数字有机体系统安全子系统的设计与实现
|
摘要
Linux是多用户、多任务的操作系统,它不仅继承了Unix系统功能强大、性能稳定的特点,还在许多方面超过了Unix,比如简单高效的进程调度,支持内核线程、虚拟文件系统、模块机制,强大的网络支持等。近些年,由于Linux的高性能、低价格,它在很多领域得到了广泛的应用。很多个人和企业都转向了Linux操作系统,并且在公开源码的基础上的开发和研究也越来越多。当前随着大规模网络应用的不断出现,特别是大规模的存储需求,分布式系统和虚拟存储系统[10]也随之诞生,以Linux为开发平台的分布式系统也成为当今主流。目前较为流行的大型分布式系统,都以Linux或者类似的Unix变种作为开发平台。
数字有机体系统[1]就是一个基于Linux平台的虚拟存储系统。其核心思想是通过聚集网络上的各种存储资源[11,12],形成虚拟的单一空间,向业务系统提供统一的映像,并提供数据的高可用性保证,从而满足大规模网络应用的需要。在传统的P2P分布式存储中数据对于所有用户都是公开的,但随着共享资源和用户数量的增多,就会存在安全问题。在某些特定系统中一些高敏感资源只能对某些用户开放,这就需要设立访问控制权限机制。
本文分析了当前Linux已有的安全策略,通过结合数字有机体系统和数字有机体虚拟文件系统的特点,描述了数字有机体系统资源访问安全子系统的设计与实现。
由于数字有机体系统本生对文件元数据的管理的高效性,使得作为文件附加属性的访问控制信息不管在访问和修改都有很高的效率。而且DOSFS良好的兼容性,也使得对于本地用户对文件访问控制属性的设置十分简便,和操作单机系统没有区别。当然还有方便系统安全管理员的界面系统和安全角色概念的引入,使管理员对整个数字有机体系统的文件访问控制信息管理的工作量大大减低。
Linux is a operation system of multi-user and multi-tasks. It not only inherited the powerful, stable performance characteristics of Unix system, is still more than a lot of aspects of Unix. Such as simple and efficient process of scheduling, support for kernel threads, virtual file system, the module mechanism, and a strong network of support. In recent years, because of Linux, high-performance, low price, which has been widely used in many areas. A lot of individuals and businesses have turned to Linux operating system, and development and basic research on it’s open source become more and more. With the current ongoing large-scale network applications, especially large-scale storage requirements, distributed systems and virtual storage system come into the world. Linux platform for the development of distributed systems has become today's mainstream. At present, the most popular large-scale distributed systems are based on Linux or Unix variant as a development platform.
Digital Organzation System[1] is a Linux-based platform for virtual storage systems. Its core idea is gathered on a variety of network storage resources to form a single virtual space to provide a unified image to the application software. And it ensure the high availability data to meet the needs of large-scale network applications. In a traditional P2P distributed storage of data for all users are open, but with the increase of sharing resources and user scales, there will exist some security problem. In some specific system, highly sensitive resources can only be open to certain users, so there must set access control mechanism.
This article has analyzed the current Linux security strategy, through a combination of Digital Organzation System and Digital Organzation System FS characteristics, described how to design and implementation Digital Organzation System access security subsystem.
Because Digital Organzation System have a high file meta-data management efficiency, the access and modify access control information which is the additional property of file meta-data also have a very high efficiency. And the Digital Organzation System FS’s good compatibility, allows local user to set the file access control property very easy. And this security subsystem have a very convenient interface and based role access mechanism, so that Greatly reduce the workload of the administrator.
