaoyang Sean Wang, editors.  Moving Target Defense - Creating Asymmetric Uncertainty for Cyber Threats, volume 54 of Advances in Information Security.  Springer, 2011.
  * [30] Bryan Klimt and Yiming Yang.  The enron corpus: A new dataset for email classification research.  In Jean-François Boulicaut, Floriana Esposito, Fosca Giannotti, and Dino Pedreschi, editors, Machine Learning: ECML 2004, 15th European Conference on Machine Learning, Pisa, Italy, September 20-24, 2004, Proceedings, volume 3201 of Lecture Notes in Computer Science, pages 217–226. Springer, 2004.
  * [31] Changman Lee, Dongho Sim, Jooyoung Hwang, and Sangyeun Cho.  F2fs: A new file system for flash storage.  In 13th USENIX Conference on File and Storage Technologies (FAST 15), pages 273–286, Santa Clara, CA, 2015. USENIX Association.
  * [32] Eunji Lee, Hyokyung Bahn, and Sam H. Noh.  Unioning of the buffer cache and journaling layers with non-volatile memory.  In Keith A. Smith and Yuanyuan Zhou, editors, Proceedings of the 11th USENIX conference on File and Storage Technologies, FAST 2013, San Jose, CA, USA, February 12-15, 2013, pages 73–80. USENIX, 2013.
  * [33] Kisung Lee and Youjip Won.  Smart layers and dumb result: IO characterization of an android-based smartphone.  In Ahmed Jerraya, Luca P. Carloni, Florence Maraninchi, and John Regehr, editors, Proceedings of the 12th International Conference on Embedded Software, EMSOFT 2012, part of the Eighth Embedded Systems Week, ESWeek 2012, Tampere, Finland, October 7-12, 2012, pages 23–32. ACM, 2012\.
  * [34] Donald Lewine.  POSIX programmers guide.  ” O’Reilly Media, Inc.”, 1991.
  * [35] Lanyue Lu, Andrea C. Arpaci-Dusseau, Remzi H. Arpaci-Dusseau, and Shan Lu.  A study of linux file system evolution.  Trans. Storage, 10(1):3:1–3:32, January 2014.
  * [36] Aravind Menon, Simon Schubert, and Willy Zwaenepoel.  Twindrivers: semi-automatic derivation of fast and safe hypervisor network drivers from guest OS drivers.  In Mary Lou Soffa and Mary Jane Irwin, editors, Proceedings of the 14th International Conference on Architectural Support for Programming Languages and Operating Systems, ASPLOS 2009, Washington, DC, USA, March 7-11, 2009, pages 301–312. ACM, 2009.
  * [37] Mozilla.  Clamp the resolution of performance.now() calls to 5us, 2015.
  * [38] Edmund B. Nightingale and Jason Flinn.  Energy-efficiency and storage flexibility in the blue file system.  In Eric A. Brewer and Peter Chen, editors, 6th Symposium on Operating System Design and Implementation (OSDI 2004), San Francisco, California, USA, December 6-8, 2004, pages 363–378. USENIX Association, 2004\.
  * [39] Heejin Park, Shuang Zhai, Long Lu, and Felix Xiaozhu Lin.  Streambox-tz: Secure stream analytics at the edge with trustzone.  In Dahlia Malkhi and Dan Tsafrir, editors, 2019 USENIX Annual Technical Conference, USENIX ATC 2019, Renton, WA, USA, July 10-12, 2019, pages 537–554. USENIX Association, 2019.
  * [40] Vijayan Prabhakaran, Andrea C. Arpaci-Dusseau, and Remzi H. Arpaci-Dusseau.  Analysis and evolution of journaling file systems.  In Proceedings of the 2005 USENIX Annual Technical Conference, April 10-15, 2005, Anaheim, CA, USA, pages 105–120. USENIX, 2005.
  * [41] Christian Priebe, Divya Muthukumaran, Joshua Lind, Huanzhou Zhu, Shujie Cui, Vasily A. Sartakov, and Peter Pietzuch.  SGX-LKL: Securing the host OS interface for trusted execution.  2020\.
  * [42] ROS developers.  Ros: Recording and playing back data.  http://wiki.ros.org/Bags/Format, 2020.
  * [43] Nuno Santos, Himanshu Raj, Stefan Saroiu, and Alec Wolman.  Using ARM trustzone to build a trusted language runtime for mobile applications.  In Architectural Support for Programming Languages and Operating Systems, ASPLOS ’14, Salt Lake City, UT, USA, March 1-5, 2014, pages 67–80, 2014.
  * [44] Pravin Shankar, Vinod Ganapathy, and Liviu Iftode.  Privately querying location-based services with sybilquery.  In UbiComp 2009: Ubiquitous Computing, 11th International Conference, UbiComp 2009, Orlando, Florida, USA, September 30 - October 3, 2009, Proceedings, pages 31–40, 2009.
