CN105404560A - RAID5 based security authentication method in object storage system - Google Patents

Abstract

The invention discloses a security authentication method based on RAID5 in an object storage system. The method includes: utilizing the safe, reliable and low-cost characteristics of RAID5, setting N TA servers on the critical path TA of the object storage system, integrating storage resources on the N TA servers, and deploying RAID5 on it. When the client sends an authentication request, TA? The Controller first assigns an ID to the authentication request, and performs a modulo operation on the ID, selects a target TA server to process the client-side authentication request, and returns the authentication request processing result to the TA? Controller. TA? The Controller stores the processing results in RAID5, and performs data access according to the RAID5 access mechanism. Redundant TA servers can effectively prevent single-point failures. At the same time, RAID5 can ensure rapid recovery when data is lost, and ensure the security of TA-side user data and service reliability. The invention can greatly improve the safety and reliability of the data at the TA end.

Description

A security authentication method based on RAID5 in object storage system

technical field

The invention belongs to the technical field of storage systems and security authentication, and more specifically relates to a security authentication method based on RAID5 (Redundant Arrays of Independent Disks 5, disk array 5) in an object storage system.

Background technique

With the advent of the era of big data, data has become an intangible and priceless asset, and its security and reliability have gradually been valued and concerned by countries, enterprises and individuals.

The trusted center (TrustedAuthority, TA) in the object storage system mainly includes important information such as user information list and certificate revocation list (CertificateRevocationList, CRL). When the TA server is attacked by hackers, there will be the following risks:

Data loss: Hackers intrude into the system, obtain user information, and then enter the object storage system to obtain the data stored in the object storage device (Object-based Storage Device, OSD) by the user, causing incalculable economic losses to the user.

Data damage: When hackers invade the system, they tamper and damage user data, making users unable to use the data in the OSD normally, resulting in immeasurable economic losses.

Service interruption: When a hacker invades the TA server, the implanted Trojan horse virus makes the TA server unable to provide services normally, resulting in service interruption, which will undoubtedly be a fatal blow to enterprises that need to provide uninterrupted services.

The related work of the existing object storage system is provided by a single TA server. Once the server is attacked, it will cause inestimable economic losses.

Contents of the invention

Aiming at the above defects or improvement needs of the prior art, the present invention provides a security authentication method based on RAID5 in the object storage system, deploying RAID5 on the critical path TA of the object storage system, and its purpose is to improve the security and reliability of the object storage system reliability; when a single TA server is attacked, the object storage system can continue to provide normal services to users; if data is lost or damaged, the data can be quickly restored through the RAID5 recovery mechanism.

In order to achieve the above object, the present invention provides a security authentication method based on RAID5 in an object storage system, comprising the following steps:

(1) Start N TA servers based on RAID5, and wait for the client (Client) to connect, where N is the number of TA servers;

(2) The client sends the authentication request to the trusted central controller (TAController), and the TAController selects one of the above-mentioned multiple TA servers as the target TA server;

(3) The selected target TA server processes the client's authentication request, and returns the authentication request processing result to TAController;

(4) The TAController dispersively stores the authentication request processing results into different disks constituting the RAID5 according to the RAID5 access mechanism.

In one embodiment of the present invention, said step (2) includes the following sub-steps:

(2.1) Authentication requests from multiple clients are first sent to TAController, and TAController numbers the authentication requests (such as 0, 1, 2...), and then moduloes the ID (ID%N) , the TA server whose number is equal to the result of the modulo operation is used as the target TA server, and the numbers of the above N TA servers are 1-N respectively;

(2.2) A connection path is established between the client end and the selected target TA server, and the selected target TA server is used to process the authentication request of the client end.

In one embodiment of the present invention, said step (3) includes the following sub-steps:

(3.1) The target TA server and client first generate their own session keys according to the parameters and algorithms agreed in advance, and the subsequent communication process is encrypted and transmitted through the session keys;

(3.2) The target TA server obtains the user name and password included in the authentication request sent by the client, and then performs legality verification on the user name and password. After the verification is passed, compare the information in the user information list to see if there is a data match;

The legality verification refers to verifying the format, length, and whether illegal characters are included in the user name and password.