数字有机体系统[1]就是一个基于Linux平台的虚拟存储系统。其核心思想是通过聚集网络上的各种存储资源[11,12],形成虚拟的单一空间,向业务系统提供统一的映像,并提供数据的高可用性保证,从而满足大规模网络应用的需要。在传统的P2P分布式存储中数据对于所有用户都是公开的,但随着共享资源和用户数量的增多,就会存在安全问题。在某些特定系统中一些高敏感资源只能对某些用户开放,这就需要设立访问控制权限机制。
本文分析了当前Linux已有的安全策略,通过结合数字有机体系统和数字有机体虚拟文件系统的特点,描述了数字有机体系统资源访问安全子系统的设计与实现。
由于数字有机体系统本生对文件元数据的管理的高效性,使得作为文件附加属性的访问控制信息不管在访问和修改都有很高的效率。而且DOSFS良好的兼容性,也使得对于本地用户对文件访问控制属性的设置十分简便,和操作单机系统没有区别。当然还有方便系统安全管理员的界面系统和安全角色概念的引入,使管理员对整个数字有机体系统的文件访问控制信息管理的工作量大大减低。
Linux is a operation system of multi-user and multi-tasks. It not only inherited the powerful, stable performance characteristics of Unix system, is still more than a lot of aspects of Unix. Such as simple and efficient process of scheduling, support for kernel threads, virtual file system, the module mechanism, and a strong network of support. In recent years, because of Linux, high-performance, low price, which has been widely used in many areas. A lot of individuals and businesses have turned to Linux operating system, and development and basic research on it’s open source become more and more. With the current ongoing large-scale network applications, especially large-scale storage requirements, distributed systems and virtual storage system come into the world. Linux platform for the development of distributed systems has become today's mainstream. At present, the most popular large-scale distributed systems are based on Linux or Unix variant as a development platform.
Digital Organzation System[1] is a Linux-based platform for virtual storage systems. Its core idea is gathered on a variety of network storage resources to form a single virtual space to provide a unified image to the application software. And it ensure the high availability data to meet the needs of large-scale network applications. In a traditional P2P distributed storage of data for all users are open, but with the increase of sharing resources and user scales, there will exist some security problem. In some specific system, highly sensitive resources can only be open to certain users, so there must set access control mechanism.
This article has analyzed the current Linux security strategy, through a combination of Digital Organzation System and Digital Organzation System FS characteristics, described how to design and implementation Digital Organzation System access security subsystem.
Because Digital Organzation System have a high file meta-data management efficiency, the access and modify access control information which is the additional property of file meta-data also have a very high efficiency. And the Digital Organzation System FS’s good compatibility, allows local user to set the file access control property very easy. And this security subsystem have a very convenient interface and based role access mechanism, so that Greatly reduce the workload of the administrator.
引文
[1]王典荫,刘心松.下一代计算机系统-数字有机体[J].西部广播电视, 2005, Vo11: 4-6
[2] D.Elliott Bell, Leonard J.LaPadula. Secure Computer Systems[J]. Mathematical Foundations, 1973/3
[3]蒋韬,李信满等.信息安全模性研究[J].小型微型计算机系统, 2000/10
[4]刘怀宇,李伟琴.浅谈访问控制技术[J].电脑&网络, 1999
[5]李军,孙玉芳.计算机安全和安全模型[J].计算机研究与发展, 1996/4
[6]李伟琴,杨亚平.基于角色的访问控制系统[J].计算机应用, 2000
[7] Ravi S.Sandhu, Edward J.Coynek, etc. Role-Based Access Control Models[J], IEEE Computer, Volume 29, Number 2, February 1996: pages 38-47.
[8] Gaoshou Zhai, Yaodong Li. Analysis and Study of Security Mechanisms inside Linux Kernel[J], 2008 International Conference on Security Technology, 978-0-7695-3486-2/08 2008 IEEE
[9] R.Baird. Virtual Storage Architecture Guide(VSAG). Fourteenth IEEE Symposium on Mass Storage Systems: 312-326
[10] Huang, H.Howie, Karpovich, et al. A Feasibility Study of a Virtual Storage System for Large Organizations[J]. Virtualization Technology in Distributed Computing, 2006, VTDC 2006 First International Workshop on 17-17 Nov. 2006:9 - 9
[11]杨曙锋.分布式并行文件系统的副本管理策略[D]:[硕士学位论文].成都:电子科技大学, 2003:16-23
[12]朱海滨,蔡开裕,樊爱华等.分布式系统原理与设计[J].长沙:国防科技大学出版社, 1997:25-105
[13]肖庆华.几种典型网络存储系统的存储管理技术研究[D]: [硕士学位论文].武汉:华中科技大学, 2004: 27-62
[14] Ragib Hasan, Zahid Anwar, William Yurcik, et al. A Survey of Peer-to-Peer Storage Techniques for Distributed File Systems[J], Proceeding of the International Conference on Information Technology:Coding and Computing(ITCC’05), 2005
[15]宋静.分布式并行数据库一致性研究机制与实现[D]: [硕士学位论文].成都:电子科技大学, 2006: 19-63
[16]毛德操,胡希明. Linux内核源代码情景分析[M].浙江:浙江大学出版社, 2001: 25-100
[17]周伦,刘心松,邱元杰.一种基于广域网的资源管理模型[J].计算机科学, 2006, 33(7): 400-402
[18] I.Gupta, K.Birman, P.Linka, A.Demers and R.van Renesse. Building an ef_cient and stable P2P DHT through increased memory and background overhead[J]. In IPTPS, Feb. 2003.
