Enforcing Confinement in Distributed Storage and a Cryptographic Model for Access Control.
Shai Halevi, Paul A. Karger, Dalit Naor · 2005
This work is concerned with the security of the standard T10 OSD protocol, a capabilitybased protocol for object stores designed by the OSD SNIA working group. The Object Store security protocol is designed to provide access control enforcement in a distributed storage setting such as a Storage Area Network (SAN) environment. In this work we consider in particular the ability of the OSD protocol to enforce confinement, which is the property that even misbehaving participants can not leak secret information across predefined boundaries. We observe that being a “pure capability ” protocol, the plain vanilla OSD protocol is incapable of enforcing confinement. We show, however, that given a trustworthy infrastructure for authentication and secure channels, the protocol can be used in a manner that achieves the desired property (and does not require any change in the message format). Thus we demonstrate that object stores can in principle be used in a standard fashion in applications that require protection against leakage of secret data. Having identified a problem and proposed a solution, we proceed to prove formally that the proposed protocol indeed meets all its security goals. In the process we refine common