TTP: Small: NFS4Sec: An Extensible Security Layer for Network Storage

网络文件系统（NFS）是计算机跨网络访问文件的常用方法。 该IETF协议的最新主要版本（版本4）被广泛接受，并包含许多新功能，以提高在广域网上使用时的安全性，性能和可用性。 然而，NFSv 4的安全重点是网络范围的加密（确保用户数据不会被拦截）和用户身份验证（确保只有合法用户才能访问他们的文件）;它不解决端到端数据安全（即，这个项目扩展了NFSv 4的安全层，允许开发多个可组合的插件模块来增强协议的安全性。 该层允许拦截客户端和服务器之间的协议请求以执行各种有用的安全功能：记录用户和主机对文件的访问，这对于法规遵从性报告和审计是有用的;检查文件的恶意软件模式并自动对其进行拦截;针对恶意更改验证长期文件的完整性（例如，特洛伊木马入侵）和良性但严重的（例如，存储介质退化和硬件损坏）;检测拒绝服务尝试并通过负载平衡和重定向确保合法用户的服务质量;自动快照和日志记录，以便进行取证分析并从故障和入侵中恢复。在基于云的时代，更多的数据寿命更长，并且通过广域不安全的网络访问，该项目有助于提高每个用户数据文件的安全级别。

The Network File System (NFS) is a popular method for computers to access files across networks. The latest major version of this IETF protocol, version 4, is widely accepted and includes numerous new features to improve security, performance, and usability when used over wide-area networks. However, the NFSv4's security focus is on network-wide encryption (ensuring that user data cannot be intercepted) and user authentication (ensuring that only legitimate users can access their files); it does not address end-to-end data security (i.e., persistently stored data), does not address data integrity (malicious or benign data corruptions), and more.This project extends NFSv4 with a security layer that allows one to develop multiple, composable plugin modules to enhance the protocol's security. This layer allows for interception of protocol requests between clients and servers to perform various useful security functions: logging access to files by users and hosts, useful for regulatory compliance reports and audits; inspecting files for malware patterns and automatically quarantining them; verifying the integrity of long-lived files against malicious changes (e.g., Trojan intrusions) and benign but serious ones (e.g., storage media degradation and hardware corruptions); detecting denial-of-service attempts and ensuring quality-of-service to legitimate users through load-balancing and redirection; automatic snapshotting and logging to allow for forensic analysis and recovery from failures and intrusions. In a cloud-based era where more data lives longer and is accessed over wide-area, insecure networks, this project helps elevate the level of security of every user's data files.