[19] DWORK, C.NAOR, M.Pricing. via processing or combating junk mail[J]. In Proc. CRYPTO Conf. 1992: 139–147.
[20] Antony Rowstron, Peter Druschel. Pastry: Scalable, decentralized object location and routing for large-scale peer-to-peer systems[J]. The 18th IFIP/ACM International Conference on Distributed Systems Plat-forms (Middleware 2001). Heidelberg, Germany, November 2001
[21]陈勇.基于存储虚拟化的动态副本及资源管理系统研究[D]:[硕士学位论文].武汉:华中科技大学,2004:32-39
[22] ABADI,M,BIRRELL,et al. Bankable postage for network services[J]. In Proc.Advances in Computing Science (Mumbai, India, December 2003):25-32
[23] Anurag Kahol, Sumit Khurana, Sandeep K.S. Gupta,et al. A Strategy to Manage Cache Consistency in a Disconnected Distributed Environment[J]. IEEE transactions on parallel and distributed systems, vol.12, no. 7, JULY 2001:680-700
[24] Robert Love. Linux Kernel Development[M](陈莉君,康华等译).中国:机械工业出版社, 2006.1, 166-187
[25] W.Richard.Stevens, Stephen A.Rago. Advanced Programming in the UNIX Enviroment[M](尤晋元,张亚英等译).中国:人民有点出版社, 2006.5, 133-146
[26] Nagaraj, S.V. Access control in distributed object systems: problems with access control lists[J]. Enabling Technologies: Infrastructure for Collaborative Enterprises, 2001. WET ICE 2001. Proceedings. Tenth IEEE International Workshops on 20-22 June 2001 Page(s):163– 164
[27] Kanghee Lee, Zhefan Jiang, Sangok Kim, Sangwook Kim, Sunkyung Kim. Access Control List Mediation System for Large-Scale Network. Parallel and Distributed Computing[J], Applications and Technologies, 2005. PDCAT 2005. Sixth International Conference on 05-08 Dec. 2005 Page(s):483– 487
[28] Chao Xie, Hai Jin, Song Wu, Shengli Li, Zhiping Wang. Access control of global distributed storage system[J]. Computer and Information Technology, 2004. CIT '04. The Fourth International Conference on 14-16 Sept. 2004 Page(s):369– 374
[29]艾鸿.分布式访问控制[J].计算机工程与设计, 2007.11,第28卷,第21期:5110-5118
[30]王永春,唐治平,唐乙秋.在分布式环境下基于RBAC域间安全访问控制策略[J].湖南科技学院学报, 2005.5,第26卷,第5期:162-164
[31]阮越.基于LSM的ACL的设计与实现[J].安徽工业大学学报, 2006.4, Vol.23 No.2:199-205
[32]王丽梅.安全Linux访问控制机制设计与实现[D]:[北京工业大学硕士学位论文],北京.北京工业大学, 2003, 1-24
[2] D.Elliott Bell, Leonard J.LaPadula. Secure Computer Systems[J]. Mathematical Foundations, 1973/3
[3]蒋韬,李信满等.信息安全模性研究[J].小型微型计算机系统, 2000/10
[4]刘怀宇,李伟琴.浅谈访问控制技术[J].电脑&网络, 1999
[5]李军,孙玉芳.计算机安全和安全模型[J].计算机研究与发展, 1996/4
[6]李伟琴,杨亚平.基于角色的访问控制系统[J].计算机应用, 2000
[7] Ravi S.Sandhu, Edward J.Coynek, etc. Role-Based Access Control Models[J], IEEE Computer, Volume 29, Number 2, February 1996: pages 38-47.
