Scalable security for petascale parallel file systems
- 10 November 2007
- proceedings article
- Published by Association for Computing Machinery (ACM)
Abstract
Petascale, high-performance file systems often hold sensitive data and thus require security, but authentication and authorization can dramatically reduce performance. Existing security solutions perform poorly in these environments because they cannot scale with the number of nodes, highly distributed data, and demanding workloads. To address these issues, we developed Maat, a security protocol designed to provide strong, scalable security to these systems. Maat introduces three new techniques. Extended capabilities limit the number of capabilities needed by allowing a capability to authorize I/O for any number of client-file pairs. Automatic Revocation uses short capability lifetimes to allow capability expiration to act as global revocation, while supporting non-revoked capability renewal. Secure Delegation allows clients to securely act on behalf of a group to open files and distribute access, facilitating secure joint computations. Experiments on the Maat prototype in the Ceph petascale file system show an overhead as little as 6--7%.Keywords
Funding Information
- Division of Computing and Communication Foundations (CCF-0621463)
- U.S. Department of Energy (DE-FC03-06ER25768)
This publication has 11 references indexed in Scilit:
- Scalable security for large, high performance storage systemsPublished by Association for Computing Machinery (ACM) ,2006
- The OSD Security ProtocolPublished by Institute of Electrical and Electronics Engineers (IEEE) ,2006
- Formal Analysis of Dynamic, Distributed File-System Access ControlsPublished by Springer Nature ,2006
- Secure capabilities for a petabyte-scale object-based distributed file systemPublished by Association for Computing Machinery (ACM) ,2005
- Security vs Performance: Tradeoffs using a Trust FrameworkPublished by Institute of Electrical and Electronics Engineers (IEEE) ,2005
- The Panasas ActiveScale Storage Cluster - Delivering Scalable High Bandwidth StoragePublished by Institute of Electrical and Electronics Engineers (IEEE) ,2004
- The Google file systemPublished by Association for Computing Machinery (ACM) ,2003
- File access prediction with adjustable accuracyPublished by Institute of Electrical and Electronics Engineers (IEEE) ,2003
- A cost-effective, high-bandwidth storage architecturePublished by Association for Computing Machinery (ACM) ,1998
- Scale and performance in a distributed file systemACM Transactions on Computer Systems, 1988