Print-Time Audit-Log Integrity Below the Operating System

Abstract

An audit log is written by the very host an attacker sets out to compromise. Between the instant a record is produced and the instant it becomes immutable lies a race window in which a host-root adversary can delete or rewrite it, and the forensic record is exactly what the attacker edits first. Tamper-evident logging and trusted execution environment (TEE)-backed logging shrink the host’s trusted base but keep the host on the write path, so the window persists: a record still crosses untrusted host memory before anything seals it. We argue audit integrity should be enforced at print time, below the OS, on the computational storage device or data processing unit (DPU) where the record physically lands—a trust domain outside the scope of a host compromise. With a synchronous typed submission path, each record is bound to its delivered kernel-stamped identity and appended to a device-sealed, tamper-evident log under a key the host never sees. This moves the post-submission trust boundary off-host while making host submission latency explicit. The crux is a semantic gap: the device sees blocks, not records; we argue it can be bridged by carrying kernel-stamped fields across a thin typed interface, and we set out the research agenda.