A Two Layered Approach for Securing an Object Store Network

Reference: 1st International IEEE Security in Storage Workshop (SISW 2002)

Abstract: Storage Area Networks (SAN) are based on direct interaction between clients and storage servers. This unmediated access exposes the storage server to network attacks, necessitating a verification, by the server, that the client requests conform with the system protection policy. Solutions today can only enforce access control at the granularity of entire storage servers. This is an outcome of the way storage servers abstract storage: an array of fixed size blocks. Providing access control at the granularity of blocks is infeasible -- there are too many active blocks in the server. Thus, the coarse granularity of entire servers is used. Object stores (e.g., the NASD system) on the other hand provide means to address these issues. An object store control unit presents an abstraction of a dynamic collection of objects, each can be seen as a different array of blocks, thus providing the basis for protection at the object level.

In this paper we present a security model for the object store which leverages on existing security infrastructure. We give a simple generic mechanism capable of enforcing an arbitrary access control policy at object granularity. This mechanism is specifically designed to achieve low overhead by minimizing the cost of validating an operation along the critical data path, and lends itself for optimizations such as caching. The key idea of the model is to separate the mechanisms for transport security from the one used for access control and to maximize the use standard security protocols when possible. We utilize a standard industry protocol for authentication, integrity and privacy on the communication channel (IPSec for IP networks) and define a proprietary protocol for authorization on top of the secure communication layer.

Keywords: SAN, Object Store Device, Storage Security.