Efficient and Safe Networked Storage Protocols

After more than two decades evolving a variety of client/server-based distributed file systems (DFS), the recently emerging storage area networks (SAN) allow the former file-server to be split into a storage and a metadata component. Metadata servers perform file access coordination and metadata management, whereas storage devices directly serve the clients’ read and write requests. The clear separation of duties, the straight data path, and the virtualization of storage result in better scalability, performance, and maintainability. Whereas the first generation of SAN-based DFS focused primarily on performance, the second generation aims at spreading its service to the organizations’ desktops, where server-room trust-levels can no longer be presumed. We identified a set of security threats that arise when SAN File System protocols for client to metadata server communication are opened to the insecure desktops. This work discusses and analyzes design modifications for client authentication, protocol encryption, and distributed lock recovery, which we partly implemented on a Linux-based SAN.FS environment. In addition, we cover quota management as well as lock scheduling, and introduce virtual machines as a valuable tool to support research within distributed storage systems.

By: Marc Kramis

Published in: RZ3580 in 2005


This Research Report is available. This report has been submitted for publication outside of IBM and will probably be copyrighted if accepted for publication. It has been issued as a Research Report for early dissemination of its contents. In view of the transfer of copyright to the outside publisher, its distribution outside of IBM prior to publication should be limited to peer communications and specific requests. After outside publication, requests should be filled only by reprints or legally obtained copies of the article (e.g., payment of royalties). I have read and understand this notice and am a member of the scientific community outside or inside of IBM seeking a single copy only.


Questions about this service can be mailed to reports@us.ibm.com .