基于公开密钥基础设施的Lustre安全模型设计  

Security model design for Lustre based on PKI

作　　者：刘素芹[1] 李兴盛[1] 硕珺[1] 王婧[1] 

机构地区：[1]中国石油大学计算机与通信工程学院,山东青岛266555

出　　处：《中国石油大学学报（自然科学版）》2009年第5期164-167,172,共5页Journal of China University of Petroleum(Edition of Natural Science)

摘　　要：在分析并行文件系统Lustre存在的安全隐患的基础上,根据其存储特点,利用公开密钥基础设施(PK I)安全机制设计相应的安全模型。该模型包括证书管理和用户访问两部分,证书管理部分采用PK I本身的证书管理机制,用户访问部分采用双向身份认证和数字签名方式,且在认证过程中加入对随机数的检验。在传输请求信息和认证信息时,采用非对称加密机制;在传输大量数据时,采用对称加密机制。该模型能较好地解决存储系统存在的身份冒充、数据窃取、数据篡改以及重放攻击等安全隐患,提高Lustre的安全性。By analyzing safety loophole and storage characteristic of Lustre file system, a security model for Lustre file system was designed based on public key infrastructure （PKI） security mechanism. The model includes certificate management and client accessing. Certificate management mechanism of PKI is adopted in certificate management module. Bidirectional identity authentication and digital signature are applied in client accessing module. Random number must be checked during authentication. Dissymmetrical encryption mechanism is applied to the transmission of request information and authentication information. Symmetrical encryption mechanism is applied to the transmission of data stream. The security model can remove safety loopholes in Lustre file system, such as imitating identity, filching data, distorting data and replaying attack. It can enhance the security of Lustre file system.

关 键 词：公开密钥基础设施 LUSTRE 安全模型 双向身份验证 数字签名 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]