Object-Based Storage: IEEE Communications Magazine September 2003
Object-Based Storage: IEEE Communications Magazine September 2003
net/publication/3199003
Object-based storage
CITATIONS READS
293 509
3 authors, including:
Michael P. Mesnier
Intel
27 PUBLICATIONS 1,288 CITATIONS
SEE PROFILE
All content following this page was uploaded by Michael P. Mesnier on 02 February 2015.
Object-Based Storage
Mike Mesnier, Carnegie Mellon and Intel
Gregory R. Ganger, Carnegie Mellon
Erik Riedel, Seagate Research
File I/O
storage (DAS), storage area networks (SANs),
and network-attached storage (NAS). A fourth
architecture, often called a SAN file system, has
recently been introduced in an attempt to cap-
IP network
ture the features of both NAS and SANs.
DAS connects block-based storage devices
directly to the I/O bus of a host machine (e.g.,
via SCSI or ATA/IDE). While DAS offers high Storage area network
performance and minimal security concerns, Block I/O
there are limits on connectivity. SCSI, for exam-
ple, is limited by the width of the bus (a 16-bit
bus can have at most 16 hosts or devices). To File server
address the connectivity limits of DAS , and con-
sequently enable the consolidation and sharing Block storage
of storage devices, the SAN was introduced. A
SAN is a switched fabric that provides a fast, ■ Figure 1. This figure illustrates NAS being used to share files among a num-
scalable interconnect for large numbers of hosts ber of clients. The files themselves may be stored on a fast SAN. However,
and storage devices. With this added connectivi- because the clients often suffer from queuing delays at the server, they rarely
ty, however, came the need for better security. see the full performance of the SAN.
SANs therefore introduced concepts such as
zoning (like a virtual private network) and host-
device authentication to keep the fabric secure.
DAS and SAN are both block-based. The
storage application (e.g., file system) is responsi- Clients
ble for mapping its data structures (files and
directories) to blocks on the storage devices. The
extra data required to do this mapping is com-
Met Servers
monly referred to as metadata. For multiple adat
a
hosts to share data blocks, they must also share
metadata, and do so in a manner that guarantees
metadata consistency among the hosts. The com-
plexity of this process has resulted in block shar-
Data
on a storage
System call interface System call interface
device is
accomplished File system, File system,
user component user component
through a rich
interface similar to
File system,
a file system. And, storage component
Object interface
because objects
can grow and Block interface
File system,
shrink dynamically, storage component
Block I/O manager
the storage device Block I/O manager
is responsible for
all internal space
management of
Storage device Storage device
the object.
(a) Traditional model (b) OSD model
that provides both the direct access nature of data stored in an object is opaque to the object-
SANs and the data sharing and security capabili- based storage device and is simply stored in the
ties of NAS. data portion of the object. The user-accessible
attributes describe characteristics of the object,
OBJECT-BASED STORAGE some of which will be opaque and others not.
For example, a quality of service (QoS) attribute
OVERVIEW may describe latency and throughput require-
Objects are storage containers with a file-like ments for a multimedia object. Lastly, the device-
interface, effectively representing a convergence managed metadata is any extra information (e.g.,
of the NAS and SAN architectures. Objects cap- an inode) maintained by the storage device for
ture the benefits of both NAS (high-level the purposes of managing the physical storage of
abstraction that enables cross-platform data the object.
sharing as well as policy-based security) and We refer to a device that stores objects as an
SAN (direct access and scalability of a switched object-based storage device (OSD). OSDs can
fabric of devices). Although objects do behave come in many forms, ranging from a single disk
like files in terms of space allocation and data drive to a storage controller with an array of
access, they are only intended to serve as con- drives. OSDs are not limited to random access
tainers for storage applications (e.g., file systems or even writeable devices; tape drives and optical
and databases), which implement any desired media could also be used to store objects. The
additional interfaces (e.g., locking) and lookup difference between an OSD and a block-based
mechanisms (e.g., directories). device is the interface, not the physical media.
