Efficient and Safe Networked Storage Protocols

After more than two decades evolving a variety of client/server-based distributed file systems (DFS), the recently emerging storage area networks (SAN) allow the former file-server to be split into a storage and a metadata component. Metadata servers perform file access coordination and metadata management, whereas storage devices directly serve the clients’ read and write requests. The clear separation of duties, the straight data path, and the virtualization of storage result in better scalability, performance, and maintainability. Whereas the first generation of SAN-based DFS focused primarily on performance, the second generation aims at spreading its service to the organizations’ desktops, where server-room trust-levels can no longer be presumed. We identified a set of security threats that arise when SAN File System protocols for client to metadata server communication are opened to the insecure desktops. This work discusses and analyzes design modifications for client authentication, protocol encryption, and distributed lock recovery, which we partly implemented on a Linux-based SAN.FS environment. In addition, we cover quota management as well as lock scheduling, and introduce virtual machines as a valuable tool to support research within distributed storage systems.