TTP: Small: NFS4Sec: An Extensible Security Layer for Network Storage

网络文件系统(NFS)是计算机通过网络访问文件的一种流行方法。此IETF协议的最新主要版本Version 4被广泛接受，并包括许多新功能，以提高在广域网上使用时的安全性、性能和可用性。然而，NFSv4的S安全关注的是网络范围的加密(确保用户数据不被截取)和用户身份验证(确保只有合法用户可以访问他们的文件)；它没有解决端到端数据安全(即，永久存储的数据)，没有解决数据完整性(恶意或良性数据损坏)等问题。这个项目扩展了NFSv4，增加了一个安全层，允许开发多个可组合的插件模块来增强协议的安全性。这一层允许拦截客户端和服务器之间的协议请求，以执行各种有用的安全功能：记录用户和主机对文件的访问，这对法规遵从性报告和审计很有用；检查文件中的恶意软件模式并自动将其隔离；针对恶意更改(例如，特洛伊木马入侵)和良性但严重的更改(例如，存储介质退化和硬件损坏)验证长期文件的完整性；检测拒绝服务尝试，并通过负载平衡和重定向确保合法用户的服务质量；自动快照和日志记录，以允许取证分析和从故障和入侵中恢复。在基于云的时代，更多的数据存在时间更长，并且可以通过广域、不安全的网络进行访问，该项目有助于提高每个用户数据文件的安全级别。

The Network File System (NFS) is a popular method for computers to access files across networks. The latest major version of this IETF protocol, version 4, is widely accepted and includes numerous new features to improve security, performance, and usability when used over wide-area networks. However, the NFSv4's security focus is on network-wide encryption (ensuring that user data cannot be intercepted) and user authentication (ensuring that only legitimate users can access their files); it does not address end-to-end data security (i.e., persistently stored data), does not address data integrity (malicious or benign data corruptions), and more.This project extends NFSv4 with a security layer that allows one to develop multiple, composable plugin modules to enhance the protocol's security. This layer allows for interception of protocol requests between clients and servers to perform various useful security functions: logging access to files by users and hosts, useful for regulatory compliance reports and audits; inspecting files for malware patterns and automatically quarantining them; verifying the integrity of long-lived files against malicious changes (e.g., Trojan intrusions) and benign but serious ones (e.g., storage media degradation and hardware corruptions); detecting denial-of-service attempts and ensuring quality-of-service to legitimate users through load-balancing and redirection; automatic snapshotting and logging to allow for forensic analysis and recovery from failures and intrusions. In a cloud-based era where more data lives longer and is accessed over wide-area, insecure networks, this project helps elevate the level of security of every user's data files.