Cooperative Computing - University of Notre Dame协同计算-圣母大学.ppt

The Consequences ofDecentralized Security in a Cooperative Storage System Douglas Thain, Chris Moretti, Paul Madrid, Phil Snowberger, and Jeff Hemmes University of Notre Dame /~ccl IEEE Workshop on Security in Storage 2005 Abstract Suppose that security in storage has been deployed at all endpoints. How does this affect the design of distributed storage systems that rely upon these devices? Clients must become much more: Fault tolerant, adaptive, and self reliant. Aware of resource allocation issues. Helpful to the end user! Environment: Storage Pool at Notre Dame Traditional File System Security Decentralized Security CooperativeStorage SystematNotre Dame What is Cooperative Storage? Many devices bound together that can accomplish more than one device alone. Improve capacity, reliability, performance... Could be one person, or many cooperating users. Key property: Each person retains absolute control of their own resources by setting local policies. People share and collaborate with others that they know and trust. No free love! No central control! However, some resources are set up for the common good by an authority. (CS workstations usable by any member of the CS department, says the chair.) CFS: Central File System DSFS: Dist. Shared File System DSDB: Dist. Shared Database Applications Simple and Secure Remote Access CDF: Remote Dynamic Linking BaBar: Remote Database Access LHC: Semantic Remote Filesystems Distributed File Systems GRAND: Scalable Archive for Online Data Distributed Databases GEMS: Molecular Dynamics Simulation CVRL: Biometric Image Storage/Analysis Challenges of Decentralization Unbounded Set of Users There is no global /etc/passwd or /etc/group! Multiple Identities per User Kerberos creds from Notre Dame / Wisconsin. GSI creds from ND/UW/DOE/NCSA. New Decision Points Placement decision made, but action fails! Directory op succeeds, but file creation fails! Unexpected Policy Coupling Data placement may affect access control! Outline