  * [45] Takahiro Shinagawa, Hideki Eiraku, Kouichi Tanimoto, Kazumasa Omote, Shoichi Hasegawa, Takashi Horie, Manabu Hirano, Kenichi Kourai, Yoshihiro Oyama, Eiji Kawai, Kenji Kono, Shigeru Chiba, Yasushi Shinjo, and Kazuhiko Kato.  Bitvisor: a thin hypervisor for enforcing i/o device security.  In Antony L. Hosking, David F. Bacon, and Orran Krieger, editors, Proceedings of the 5th International Conference on Virtual Execution Environments, VEE 2009, Washington, DC, USA, March 11-13, 2009, pages 121–130. ACM, 2009.
  * [46] Shweta Shinde, Dat Le Tien, Shruti Tople, and Prateek Saxena.  Panoply: Low-TCB linux applications with SGX enclaves.  In Proceedings 2017 Network and Distributed System Security Symposium. Internet Society, 2017.
  * [47] Shweta Shinde, Shengyi Wang, Pinghai Yuan, Aquinas Hobor, Abhik Roychoudhury, and Prateek Saxena.  Besfs: A POSIX filesystem for enclaves with a mechanized safety proof.  In Srdjan Capkun and Franziska Roesner, editors, 29th USENIX Security Symposium, USENIX Security 2020, August 12-14, 2020, pages 523–540. USENIX Association, 2020.
  * [48] Emil Stefanov, Marten van Dijk, Elaine Shi, Christopher W. Fletcher, Ling Ren, Xiangyao Yu, and Srinivas Devadas.  Path ORAM: an extremely simple oblivious RAM protocol.  In 2013 ACM SIGSAC Conference on Computer and Communications Security, CCS’13, Berlin, Germany, November 4-8, 2013, pages 299–310, 2013.
  * [49] Madhav Suresh, Zuohao She, William Wallace, Adel Lahlou, and Jennie Rogers.  Kloakdb: A platform for analyzing sensitive data with k-anonymous query processing.  CoRR, abs/1904.00411, 2019.
  * [50] Latanya Sweeney.  K-anonymity: A Model for Protecting Privacy.  International Journal of Uncertainty, Fuzziness and Knowledge-Based Systems, 10(05):557–570, 2002.
  * [51] Chia-che Tsai, Donald E. Porter, and Mona Vij.  Graphene-sgx: A practical library OS for unmodified applications on SGX.  In 2017 USENIX Annual Technical Conference, USENIX ATC 2017, Santa Clara, CA, USA, July 12-14, 2017., pages 645–658, 2017.
  * [52] Bhanu C. Vattikonda, Sambit Das, and Hovav Shacham.  Eliminating fine grained timers in xen.  In Proceedings of the 3rd ACM workshop on Cloud computing security workshop, CCSW ’11, pages 41–46. Association for Computing Machinery, 2011.
  * [53] David Wheeler.  Sloccount.  http://www. dwheeler. com/sloccount/, 2001.
  * [54] Yuanzhong Xu, Weidong Cui, and Marcus Peinado.  Controlled-channel attacks: Deterministic side channels for untrusted operating systems.  In Proceedings of the 2015 IEEE Symposium on Security and Privacy, SP ’15, pages 640–656, Washington, DC, USA, 2015. IEEE Computer Society.
  * [55] Ming-Chang Yang, Yu-Ming Chang, Che-Wei Tsao, Po-Chun Huang, Yuan-Hao Chang, and Tei-Wei Kuo.  Garbage collection and wear leveling for flash memory: Past and future.  In International Conference on Smart Computing, SMARTCOMP 2014, Hong Kong, China, November 3-5, 2014, pages 66–73. IEEE Computer Society, 2014.
  * [56] Mengmei Ye, Jonathan Sherman, Witawas Srisa-an, and Sheng Wei.  Tzslicer: Security-aware dynamic program slicing for hardware isolation.  In 2018 IEEE International Symposium on Hardware Oriented Security and Trust, HOST 2018, Washington, DC, USA, April 30 - May 4, 2018, pages 17–24, 2018.
  * [57] Min Hong Yun and Lin Zhong.  Ginseng: Keeping secrets in registers when you distrust the operating system.  In 26th Annual Network and Distributed System Security Symposium, NDSS 2019, San Diego, California, USA, February 24-27, 2019. The Internet Society, 2019.
  * [58] Wenting Zheng, Ankur Dave, Jethro G. Beekman, Raluca Ada Popa, Joseph E. Gonzalez, and Ion Stoica.  Opaque: An oblivious and encrypted distributed analytics platform.  In 14th USENIX Symposium on Networked Systems Design and Implementation, NSDI 2017, Boston, MA, USA, March 27-29, 2017, pages 283–298, 2017.


