IDEAS: An Identity-based Security Architecture for Large-scale and High-performance Storage Systems

Authors

Zhongying Niu, Wuhan National Laboratory for Optoelectronics, China
Ke Zhou, Wuhan National Laboratory for Optoelectronics, China
Hong Jiang, University of Nebraska-LincolnFollow
Dan Feng, Wuhan National Laboratory for Optoelectronics, Wuhan, 430074, China
Tianming Yang, Wuhan National Laboratory for Optoelectronics, China

Date of this Version

11-9-2008

Comments

University of Nebraska–Lincoln, Computer Science and Engineering
Technical Report TR-UNL-CSE-2008-0013
Issued Nov. 9, 2008

Abstract

We develop IDEAS, an identity-based security architecture for large-scale and high-performance storage systems, designed to improve security, convenience and total cost of access control by merging identity management with access control in these systems. IDEAS authenticates users at each I/O node by using a single-identity certificate without the service of a centralized security server and enforces access control mechanism by using an object-based access control (OBAC) model, which is designed to address the complexity and scalability issue of security administration in large-scale storage systems. We also discuss the issue of how to identify and authenticate a large number of users with the state-of-the-art cryptographic solutions and suggest the potential alternative technologies to the well-known PKI mechanism. In particular, we present a generic definition and formal description of the OBAC model. The access control rules for OBAC, namely, the PIPS (Proximity, Inheritance, Priority, Sharing) rules, proposed in this paper can be used as the basis for establishing a testing and evaluation criteria for securing general large-scale storage systems.
Experiments on the IDEAS prototype in the HUST OSD project show that IDEAS significantly outperforms the conventional capability-based security scheme (CapSec) in terms of latency for key security-related operations, by a speedup factor of 1.81 and 2.22 for the frequent read and write operations respectively and by a factor of 1.65, 1.22, and 0.52 for the infrequent create, delete and chmod operations respectively. Furthermore, in addition to achieving higher security, IDEAS drastically improves scalability by completely removing the performance bottleneck caused by security overhead through avoiding capability requests for both read and write operations, as evidenced by the zero read and write latency of IDEAS on the metedata server while CapSec quickly saturates its metadata server with a moderate number of read or write requests.