iSCSI网络存储系统中加密方法研究与设计  

An encryption method based on iSCSI network storage system

作　　者：孟祥辉[1,2] 曾学文[2] 陈晓[2] 叶晓舟[2] 

机构地区：[1]中国科学院大学电子电气与通信工程学院,北京100049 [2]中国科学院声学研究所国家网络新媒体工程技术研究中心,北京100190

出　　处：《计算机工程与科学》2016年第12期2456-2462,共7页Computer Engineering & Science

基　　金：中国科学院战略性先导科技专项课题(XDA06010302);国家863计划(2011AA01A102)

摘　　要：由于iSCSI协议不提供安全服务,大部分网络存储也不具备加密功能,提出了一种面向iSCSI的实时加密模块,使得网络存储系统加载该模块后,能够为用户提供透明实时的数据安全服务。为iSCSI target设计了加密写和解密读流程,加解密模块相对原网络存储系统独立,不用更改系统内核,而iSCSI initiator不会感知加密操作的存在,基于标准iSCSI协议的客户端可直接使用。此外,利用多核网络处理器的加密协处理器,来优化读写性能。实验结果显示,系统并没有因为加密模块的引入而导致严重的性能损失,性能令人满意。Due to the fact that the iSCSI protocol does not provide security services and most network storage systems do not have the encryption capabilities either, we propose a real-time encryption module for the iSCSI, which enables the network storage system to provide users with transparent real-time encryption services after loading this module. We design an encrypted writing and decrypted reading process for the iSCSI target. Since the encryption module is independent of the original network storage system, the operating system＇s kernel does not need to change. The iSCSI initiator does not perceive the existence of encryption operation, thus clients based on standard iSCSI protocol can use the service directly. In addition, we use the security coprocessor of the multi-core network processor to optimize the read and write performance. Experimental results show that introducing the encryption module to network storage system does not lead to serious loss of performance, and the system performance is satisfactory.

关 键 词：ISCSI协议 网络存储 实时加密 数据安全 网络处理器 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]