# Rebuttal of Morris’ criticism of the diffusive compressible Euler model

Magnus Svärd  Dept. of Mathematics, University of Bergen, P.O. Box 7803, 5020
Bergen, Norway,
<EMAIL_ADDRESS>
###### Abstract

This short note addresses the criticism of the diffusive compressible Euler
model regarding heat diffusion, sound attenuation and material frame
indifference put forward by M. Morris.

##  1 The model

The diffusive compressible Euler (dcE) model (previously Eulerian model) is
given by,

$\displaystyle\partial_{t}\rho+\nabla\cdot(\rho{\bf v})$
$\displaystyle=\nabla\cdot(\nu\nabla\rho),$ (1a)
$\displaystyle\partial_{t}(\rho{\bf v})+\nabla\cdot(\rho{\bf v}\otimes{\bf
v})+\nabla p$ $\displaystyle=\nabla\cdot(\nu\nabla\rho{\bf v}),\qquad
t\in[0,\mathcal{T}]$ (1b) $\displaystyle\partial_{t}(E)+\nabla\cdot(E{\bf
v}+p{\bf v})$ $\displaystyle=\nabla\cdot(\nu\nabla
E)+\nabla\cdot(\kappa_{T}\nabla T),$ (1c) $\displaystyle p$
$\displaystyle=\rho RT,\quad\textrm{ideal gas law,}$ (1d)

where $\rho,\rho{\bf v},E,p,T$ are density, momentum, total energy, pressure
and temperature. Furthermore, ${\bf v}=(u,v,w)$ is the velocity vector,
$\gamma=c_{p}/c_{v}$ where $c_{p,v}$ are the heat capacities at constant
pressure or volume. For ideal gases $1<\gamma\leq 5/3$. The total energy
satisfies $E=\frac{p}{\gamma-1}+\frac{\rho|{\bf v}|^{2}}{2}$. Furthermore, $R$
is the gas constant, $\nu=\nu(\rho,T)$ the diffusion coefficient and
$\kappa_{T}$ the heat diffusion coefficient. In the original model ([Svä18])
$\kappa_{T}$ was not included, i.e., $\kappa_{T}=0$. In its current form the
diffusive coefficients take the values ([Svä24]),

$\displaystyle\nu=\frac{\mu}{\rho},\quad\quad\kappa_{T}=\frac{\mu
c_{p}}{Pr}(1-Pr)$ (2)

where $\mu$ is the value of the dynamic viscosity and $Pr$ is the Prandtl
number.

######  Remark 1.

Although $\mu$ takes the _value_ of the dynamic viscosity, the $\nu$ terms do
not model viscosity. They model diffusion.

######  Remark 2.

Note that $\nu$ and $\kappa_{T}$ in the dcE model, or $\mu$ and $\kappa$ in
the NSF model, are not fundamental constants of nature but model-specific
parameters associated with constitutive laws. These parameters can not be
measured directly but the associated system must be solved (often
approximately) for the experimental setup and the parameters optimised to make
the (approximate) solutions match the available data. (See [AAVW23] for a
discussion on heat conduction.)

