基于iSCSI协议的加密存储区域网模型设计与实现  

Design and implementation of iSCSI-based encryption storage area network model

作　　者：任星[1,2] 韩军 张来顺[1] 汪伦伟 

机构地区：[1]解放军信息工程大学电子技术学院,河南郑州450004 [2]北京市7227信箱10分箱,北京100072

出　　处：《计算机工程与设计》2009年第4期876-879,共4页Computer Engineering and Design

基　　金：国家863高技术研究发展计划基金项目(2007AA01Z437322)

摘　　要：采用IPSec协议机制保护基于iSCSI协议的IP存储区域网可以提供传输数据的机密性和完整性,但性能损失严重。根据iSCSISAN的安全需求,提出了一种基于iSCSI协议的加密存储区域网模型。在模型initiator端的iSCSI协议层内嵌加密机制,target端不进行加解密运算,只进行访问控制,在提供数据传输及存储安全性的同时提高了网络I/O性能。在Linux操作系统上对该模型进行了原型实现,测试结果表明,性能获得较大提升。IPSec mechanism is used in iSCSI-based SAN to protect packet integrity and confidentiality at the IP level. However, the IPSec encryption processing degrades throughput of storage access and increases its CPU load. An iSCSI-based encryption storage area network model is designed and implemented, which embeds encrypts and decrypts in the iSCSI-layer at initiator. The iSCSI target need only perform access control without paying the cost ofencryption whenever an UO command is issued. A prototype of the model is implemented and tested on Linux operation system. Performance evaluation shows that this model improves throughput of storage access in comparison to IPSec based mechanism.

关 键 词：ISCSI 存储区域网 加密 

分 类 号：TP309.7[自动化与计算机技术—计算机系统结构]