A two layered approach for securing an object store network

A. Azagury, R. Canetti, M. Factor, S. Halevi, E. Henis, D. Naor, N. Rinetzky, O. Rodeh, J. Satran

Research output: Chapter in Book/Report/Conference proceedingConference contributionpeer-review

25 Scopus citations

Abstract

Storage Area Networks (SAN) are based on direct interaction between clients and storage servers. This unmediated access exposes the storage server to network attacks, necessitating a verification, by the server, that the client requests conform with the system protection policy. Solutions today can only enforce access control at the granularity of entire storage servers. This is an outcome of the way storage servers abstract storage: an array of fixed size blocks. Providing access control at the granularity of blocks is infeasible there are too many active blocks in the server of entire servers is used. Object, stores (e.g, the NASD system) on the other hand provide means to address these issues. An object store control unit presents an abstraction of a dynamic collection of objects, each can be seen as a different array of blocks, thus providing the basis for Protection at the object level. In this paper we present a security model for the object store which leverages on existing security infrastructure. We give a simple generic mechanism capable of enforcing an arbitrary access control policy at object granularity. This mechanism is specifically designed to achieve low overhead by minimizing the cost of validating an operation along the critical data path, and lends itself for optimizations such as caching The key idea of the model is to separate the mechanisms for transport security from the one used for access control and to maximize the use standard security protocols when possible We utilize a standard industry protocol for authentication, integrity and privacy on the communication channel (IPSec for IP networks) anti fine a proprietary protocol for authorization on top of the secure communication layer.

Original languageEnglish
Title of host publicationProceedings - 1st International IEEE Security in Storage Workshop, SISW 2002
PublisherInstitute of Electrical and Electronics Engineers Inc.
Pages10-23
Number of pages14
ISBN (Electronic)0769518885, 9780769518886
DOIs
StatePublished - 2003
Externally publishedYes
Event1st International IEEE Security in Storage Workshop, SISW 2002 - Greenbelt, United States
Duration: 11 Dec 2002 → …

Publication series

NameProceedings - 1st International IEEE Security in Storage Workshop, SISW 2002

Conference

Conference1st International IEEE Security in Storage Workshop, SISW 2002
Country/TerritoryUnited States
CityGreenbelt
Period11/12/02 → …

Keywords

  • Object Store Device
  • SAN
  • Storage Security

Fingerprint

Dive into the research topics of 'A two layered approach for securing an object store network'. Together they form a unique fingerprint.

Cite this