######  Remark 3.

In order to prove the existence of weak solutions to (1), the $\nu$ and
$\kappa_{T}$ had to be augmented with some extra terms ([Svä22]). These terms
may be considered technical assumptions and can be taken suitably small. The
values given in (2) are the important ones with respect to modelling.

Throughout, I make the distinction between diffusion, i.e., the transport by
random movements, and conduction, i.e., the transfer of momentum and internal
energy by collisions without molecules changing their relative positions. In
gases, where the mean free path is far greater than the size of the molecules,
diffusion is the dominating mechanism for random transport.

In [Svä18], it is stated that the model is derived for compressible and
diffusive (viscous and heat conductive) ideal gases. It can be expected to be
accurate for the same range of Knudsen numbers as the compressible Navier-
Stokes-Fourier (NSF) system.

I have used “viscous and heat conductive” in the description of (1) to
emphasise that it models the same types of gases as the viscous and heat
conductive compressible Navier-Stokes equations. However, (1) does not model
viscosity. In fact, there is a long discussion on the stress tensor and its
role in the Navier-Stokes equations in [Svä18], that serves to emphasise the
change of paradigms that subsequently leads to (1).

As the NSF system, the dcE model can for practical purposes be used
effectively for gases that are close to ideal, such as air, [DS21, SDP21b,
SDP21a, SM23, Svä24]. Under normal flow conditions the effects from a real gas
law (e.g. van der Waal’s), or temperature dependent viscosity, heat conductive
coefficients and specific heats are often small. In shocks, however, they may
have significant effects and their inclusion will improve the results
([SM23]). In this respect, the dcE model is no different from the NSF.

##  2 Initial remarks

All models, new and old, should be subject to a critical examination. This
sharpens arguments supporting the model; it may lead to improvements of the
model and it highlights its limitations. This is what led me to consider
alternatives to the NSF system and my proposition for a new model should of
course be scrutinised in the same way.

Although, this is probably evident to the readership, I remind that scientific
criticism should abide by the usual scientific rules. As the bare minimum, the
most recent model/theory should be considered, misrepresentations avoided and
range of validity acknowledged. One should also be careful not to extrapolate
arguments and criticisms beyond their validity ranges. Selective use of
evidence should be avoided. Scientific disagreements should be acknowledged
and one side should not be presented as the consensus.

I did not intend to respond to the stream of Morris’ critical reports on
ResearchGate. (That would require a substantial part of my research time.) I
have already responded to most of the criticism regarding noble and polyatomic
gases in [SM23, Svä24] and updated the model to include the $\kappa_{T}$ term.
However, since there is now a critical paper published in a scientific journal
([Mor24a]), I am forced to address its inaccuracies. I also take the
opportunity to address other recent re-iterations and extrapolations of
Morris’ previous arguments, as well as a new attempt to debunk the dcE model.

##  3 Heat transfer

In [Mor24a], Morris claims that the dcE model “substantially underestimates
the magnitude of the heat flux in gases”. To support this criticism of the dcE
model, Morris considers the, at the time superseded, model with
$\kappa_{T}=0$. Already in [SM23], it was tentatively proposed that the
$\kappa_{T}$ term should be included. A physical rationale for its presence
was given and a value was proposed for noble gases. In [Svä23, Svä24], the
heat diffusion for the dcE model was studied and the correction was confirmed
and generalised to non-noble gases. In its current form, the dcE system (1)
models heat transfer as accurately as the NSF model for gases.

Furthermore, Morris goes on and claims that the dcE model fails to predict
heat conduction in water. This criticism is irrelevant since the dcE system
does not model liquids. (In liquids, the mean free path is of the same order
as the size of the molecules. Hence, conduction, rather than diffusion, is the
major mechanism for random transport.)

##  4 Sound attenuation

In [Mor24b], the accuracy of (1) with respect to extremely high-frequency
ultrasound experiments was criticised. Once again, Morris chooses, rather
inexplicably, to include the superseded model with $\kappa_{T}=0$ along with
the current model.

For the current model, with the diffusive coefficients given in (2), Morris
finds that it reproduces the sound attenuation experiments for _noble gases_ ,
just as accurately as the NSF model does.