(3.3) If there is a data match in the comparison, it means that the user information is already in the user list. It means that the certificate has been sent to the user and is within the validity period. At this time, the target TA server refuses to generate a new certificate for the user; if it is not in the user list, it means that the user is applying for a certificate for the first time, and the target TA server accepts the client's authentication request;

(3.4) The target TA server generates a private key and certificate through the user name and password, and encrypts the private key and certificate through the session key and sends it to the client. The client side decrypts the received private key and certificate data through its own session secret key, and then uses the private key to decrypt the certificate encrypted with the public key, and finally saves the certificate locally on the client side;

(3.5) The target TA server returns the authentication request processing result to TAController.

In one embodiment of the present invention, said step (4) includes the following sub-steps:

(4.1) The selected target TA server returns the data of the authentication request processing result to TAController and saves it in TAController;

(4.2) The TAcontroller disperses and stores the authentication request processing results returned by the target TA server into different disks constituting the RAID5 according to the RAID5 mechanism, so as to realize safe storage.

In one embodiment of the present invention, the value of N in the step (1) is 3.

Generally speaking, compared with the prior art, the above technical solution conceived by the present invention has the following beneficial effects: the present invention can effectively solve the problem of TA single-point failure and improve the reliability of the system by using redundancy technology; RAID5 technology allows hackers to intrude into a certain TA server, and can only obtain some user data instead of all user data, which further ensures the security of user data; using RAID5 technology, it can also quickly restore lost and damaged data, Ensure data security and reliability.

Description of drawings

FIG. 1 is a structural diagram of a redundant TA object storage system in an embodiment of the present invention;

Fig. 2 is a flow chart of TA server selection in the embodiment of the present invention;

Fig. 3 is a flow chart of storing data by a TA server in an embodiment of the present invention;

Fig. 4 is a flowchart of user registration and certificate issuance in the embodiment of the present invention.

detailed description

In order to make the object, technical solution and advantages of the present invention clearer, the present invention will be further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described here are only used to explain the present invention, not to limit the present invention. In addition, the technical features involved in the various embodiments of the present invention described below can be combined with each other as long as they do not constitute a conflict with each other.

As shown in Figure 1, the detailed description of the structure diagram of the redundant TA object storage system based on the method of the present invention is as follows:

The object storage system mainly includes four parts: the client client, the trusted center TA, the metadata server MDS, and the object storage device OSD.

The redundant TA object storage system is based on the object storage system, and builds redundant TA on the key path TA of the system to improve the reliability of the system.

Redundant object storage system process: first, the client sends an authentication request to TAController, and TAController first assigns an ID to the authentication request, then performs a modulo operation on the authentication request ID, selects the target TA server, and sends the user name and password information to the target TA server. The target TA server first establishes a communication line with the client, then processes the authentication request, and sends the processing result of the authentication request back to TAController, and TAController saves the user information to the TA cluster storage device that constitutes RAID5. At the same time, the certificate and private key are encrypted and sent to the client, and the client decrypts the obtained certificate and saves it locally. The client side sends the certificate and request to the MDS side, and the MDS side returns the capability certificate and metadata information to the client side after passing the verification. The client uses the obtained capability certificate and metadata information to send a request to the OSD to obtain the required data.

As shown in Figure 2, the TA server selection flow chart is described in detail as follows:

When the client sends an authentication request to the TA server, it is first sent to the TAController, and the TAController assigns an ID to the authentication request.

TAController performs a modulo operation on the authentication request ID (ID%3) to select the target TA server. If the result of the modulo operation is 0, select TA0 server numbered 0 to process the authentication request; if the result of the modulo operation is 1, select TA1 server numbered 1 to process the authentication request; if the result of the modulo operation is 2, select The TA2 server numbered 2 processes the authentication request.

As shown in Figure 3, the detailed description of the TA module storage data flow chart is as follows:

After TAController selects the target TA server for the client authentication request, it will establish a communication line between the client and the target TA server. The target TA server processes the client authentication request, and returns the authentication request processing result to TAController.

