文档介绍：华中科技大学
硕士学位论文
分布式存储系统安全关键技术研究与实现
姓名:冯光曦
申请学位级别:硕士
专业:计算机系统结构
指导教师:李春花
2011-01-14
华中科技大学硕士学位论文
摘要
随着存储技术的不断提高和计算机计算能力的飞速发展,存储系统逐渐向大规
模、高并发的方向发展,对存储系统的存储安全也提出了新的要求。传统的对存储
系统的安全措施已不足以满足当前分布式存储的安全需求。
经过分析 Plutus、SiRiUS 等文件系统的安全机制及其实现方式,发现这些安全机
制的实现受其性能和规模的限制,不足以在分布式存储的环境中仍保持高性能。而
且当所有数据都存放在整个系统中时,系统管理员的权限限制显得尤其必要。
分布式存储系统存在大规模、高并发、并非所有数据都需要加密等特征。一套针
对分布式存储系统的安全机制应允许用户按需对数据加密,避免对不敏感数据的加
密开销;通过使用安全管理器免除了用户直接参与加解密过程和密钥管理的麻烦,
并通过权限证书的缓存,将系统的访问控制开销减到最低,避免了对系统吞吐率的
影响。通过密钥与密钥号的分离,可以限制管理员用户的超级权限。
实验显示,在部署上述安全机制的分布式存储系统中,对加密文件的读写性能受
限于当前加解密速度的限制;而对不加密的文件,引入加密存储和访问控制策略,
对存储系统的性能影响均不大,在保证存储安全的同时,不仅维持了系统的高性能,
还提供了灵活的加密粒度和友好的访问方式。

关键词:加密存储、访问控制、管理员权限限制、高性能
I
华中科技大学硕士学位论文
Abstract
As the storage technology has been kept improving and putable ability of
computers increased rapidly, storage system is improving to fit the needs of large scale
and high concurrency. The massive growth in information storage has brought new
requirement to ensure the security of information storage. Traditional security methods for
storage systems are insufficient to satisfy current security requirement in a distributed
storage system.
Having analysed the security mechanism of some file-systems and their
implementation, such as Plutus and SiRiUS, it is found that the implementation of these
security mechanisms are restricted by their performance and scales, not enough
high-performance for distributed storage system. And when all data are stored in the
system, it is necessary to restrict the system administrator’s priviledge.
The large-scale, high concurrency and less sensitive data are the characteristics in a
distributed storage system. A set of security mechanisms for a distributed storage system
should allow the user encrypt data as they wish which prevents non-sensitive data from
being encrypted, keep the user from being directly involved in the encryption/decryption
and key management problems by using the security manager,