For real gases, $N_{2},O_{2}$ and dry air, Morris observes a mismatch between
the sound attenuation coefficient for the (linearised) dcE model and
experimental values. Furthermore, Morris claims that the NSF system perfectly
predicts the sound attenuation. This is achieved by _choosing_ the bulk
viscosity in the NSF to obtain an exact match with the experimental sound
attenuation coefficient. Since there is no parameter left to choose in the dcE
model, this trick can not be done and therefore, according to Morris, the dcE
model is incorrect.

This line of argumentation contains a number of statements and assumptions
that requires further scrutiny.

Bulk viscosity: _The bulk viscosity is not accurately known_ , which is
recognised by Morris in [Mor24b]. A common choice for the bulk viscosity, that
gives good agreement with data in aerodynamic experiments, is given by Stokes’
hypothesis. For that choice of bulk viscosity, the NSF system is slightly
_worse_ (about 6% [Svä24]) than the dcE model, for these extremely high-
frequency ultrasound attenuation experiments.

Whether or not Stokes’ hypothesis is correct for diatomic gases has
justifiably been questioned in the literature. Nevertheless, the choice made
in [Mor24b] to demonstrate the superiority of the NSF over the dcE model can
hardly be considered to represent the current scientific consensus.
Furthermore, the effects of this choice with respect to other, less extreme,
validation experiments need to be evaluated.

Polyatomic gases: Morris terms $N_{2},O_{2},CH_{4}$ and air as, polyatomic
_ideal gases_. Here, one needs to be a bit more specific. Under normal
conditions they are certainly very close to ideal. That is why both the NSF
and dcE produce accurate aerodynamic results with ideal gas approximations of
the fluid parameters. (Recall that in an ideal gas, molecules bounce
elastically and the system does not exchange energy with the rotational or
vibrational modes of the molecules.)

The paper [BCF92] contains a discussion on the very high frequency sound
experiments that Morris uses for validation of the linearised flow models.
Here, I will draw the attention to a few statements. First, “[the absorption]
depends on the amplitude of the waves”. This was also noted in [SM23], where
very accurate numerical experiments were carried out. Only for extremely small
amplitudes were the absorption coefficients calculated from the linearised
equations recovered. For slightly higher amplitudes the actual absorption was
higher than the linear prediction, due to non-linear effects in the full non-
linear systems. (This applies both to the NSF and dcE models.) To allow for an
estimate of the significance of this type of error, the amplitudes used in
experiments must be known.

Furthermore, Bond et al. [BCF92] identify the following contributions to the
absorption coefficient $\alpha=\alpha_{cl}+\alpha_{rot}+\alpha_{vib}$.
$\alpha_{cl}$ is the coefficient obtained from classical theory, i.e., the
linearised NSF (or here the linearised dcE model). $\alpha_{rot}$ and
$\alpha_{vib}$ are the contributions from the rotational and vibrational
modes. If $\alpha_{rot}$ and $\alpha_{vib}$ are both close to zero, the gas
behaves as an ideal gas.

However, with $f$ being the sound frequency and $p$ the ambient pressure, it
is stated in [BCF92] that for $f/p>10Hz/Pa$, rotational relaxation phenomena
may become important. That is, the gas is no longer ideal. The experiments
Morris refers to are exceeding this limit. For monatomic gases, this is not a
problem since they do not have rotational or vibrational modes that may store
significant energy. Hence, the gas is essentially ideal and both the NSF and
dcE accurately predict the absorption coefficient. For diatomic gases, the
$f>1MHz$ experiments (at atmospheric pressure) excite rotational modes and the
results deviate from the classical absorption coefficients. Furthermore,
$CH_{4}$ has more internal modes that can store energy than $N_{2}$ and
$O_{2}$, which distorts the coefficient further away from $\alpha_{cl}$. This
explains why both the dcE model and the NSF model (without Morris’ specific
choice of bulk viscosity) underpredicts the actual attenuation coefficient for
polyatomic gases. Both models are outside of their (close to) ideal gas
regime. Notably, it is not suggested in [BCF92] that the bulk viscosity in the
NSF is chosen so as to compensate for the deviation from the measured
absorption coefficient.

Nevertheless, bulk viscosity could be argued to model the energy interchange
with rotational and vibrational modes in gases. If so, Morris’ choice will
indeed improve the models ability to reproduce sound attenuation at extremely
high frequencies. However, this choice must then also be shown not to
interfere with other aerodynamic validation cases, as well as attenuation at
frequencies just below that where rotational modes are excited.