[8] Gaoshou Zhai, Yaodong Li. Analysis and Study of Security Mechanisms inside Linux Kernel[J], 2008 International Conference on Security Technology, 978-0-7695-3486-2/08 2008 IEEE
[9] R.Baird. Virtual Storage Architecture Guide(VSAG). Fourteenth IEEE Symposium on Mass Storage Systems: 312-326
[10] Huang, H.Howie, Karpovich, et al. A Feasibility Study of a Virtual Storage System for Large Organizations[J]. Virtualization Technology in Distributed Computing, 2006, VTDC 2006 First International Workshop on 17-17 Nov. 2006:9 - 9
[11]杨曙锋.分布式并行文件系统的副本管理策略[D]:[硕士学位论文].成都:电子科技大学, 2003:16-23
[12]朱海滨,蔡开裕,樊爱华等.分布式系统原理与设计[J].长沙:国防科技大学出版社, 1997:25-105
[13]肖庆华.几种典型网络存储系统的存储管理技术研究[D]: [硕士学位论文].武汉:华中科技大学, 2004: 27-62
[14] Ragib Hasan, Zahid Anwar, William Yurcik, et al. A Survey of Peer-to-Peer Storage Techniques for Distributed File Systems[J], Proceeding of the International Conference on Information Technology:Coding and Computing(ITCC’05), 2005
[15]宋静.分布式并行数据库一致性研究机制与实现[D]: [硕士学位论文].成都:电子科技大学, 2006: 19-63
[16]毛德操,胡希明. Linux内核源代码情景分析[M].浙江:浙江大学出版社, 2001: 25-100
[17]周伦,刘心松,邱元杰.一种基于广域网的资源管理模型[J].计算机科学, 2006, 33(7): 400-402
[18] I.Gupta, K.Birman, P.Linka, A.Demers and R.van Renesse. Building an ef_cient and stable P2P DHT through increased memory and background overhead[J]. In IPTPS, Feb. 2003.
[19] DWORK, C.NAOR, M.Pricing. via processing or combating junk mail[J]. In Proc. CRYPTO Conf. 1992: 139–147.
[20] Antony Rowstron, Peter Druschel. Pastry: Scalable, decentralized object location and routing for large-scale peer-to-peer systems[J]. The 18th IFIP/ACM International Conference on Distributed Systems Plat-forms (Middleware 2001). Heidelberg, Germany, November 2001
[21]陈勇.基于存储虚拟化的动态副本及资源管理系统研究[D]:[硕士学位论文].武汉:华中科技大学,2004:32-39
[22] ABADI,M,BIRRELL,et al. Bankable postage for network services[J]. In Proc.Advances in Computing Science (Mumbai, India, December 2003):25-32
[23] Anurag Kahol, Sumit Khurana, Sandeep K.S. Gupta,et al. A Strategy to Manage Cache Consistency in a Disconnected Distributed Environment[J]. IEEE transactions on parallel and distributed systems, vol.12, no. 7, JULY 2001:680-700
[24] Robert Love. Linux Kernel Development[M](陈莉君,康华等译).中国:机械工业出版社, 2006.1, 166-187
[25] W.Richard.Stevens, Stephen A.Rago. Advanced Programming in the UNIX Enviroment[M](尤晋元,张亚英等译).中国:人民有点出版社, 2006.5, 133-146
[26] Nagaraj, S.V. Access control in distributed object systems: problems with access control lists[J]. Enabling Technologies: Infrastructure for Collaborative Enterprises, 2001. WET ICE 2001. Proceedings. Tenth IEEE International Workshops on 20-22 June 2001 Page(s):163– 164
[27] Kanghee Lee, Zhefan Jiang, Sangok Kim, Sangwook Kim, Sunkyung Kim. Access Control List Mediation System for Large-Scale Network. Parallel and Distributed Computing[J], Applications and Technologies, 2005. PDCAT 2005. Sixth International Conference on 05-08 Dec. 2005 Page(s):483– 487
[28] Chao Xie, Hai Jin, Song Wu, Shengli Li, Zhiping Wang. Access control of global distributed storage system[J]. Computer and Information Technology, 2004. CIT '04. The Fourth International Conference on 14-16 Sept. 2004 Page(s):369– 374
[29]艾鸿.分布式访问控制[J].计算机工程与设计, 2007.11,第28卷,第21期:5110-5118
[30]王永春,唐治平,唐乙秋.在分布式环境下基于RBAC域间安全访问控制策略[J].湖南科技学院学报, 2005.5,第26卷,第5期:162-164
[31]阮越.基于LSM的ACL的设计与实现[J].安徽工业大学学报, 2006.4, Vol.23 No.2:199-205
[32]王丽梅.安全Linux访问控制机制设计与实现[D]:[北京工业大学硕士学位论文],北京.北京工业大学, 2003, 1-24