Scalable Security for Petascale Parallel File Systems

Appeared in Proceedings of SC '07.

Abstract

Petascale, high-performance file systems often hold sensitive data and thus require security, but authentication and authorization can dramatically reduce performance. Existing security solutions perform poorly in these environments because they cannot scale with the number of nodes, highly distributed data, and demanding workloads. To address these issues, we developed Maat, a security protocol designed to provide strong, scalable security to these systems. Maat introduces three new techniques. Extended capabilities limit the number of capabilities needed by allowing a capability to authorize I/O for any number of client-file pairs. Automatic Revocation uses short capability lifetimes to allow capability expiration to act as global revocation, while supporting non-revoked capability renewal. Secure Delegation allows clients to securely act on behalf of a group to open files and distribute access, facilitating secure joint computations. Experiments on the Maat prototype in the Ceph petascale file system show an overhead as little as 6-7%.

Publication date:
November 2007

Authors:
Andrew Leung
Ethan L. Miller
Stephanie Jones

Projects:
Secure File and Storage Systems
Ultra-Large Scale Storage

Available media

Full paper text: PDF

Bibtex entry

@inproceedings{leung-sc07,
  author       = {Andrew Leung and Ethan L. Miller and Stephanie Jones},
  title        = {Scalable Security for Petascale Parallel File Systems},
  booktitle    = {Proceedings of SC '07},
  month        = nov,
  year         = {2007},
}