Liquids: Morris is also using sound attenuation data for various liquids
(water, mercury, benzene) in an attempt to falsify (1). I repeat: the system
(1) is not a model for liquids.

Summary: Morris states that “the dcE model fails to model sound wave
attenuation in general fluids with physical accuracy” ([Mor24b]). As I have
shown above, this short statement is incorrect on at least two accounts.
First, the dcE model is not valid for “general fluids”. In particular, it is
not valid for liquids; it is currently valid for essentially ideal gases.
Second, contrary to Morris’ claim, _the dcE system does model sound
attenuation as accurately as the NSF model when the gas behaves in a close to
ideal way_. None of Morris’ deliberations invalidate the dcE model under
normal conditions. Not even with respect to sound attenuation for very high
(but not extremely high) frequencies.

In [BCF92], the complexity of ultra sound absorption for polyatomic gases (at
very high to extreme frequencies) is discussed at length and there are many
mechanisms beyond the classical (viscosity and heat conduction) that affect
the absorption. Hence, it seems difficult to justify that Morris’ specific
choice of bulk viscosity is the one that accounts for all the remaining
frequency-dependent absorption mechanisms that influence the total absorption.
This may be part of the reason why the bulk viscosity has not yet been
decisively determined.

Nevertheless, even for these extreme frequencies, there is not a significant
difference between the dcE model and standard versions of the NSF.

######  Remark 4.

The update of the model in [SM23] was tentative since we had only investigated
one data set (attenuation) and the experimental accuracy as well as the sound-
wave amplitudes were not disclosed ([Gre56]). (It was not common at the time
of these experiments to report experimental errors.) With heat-diffusion data
also pointing to the same correction ([Svä24]) for noble gases, I could
conclude that the model should be updated with the extra $\kappa_{T}$ term. Of
course, this also means that the old sound attenuation measurements are
accurate, but for polyatomic gases there is still an ambiguity regarding what
physical phenomena they record.

##  5 Material frame indifference

In classical physics, Galilean invariance is a fundamental principle. It
requires that the equations of motion take the same form in any inertial
frame.

Material frame indifference (MFI) is the notion that constitutive relations
for materials take the same form in _any_ frame of reference. The concept of
MFI (or material objectivity) has been debated intensely for many decades. Not
only if it is a generally valid physical principle, but also what it even
means. See [Fre09] for a historical review. The review ends with a summary of
the consensus that “for solids and ordinary dense fluids the MFI-principle is
a reasonable approximation to reduce constitutive equations.” and “This is no
longer the case…if the mean free path length in the microprocesses gets longer
as in gases and rarefied gases.” Since (1) is a model for gases, it is thus
far from obvious that its constitutive laws should satisfy the MFI-principle.

Nevertheless, I will address the specific criticism put forward in [Mor23].
There, Morris recasts the diffusive terms into something resembling viscous
terms and proceeds to show that this construct is not invariant with respect
to accelerating reference frames, and conclude that (1) is frame dependent.

There is, however, a major logical flaw. _Material indifference concerns
constitutive laws that appear in the model. No constitutive law for viscous
stresses is used in ( 1)._ The model (1) is derived from conservation
principles and the parabolic terms in (1) model diffusion.

Furthermore, if the actual constitutive laws are considered, i.e., the
diffusive fluxes, they all take the same form as Fourier’s law. Hence, and
contrary to Morris’ claim, _the constitutive laws of ( 1) are indeed frame
indifferent_ ([Wan99]).

######  Remark 5.

One of the main points in the physical framework leading to (1) is the
rejection of the view that gases should be viewed as a continuum of
infinitesimal mass particles and that a force balance for the mass particles
should be used to derive the governing equations. The mass particle view is
what leads to the inclusion of a stress tensor in the NSF. In a gas, diffusion
gives rise to viscous stresses, but in (1) diffusion is modelled directly
which voids the need for the viscous stress tensor.

##  6 Final remarks

In her most recent reports, Morris criticises

  * •

the superseded dcE model despite an updated one being available.

  * •

the dcE system for not modelling liquids despite it being a model for gases.

  * •

the dcE system for not being frame indifferent with respect to some viscosity-
resembling construct that is not a constitutive law in the model. (The actual
constitutive laws in the dcE model are frame indifferent.)

