【作者】 李良刚；

【导师】 周敬利；

【作者基本信息】 华中科技大学 ， 计算机系统结构， 2007， 硕士

【摘要】 对象存储是存储领域新兴的发展趋势,它综合了SAN和NAS的优点,同时具有SAN的高速直接访问和NAS的数据共享等优势。与传统存储系统比较,实验证明对象存储是一种具有高性能、高可靠性、跨平台以及安全的数据共享的存储体系结构。然而,因为网络技术的体系结构具有一定的开放性,必须采用必要的措施来保证对象存储系统的高可靠性和安全性。系统的可靠性以可靠度和可用度来衡量,其中系统的可靠度函数服从指数分布规律,这是可靠性建模和分析的基础。容错和除错是提高系统可靠性的两种比较好的方法,低密度奇偶校验码(Low-Density Parity-Check code,LDPC)是一种高效的纠错编码,它把k个源数据编码为n(n>k)个数据,用这n个数据中任意k个编码数据均可重构原来的k个源数据。将这一高效的编码运用于对象存储系统中,从分析对象存储文件系统入手,实现了Linux Client端LDPC码的编解码,设计了OSD端对象的放置策略,以及在MDS端添加了部分元数据信息。通过理论分析得出了这种冗余方案对提高系统可靠性更有优势:要使数据达到相同的可用性,基于LDPC码方案只需要较低的冗余度;同样在相同的冗余度情况下,基于LDPC码冗余方案的数据有更高的可用性。在对象存储系统现有的几种安全方案中,客户机要么访问每个对象都请求一个能力钥(capability key),要么需要获得一个身份钥(identity key)。然而这两种方案中后者使得撤销十分困难;前者所需要的密钥数量太大,同时客户机需要频繁地访问元数据服务器以获得密钥,这大大加重了元数据服务器的处理和计算负荷,而且使它成为重要的攻击目标。因此研究了一种新颖的基于角色访问控制的对象存储访问控制和认证机制,从理论上分析了它可以抵御多种网络攻击,并提供客户和OSD之间的相互认证,同时也克服了现有方案中所需的密钥数量大和元数据服务器负荷重的缺陷。更多还原

【Abstract】 Object-Based Storage(OBS) is a new emerging development tendency in storage field,which combines the advantages of the Storage Area Network(SAN) and Network Attached Storage(NAS),has the superiority of SAN’s high-speed direct access and NAS’s data sharing. Compared with the traditional storage systems, the experiment has proved OBS is a high-performance, high reliability, cross-platform data sharing and security of the storage structure. However,because network technology’s architecture is somewhat opening,measure is necessary to ensure OBS system’s high reliabiity and security.Systemic reliability is measured by reliability and availability,where systemic reliability function obeys exponential distribution,which is the basis of modeling and analyzing reliability in this thesis.Fault Tolerance and Error Removal are two better ways to improve the reliability of the system.Low-Density Parity-Check(LDPC) code is a highly efficient fault-tolerant coding, which encodes k-source data into n (n>k) of the data, using the arbitrary k data can reconstruct the original k data sources. By applying this highly efficient coding method to OBS system, the technology of encoding&decoding of LDPC is realized on Linux Client,LDPC-based objects distribution model is designed on OSD, and some meta data information is added in Meta Data Servers. The theoretical analysis concludes this redundancy scheme to enhance system reliability has more advantages: to obtain the same availability of data, LDPC code-based needs only lower edundancy degree;also in the same degree of redundancy, the scheme based on LDPC code has higher availability.In the existing security schemes of OBS,a client either acquires a capability key for each object or an identity key from the Meta Data Server(MDS).Use of identity keys makes revocation difficult whereas,in the prior case,client needs to acquire a large number of keys.The client has to frequently contact the MDS to acquire a key for each object that he wants to access. This imposes a lot of overhead on the file manager, which also presents a single point of failure and an attractive attack target.So we research a novel mechanism of access control and authentication based on Role-Based Access Control for OBS.This scheme is robust against many networks attacks on theory and provides client to OSD mutual authentication.Besides,it reduces the total cryptographic keys of the existing schemes and the load on the MDS.更多还原