TAController disperses and stores the returned authentication request processing results into different disks constituting RAID5 according to the RAID5 access mechanism.

As shown in Figure 4, the flow chart of user registration and certificate issuance is described in detail as follows:

When the client sends an authentication request to TAController, TAController obtains the user information list in RAID5.

After the client sends an authentication request to TAController, TAController first monitors the user request, obtains the user name and password, and first performs legality verification. After the verification is passed, it compares the information in the user information list to see if there is any data matching. If there is a data match, it means that the user information is already in the list, and the certificate has been sent to the user, and the certificate is still valid. At this time, refuse to generate a new certificate for the user. If there is no data match, it means that the user is applying for a certificate for the first time, so generate a public and private key for it, transmit the certificate, and update the user information list.

Those skilled in the art can easily understand that the above descriptions are only preferred embodiments of the present invention, and are not intended to limit the present invention. Any modifications, equivalent replacements and improvements made within the spirit and principles of the present invention, All should be included within the protection scope of the present invention.

Claims (6)

1. a security authentication method based on RAID5 in an object storage system, is characterized in that, comprises the steps: (1) Start N TA servers based on RAID5, and wait for the client Client to connect, where N is the number of TA servers; (2) The client sends the authentication request to the trusted central controller TAController, and the TAController selects one of the above-mentioned multiple TA servers as the target TA server; (3) The selected target TA server processes the client's authentication request, and returns the authentication request processing result to TAController; (4) The TAController dispersively stores the authentication request processing results into different disks constituting the RAID5 according to the RAID5 access mechanism. 2. the security authentication method based on RAID5 in the object storage system as claimed in claim 1, is characterized in that, described step (2) specifically comprises the following sub-steps: (2.1) Authentication requests from multiple clients are first sent to TAController. TAController numbers the IDs of the authentication requests, and then performs a modulo operation ID%N on the IDs. The TA server whose number is equal to the result of the modulo operation is used as the target TA server. The numbers of the above N TA servers are 1-N respectively; (2.2) A connection path is established between the client end and the selected target TA server, and the selected target TA server is used to process the authentication request of the client end. 3. The security authentication method based on RAID5 in the object storage system according to claim 1 or 2, wherein said step (3) specifically includes the following sub-steps: (3.1) The target TA server and client generate their own session keys according to the parameters and algorithms agreed in advance, and the subsequent communication process is encrypted and transmitted through the session key; (3.2) The target TA server obtains the username and password contained in the authentication request sent by the client, and then performs legality verification on the username and password; after the verification is passed, compare the information in the user information list to check whether there is a data match; (3.3) If there is a data match in the comparison, it means that the user information is already in the user list, and the certificate has been sent to the user and is within the validity period. At this time, the target TA server refuses to generate a new certificate for the user; if it is not in the user list, Indicates that the user is applying for a certificate for the first time, and the target TA server accepts the client's authentication request; (3.4) The target TA server generates a private key and certificate through the user name and password, and encrypts the private key and certificate through the session key and sends it to the client; the client receives the private key and certificate data through its own session key pair Decrypt, then use the private key to decrypt the certificate encrypted with the public key, and finally save the certificate locally on the client side; (3.5) The target TA server returns the authentication request processing result to TAController. 4. The security authentication method based on RAID5 in the object storage system according to claim 1 or 2, wherein said step (4) specifically comprises the following sub-steps: (4.1) The selected target TA server returns the data of the authentication request processing result to TAController and saves it in TAController; (4.2) The TAcontroller disperses and stores the authentication request processing results returned by the target TA server into different disks constituting the RAID5 according to the RAID5 mechanism, so as to realize safe storage. 5. The security authentication method based on RAID5 in the object storage system as claimed in claim 3, characterized in that, performing legality verification in the step (3.2) refers to the format, length, and whether the user name and password contain illegal characters to verify. 6. The security authentication method based on RAID5 in the object storage system according to claim 1 or 2, wherein the value of N in the step (1) is 3.