  * •

the dcE system for not being accurate for extremely high frequency sound waves
despite them being outside its (current) validity range. However, this was not
enough to further the notion that the dcE model is flawed, since standard
versions of the NSF can not accurately model such sound waves either. To be
able to criticise the dcE model, Morris also had to tweak the NSF system such
that it, “by design” as Morris puts it ([Mor24b]), is perfectly accurate.

In this note, I have addressed and rebutted Morris’ criticism, and in doing so
I also hope that I have shed some light on the methods that Morris uses in her
attempts to falsify the dcE model.

The NSF system has been fine tuned for almost two centuries, by researchers
who strived to improve the model and make it useful. Yet there are still
aspects that are unclear, including the role and value of the bulk viscosity.
(See [Svä18] for other quirks with the NSF system.) From a
computational/mathematical perspective, the NSF system is very challenging,
and this is a consequence of the mass element approach in its derivation. A
clear advantage of the dcE model is its weak well-posedness allowing it to be
solved numerically much more efficiently and reliably.

Finally, the model (1) is work in progress and the current version does not
account for (strongly) non-ideal behaviour of the gas. That does not mean that
it is impossible to augment the dcE system further to improve the modelling of
non-ideal effects. However, the dcE model is not, and probably never will be,
a model for liquids, since the underlying physics is fundamentally different.

## References

  * [AAVW23] M. J. Assael, K. D. Antoniadis, D. Velliadou, and W. A. Wakeham.  Correct use of the transient hot-wire technique for thermal conductivity measurements on fluids.  International Journal of Thermophysics, 44:1–19, 2023.
  * [BCF92] L. J. Bond, C.-H. Chiang, and C. M. Fortunko.  Absorption of ultrasonic waves in air at high-frequencies (10-20Mhz).  J. Acoust. Soc. Am., 92(4):2006–2015, 1992.
  * [DS21] V. Dolejší and M. Svärd.  Numerical study of two models for viscous compressible fluid flows.  J. Comp. Phys, 427:110068, 2021.
  * [Fre09] M. Frewer.  More clarity on the concept of material frame-indifference in classical continuum mechanics.  Acta Mech., 202:213–246, 2009.
  * [Gre56] Martin Greenspan.  Propagation of sound in five monatomic gases.  The Journal of the Acoustical Society of America, 28(4):644–648, 1956.
  * [Mor23] M. Morris.  A study of Svärd’s Eulerian flow model in moving reference frames.  Downloaded June 2024: https://www.researchgate.net/publication/374417555, 2023.
  * [Mor24a] M. Morris.  Heat conduction in a new eulerian flow model.  Archives of Mechanics, 76, 2024.
  * [Mor24b] M. Morris.  A study of sound attenuation in the diffusive compressible Euler model.  ResearchGate. Downloaded June 12, 2024., 2024.
  * [SDP21a] M. Sayyari, L. Dalcin, and M. Parsani.  Development and analysis of entropy stable no-slip wall boundary conditions for the Eulerian model for viscous and heat conducting compressible flows.  Partial Differential Equations and Applications, 2:1:77–27:77, 2021\.
  * [SDP21b] M. Sayyari, L. Dalcin, and M. Parsani.  Entropy stable no-slip wall boundary conditions for the Eulerian model for viscous and heat conducting compressible flows.  In AIAA-paper AIAA 2021-1662, AIAA Scitech 2021 Forum", 2021.
  * [SM23] M. Svärd and K. Munthe.  A study of the diffusive properties of a modified compressible Navier-Stokes model.  Meccanica, 58:1083–1097, 2023.
  * [Svä18] M. Svärd.  A new Eulerian model for viscous and heat conducting compressible flows.  Physica A, 506:350–375, 2018.
  * [Svä22] M. Svärd.  Analysis of an alternative Navier-Stokes system: Weak entropy solutions and a convergent numerical scheme.  M3AS, 32(13):2601–2671, 2022.
  * [Svä23] M. Svärd.  Refining the Eulerian flow model.  Technical report, arXiv, 2023.
  * [Svä24] M. Svärd.  Refining the diffusive compressible Euler model.  Physica A, 635, 2024.
  * [Wan99] L. Wang.  A general theory of diffusion.  Progress of Theoretical Physics, 101(3):541–557, 1999.