Pp. 159-174 of the Proceedings

Next: Abstract

Block-Level Security for Network-Attached Disks

Marcos K. Aguilera, Minwen Ji, Mark Lillibridge, John MacCormick, Erwin Oertli,
Dave Andersen, Mike Burrows, Timothy Mann, Chandramohan A. Thekkath
HP Systems Research Center¹
Palo Alto, CA

• • Abstract
  
  
• 1 Introduction
• 2 Block-based security with modest RAM
  • 2.1 The basic capability scheme
  • 2.2 Revoking capabilities
  • 2.3 Network partitions
  • 2.4 Preventing replay attacks
  • 2.5 Consistency attacks
  • 2.6 Data structures and disk functionality
  
  
• 3 Implementation
  • 3.1 Overview
  • 3.2 Changes to the NFS protocol
  • 3.3 Capabilities
  • 3.4 Bloom filter parameters
  • 3.5 Cryptographic details
  • 3.6 Packet security overhead
  
  
• 4 Discussion
  • 4.1 Practical benefit of capability groups
  • 4.2 Choice of underlying file system
  • 4.3 Deployment
  • 4.4 Optional improvements to capability groups
  
  
• 5 Performance
  • 5.1 Latency breakdown
  • 5.2 Aggregate throughput and scalability
  • 5.3 Andrew benchmark with Linux kernel source
  
  
• 6 Limitations
• 7 Related work
• 8 Conclusion
• Acknowledgments
• Bibliography
• About this document ...