An object is variable-length and can be used The most immediate effect of object-based
to store any type of data, such as files, database storage is the offloading of space management
records, medical images, or multimedia. A single (i.e., allocation and tracking of used and free
object could even be used to store an entire file blocks) from storage applications. To illustrate
system or database. The storage application this offloading, consider the traditional file sys-
decides what gets stored in an object. Unlike tem architecture (Fig. 3a). Block-based file sys-
block I/O, creating objects on a storage device is tems can roughly be divided into two sections: a
accomplished through a rich interface similar to user component and a storage component. The
a file system. And, because objects can grow and user component is responsible for presenting
shrink dynamically, the storage device is respon- user applications with logical data structures,
sible for all internal space management of the such as files and directories, and an interface for
object (i.e., the storage device maintains the accessing these data structures; and the storage
allocation and free-space metadata structures, component maps the data structures to the phys-
such as UNIX index nodes, or inodes, and free- ical storage. This separation of responsibilities
block bitmaps). makes it easy to offload management to the stor-
Objects are composed of data, user-accessible age device, which is the intended effect of object-
attributes, and device-managed metadata. The based storage. In Fig. 3b, the user component of
Storage area network the number and types of clients in the system.
While an OSD does not question the authen-
nt
me ticity of the client, it does need some mechanism
age
n to validate the integrity of the capability, or
Ma
proof that the object manager granted access to
the client. Providing this guarantee requires that
Secret the object manager and device share a secret
that can be used in creating a secure hash of the
contents of the capability. Before granting a
Object-based storage devices Cap. client its capability, the manager will first create
a keyed hash of the capability, using the secret as
■ Figure 4. The object-based storage security architecture. Object managers the key. It will then return both the secure hash,
grant capabilities to clients; clients present these capabilities to the devices on referred to as a capability key, amf the capability
every I/O. Secrets shared between the manager and the storage devices are to the client. The client is expected to use this
used to generate a keyed hash of the capability, thereby protecting it from capability key in creating its own keyed hash of
modification. every request sent to the OSD. This hash pro-
tects the command from undetected modifica-
tion, similar to how the hash of the capability
protects the capability from modification.
or randomly accessed), or even relationships to The request sent to an OSD includes the
other objects. For example, multimedia files on a command, the client capability, and a signature
storage device may have similar attributes that (or digest) of the entire request. Upon receipt of
will cause them to be organized and efficiently a new request, the OSD must first validate the
managed as a group. client digest. The OSD will create its own digest
of the request and compare this with the digest
SECURITY sent by the client. 2 If they match, the OSD is
Security is perhaps the single most important fea- guaranteed that neither the capability nor any of
ture of object-based storage that distinguishes it the arguments in the request were modified.
from block-based storage. Although security does Had either of these changed, the digest generat-
exist at the device and fabric level for SANs (e.g., ed by the OSD would differ from that sent by
devices may require a secure login and switches the client, and the OSD would reject the request;
may implement zoning), objects make it possible all responses sent from the OSD to the client
to partition large devices or fabrics into multiple can be protected using a digest similar to that
security domains whose access policies are indi- sent by the client.
vidually determined by the storage applications. In some environments, object-based storage
In the object-based security architecture [3], must also ensure the privacy of data transfers
every access is authorized, and the authorization and guard against delay and replay attacks. In
is done without communicating with a central the absence of a trusted channel (e.g., IPSec),
authority that may slow the data path (Fig. 4). the object-based storage security architecture
The storage application in Fig. 4 could be a allows the capability key to be used as an encryp-
file server that stores each file as an individual tion key, thereby safeguarding the client and
2 It is not immediately object on a storage device. This architecture is storage devices from snooping attacks. Delay
obvious how this is possi- identical to the SAN file system shown in Fig. 2, and replay attacks are prevented by adding client
ble when the storage with one important distinction: the clients no timestamps and sequence numbers to each I/O,
device does not possess longer have to be trusted, nor does the network. respectively. The timestamp will establish a small
the capability key used to This means that the clients and storage devices window in which the command is valid. If the
generate the digest. How- can be anywhere on the network, without the command is received by the storage device out-
ever, recall that the capa- risk of unauthorized clients accessing the stor- side of this window, it will not be authorized.
bility key is just a hash of age, or authorized clients accessing the storage Similarly, the storage device can check the
the client’s capability in an unauthorized manner. sequence number of each command and reject
(which was sent in the The fundamental building block in an object- those that have already been executed.
request), and the secret based security system is a cryptographically To avoid a trip to the object manager on
shared between the object strong capability that contains a tamper-proof every I/O, clients may cache and reuse capabili-
manager and the OSD. description of the rights of a client. This capabil- ties. The object manager revokes cached capabil-
Thus, the OSD can simply ity represents the security policy, and is created ities by embedding expiration times in the
regenerate the capability out-of-band (i.e., off the main data path) by an capability or establishing a new secret with the
key and use this key to object manager that manages the storage devices storage device.
generate its digest of the and grants access to clients. While in possession Although the object manager has been taken
request. of this capability, the client can access the stor- off the data path, it is still a single point of fail-