National Data Store 2 crypto-clients - demonstration Front men : - - PowerPoint PPT Presentation
National Data Store 2 crypto-clients - demonstration Front men : Maciej Brzeniak, Staszek Jankowski Supercomputing Dept. of PSNC, www.psnc.pl Authors: NDS2 team at PSNC and partners full list of credits at the end of presentation Project
Front men : Maciej Brzeźniak, Staszek Jankowski
Supercomputing Dept. of PSNC, www.psnc.pl
Authors: NDS2 team at PSNC and partners
full list of credits at the end of presentation
Project funded by: NCBiR for 2011-2013 under „KMD2” project (no. NR02-0025-10/2011)
Project partners – 10 Polish universities and supercomputing centres:
– Distributed, replicated storage – Virtual Filesystem in user space (Linux) – Standard user interfaces:
– Automatic replication:
– Deployment of NDS for academic community – 10 sites in Poland – Tapes: 12+ PB in 5 sites – Disks: 2+ PB in 10 sites
+ publising + versioning + ACLs support + user management de-centralisation
FS with data migration (HSM) Replica access methods servers (NFS, GridFTP) Storage Node NDS system logic VFS for data and meta-data Access Node DB Node Access Methods Servers (SSH, HTTPs, WebDAV...) User Meta- data DB Users DB Accounting & limits DB Storage Node Replication HSM system (NFS) NAS appliance
Feature NDS NDS2 Access protocols SFTP, WebDAV, GridFTP SFTP mainly; WebDAV, GridFTP Data access tools Typical tools:
=> Users need more „natural access” Project-provided tools:
‚Typical tools’ still supported Backup / archive / sync External tools:
problems with stability/reliability
=> Too complicated for end-users! Integrated into clients!
Still, typical tools can be used with VFS Encryption External tools:
=> Users need even easier solution! Integrated into clients!
Still, you can use external tools Sharing
=> Limitation
Users may decide the scope of sharing
CryptoFS 4Windows
Windows Linux
(.net)
Any platform
CryptoFS 4Linux GUI&CLI Java client
as the local drive
as the local filesystem
for data access & management: nds2API WAN (SFTP) Replicated storage (NDS v2)
Mobile platform
Android client
Work- groups
Appliance
transparent to users
encryption & digests: (C++) LAN (CIFS)
– Boxcryptor (Win, iOS, Android) supports EncFS data format
– Another intermediate layer? – Windows:
* BoxCryptor is made with CallBack FS * EncFS + SSHFS? * Virtual FS for backend storage * FUSE issues
– Security:
Feature NDS2 Box cryptor/ EncFS
File encryption algorithm / key type Symmetric (AES 256 CTR) Symmetric (AES 256) Key usage Generated per-file Common for all files File name encryption Symmetric (AES 256) key derived from user’s asymmetric private key Common for data and names Shared data encryption Per-directory asymmetric key, encrypted with private users’ key or group key Common key for every user – no fine-grained keys management
6
Login screen:
NDS2/SFTP Server connection details:
GUI client:
if many files are dropped
jobs, pausing/resuming them etc.
GUI client:
in the ‚encrypted’ directory
Login screen:
for authentication
RSA key pair for data encryption Remote storage space visible and accessible as a local drive
Original directory content (user view) Encrypted directory content (server view)
Original file content (user view) Encrypted file content (server view)
Network settings configuration NDS2 (or SFTP server) connection configuration Internal appliance disks / RAIDs configuration
Access to data from the end-user workstation – remote storage space accessible through CIFS and NDS2 appliance Network share defined on appliance Data stored in NDS2/SFTP server Accessible through appliance and CIFS protocol
17
– Interactive & reliable data storage and retrieval:
– Supports SHARING management:
– SHARE DIRECTORY creation – Assigning the directory with the sharing keypair
– User-level METADATA support:
– Plans/roadmap:
Any platform
GUI&CLI Java client
for data access & mgmt: nds2API: (Java) Replicated storage (NDS v2) WAN (SFTP)
– Support PART
(also with regular SFTP server)
initiated by using GUI)
– ‚Natural’ interface for many users:
may further improve experience
– Work on most popular OSs – Possible next steps?
(out of scope of NDS2)
CryptoFS 4Windows
Windows Linux
like client: (.NET)
CryptoFS 4Linux
as the local drive
as the local filesystem
WAN (SFTP)
Work- groups
Appliance
transparent to users
encryption & digests: (C++) LAN (CIFS)
– Small institution / workgroup shares data using local NAS appliance – Data protected against disaster and intrusion: backup and encryption
NDS2appliance
SMB/CIFS server Users
LAN
Data access & sharing (CIFS) LDAP/ Active Directory server Appliance admin MGMT interface (web) Local disk space Remote storage/ backup space Backup / restore Data access + encryption
WAN Public cloud Private cloud
Box for small groups/ instiututions Rack server for bigger institutions Small (19,5x70x18,6cm) and silent, green (fits below the desk):
(up to ~ 2 TB of RAW internal storage)
Rack server:
Virtual machine:
storage and account in NDS2 for backups and sync’s Some ‚fancy’ hardware for users:
=> Aim: to learn about issues related to mobile client
=> Core functionality only – simplicity:
=> first experience – promising:
– Addresses Dropbox-like scenarios:
Sync & Share
NDSbox client application 4 Linux NDSbox client application
Sync & Share
NDSbox client application 4 Android
Sync & Share
– Secure sharing
(more elaboration elsewhere)
– Secure publishing and import/export from/to World
– It’s safer than with Dropbox…
Trust
Safe key exchange
NO Trust NO Trust Data access import/ export Safe key exchange Data access & storage publication Data access
Project funded by: NCBiR for 2011-2013 under „KMD2” project (no. NR02-0025-10/2011)
Project partners – 10 Polish universities and supercomputing centres:
Project funded by: NCBiR for 2011-2013 under „KMD2” project (no. NR02-0025-10/2011)
Project partners – 10 Polish universities and supercomputing centres:
PSNC team: Maciej Brzeźniak, {Gracjan, Michał, Staszek, Tomasz} Jankowski Adam Zawada Sławomir Zdanowski Rafał Mikołajczak Partners: Tomasz Chmiel, Łukasz Kuczyński, Michał Major, Łukasz Redynk, Kamil Guryn, and others