RAID系统存储加密的研究与设计

华中科技大学硕士学位论文RAID系统存储加密的研究与设计姓名：张乐申请学位级别：硕士专业：计算机系统结构指导教师：谢长生20080604I,RAID()RAIDRAIDRAIDSEALSEALRAIDSEALRAIDSCSICacheIOMETERIIAbstractToday,thesecurityproblemofdatainstoragesystemhascausemoreandmoreattention,andstorageencryptionhasbecomeoneofthehottesttechnologiesintheITresearchfield.Toencryptdatainstoragesystemprovidesthelastdefenselineforthesecurityofdata.AsRAIDisthekeyelementinalarge-scalestoragesystem,researchandimplementationofRAIDstoragesystemencryptionmeansalot.Currently,mostencryptionmethodonRAIDsystemisthehardwareencryptionwhichneedshigh-pricedhardwaredevice.Therefore,todesignasoftwareencryptionmoduleonthebaseoftheembeddedRAIDcontrollersoftwareisagoodscheme.Thecoreissueofsoftwareencryptionistochooseaproperencryptionlayerandahighlyefficientandsecureencryptionalogrithm.Thecurrentlyexistingstoragesystemsoftwareencryptionmethods,whicharemostfrequentlyused,aremanualfileencryption,filesystem-levelencryption,virtualdriveencryptionandfulldiskencryption.ThesemethodswerestudiedfromtheStorageStack’spointofview,andthefeatures,advantagesanddisadvantageswerealsostduied.Onthebasisofthat,andafteranalyzingthecharacteristicofRAIDcontrollersoftware,theencryptionlayerwasconsideredtobebetweenthefilesystem-levelanddiskdriver-level.Forthechoiceofencryptionalgorithm,theSEALalgorithm,whichisapseudorandomfunctionfamilyalgorithmandhighlyefficient,wasbelievedtobethebestproperalgorithmforstorageencryption.AkeyinfrastructurewasdesignedtoagainstthepossibledangercausebytheweaknessofSEAL.AfteranalyzingtherunningprocessesoftheRAIDcontrollersoftware,theencryptionmodulewaschosentobeimplementedbetweentheSCSITargetmoduleandCacheManagementmodule,withtheconsiderationofsecurityandperformance.BasedontheanalysisoftheI/OprocessesintheencryptedRAIDsystem,thearchitectureofencryptionmodulewasdesigned,andthefunctionofeverysubmoduleinthisarchitecturewasdescribedindetail.TheI/OperformanceencryptedRAIDsystemwastestedwiththetechnicalbenchmarksoftwareIOMETER,andtheresultshowedthattherewasacertainlossonI/OperformancecomparedtotheRAIDwithoutencryptionmodule,especiallyintheconditionofsequencereadandwrite.KeywordsStorageEncryption,RAID,Pseudorandomfunctionfamily,Keyinfrastructure□______□“√”111.120I/OPetaBytesGbytes/secI/OITPC[1]InternetIDC2001IT50%201080%[2]RAIDRAIDRedundantArrayofIndependentDisks1988ACMSIGMODPattersonGilbson[3]I/O2[4]RAIDRAID1.2ITRAIDSCSISCSIIDE100MB/s~400MB/s32M~512MBEMCIBMHPAdaptecLSII/O400MBTBGBInternet[5]2005AmeritradeEMC20075EMC3TCGIEEE200612IEEE1667iPodmp3IEEEP1619ANSISCSIT10T102004OSDOSD-2T10SCSI-3SSC-3SNIASSIFIPSecSSHIEEESISWGSecurityinStorageWorkingGroupP1619P1619P16191.3RAID1.3.1RAIDRAIDRedundantArrayofIndependentDiskRAIDRAID4I/ORAID[6]RAID6RAIDRAID0RAID5RAID6RAID10RAID[7]RAIDRAID-0RAID-1RAID-51.1RAID1.1RAIDRAIDRAID01RAID1250%RAID321RAID521RAID10350%1.3.2RAIDRAIDRAID(Striping)[8]RAIDRAID0RAID1RAID2RAID3RAID4RAID55RAID6P+QRAID10RAID5RAID6RAID5RAID5RAID10RAID1RAID0[9]SCSISCSISCSIRAIDRAID[10]1.4RAIDRAIDRAID1RAID2RAID3RAIDRAID6RAIDRAIDRAIDRAIDRAID1.59732004CB318203722.1DASSANNASFibreChannelIPiSCSI[11]SANNASSANSAN3VPN[12]2.2Cryptology8CryptographyCryptanalysisSteganography[13]2.2.1MessagePlaintextEncryptionCiphertextDecryptionCryptographyCryptographyAlgorithmEncryptionAlgorithmDecryptionAlgorithmEncryptionKeyDecryptionKey2.12.2.2(symmetriccryptographicalgorithm)(conventionalcryptographic9algorithm)blockDES645681976DiffieHellman[14]asymmetriccryptographyalgorithmpublickeyalgorithmpublickeyprivatekey[15]RSAEIGamalMerkle-Hellman[16]McElieceEIGamal2.1102.11.2.3.4.TDEA5.1.2.3.4.1.2.3.4.5.n2nC1.2.1000641283.2.111RAIDRAIDRAID2.2.3rblocktnblockalgorithmblockcipher64[17]Shannon1949-substitution-permutationSP[18]DESAES3DESIEDABlowfishstreamalgorithmstreamcipherm=m0,m1,…mi…k=k0,k1,…ki…imiEk(m)=Ek0(m0),Ek1(m1),…,Eki(mi),…keystreamXOR2.2122.2one-time-padG.Vernam1917Vernam[19]pseudo-randomN[20]LFSRRC4SEALR.A.Rueppel[21]kjjK132.3(Host-base)(Network-base)(Storage-base)2.3.1IC2.22.21.2.3.4.1.2.3.4.1.2.3.1.2.3.142.3.2IPSecAES-256NAS2.3152.3IPsecFCNAS2.4163RAID3.1RAIDRAIDLINUXRAIDLINUX[22]2.3.1RAIDRAIDRAIDRAIDRAID1.41RAID2RAIDRAIDRAIDRAIDRAID33.2RAID4RAIDRAIDI/O17RAIDCPUCPU5RAIDRAID3.2Storagestack[23]3.1I/O3.13.1PC18harddiskLogicalBlockAddressingLBA//Cylinder-Head-SectorCHSMasterBootRecordMBRI/OFATNTFSext3I/Oflashmemory19RAID3.2.13.1PGP(PrettyGoodPrivacy)[24]3.2203.23.2.2Filesystem-levelencryptionFolderencryption3.1General-purposeFileSystemswithEncryptionCrytographicFileSystemFullDiskEncryption3.2.4metadata[25][26]Linux213.3VirtualFileSystemVFSVFS(ext3)(ext3)VFSVFS(ext3)ext3VirtualFileSystem3.3Windows2000EFSEncryptingFileSystemLinuxCFSCryptographicFileSystemTCFSTransparentCryptographicFileSystem[27]3.2.3(loop)BestCryptPGPDiskLinuxcryptoloopPGPdisk22PGPdiskPGPdisk(CPGPdiskD:)PGPdisk(Mount)(Unmount)[28]PGPdisk3.4I/O/I/O//13.42323I/O/3.43.2.43.1[29]DiskSectorEncryptionsectorblock4096[29]241MBR2swapspace34FullDiscEncryptionFDEFDEFDEFDEBIOSATAFDEWordEmailDatabaseMBR3.525WindowsVista™BitLocker™1.2TPMTrustedPlatformModule3.2.5RAID13.13.1sectorblock23.2.