一种分布式存储系统拟态化架构设计与实现

doi:10.19678/j.issn.1000-3428.0056660

计算机工程 ›› 2020, Vol. 46 ›› Issue (6): 12-19. doi: 10.19678/j.issn.1000-3428.0056660

一种分布式存储系统拟态化架构设计与实现

郭威^1a, 谢光伟², 张帆^1a, 李敏^1b

1. 战略支援部队信息工程大学 a. 信息技术研究所;b. 教研保障中心, 郑州 450002;
2. 复旦大学计算机科学技术学院, 上海 200203

收稿日期:2019-11-21 修回日期:2020-01-10 发布日期:2019-12-14
作者简介:郭威(1990-),男,博士,主研方向为信息安全、分布式存储系统、大数据分析与处理;谢光伟,高级工程师、博士;张帆(通信作者),副研究员、博士;李敏,讲师、硕士。
基金资助:
国家自然科学基金面上项目“网络空间拟态安全异构冗余机制研究”（61572520）；上海市信息化发展专项资金“拟态大数据一体机研制”（201701046）。

Design and Implementation of a Mimic Architecture for Distributed Storage System

GUO Wei^1a, XIE Guangwei², ZHANG Fan^1a, LI Min^1b

1a. Institute of Information Technology;1b. Teaching and Research Support Center, PLA Strategic Support Force Information Engineering University, Zhengzhou 450002, China;
2. School of Computer Science, Fudan University, Shanghai 200203, China

Received:2019-11-21 Revised:2020-01-10 Published:2019-12-14

摘要/Abstract

摘要： 针对当前分布式存储系统中漏洞后门威胁导致的数据安全问题，通过引入网络空间拟态防御理论及其相关安全机制，从结构角度出发增强系统的安全防护能力。对分布式存储系统面临的主要威胁和攻击途径进行分析，定位其核心薄弱点，结合防护的代价与有效性提出一种可行的系统安全构造方法。以大数据Hadoop分布式文件系统为目标对象，设计面向元数据服务的拟态化架构，利用搭建元数据服务的动态异构冗余结构保护系统核心信息和功能，通过对副本的异构化放置保护用户数据，并在此架构基础上设计基于反馈信息的裁决调度联动机制。测试结果表明，该方法能够有效提升分布式存储系统的安全性。

关键词: 大数据, 数据安全, 网络空间拟态防御, 分布式存储系统, 裁决与调度机制

Abstract: To address the data security problems caused by vulnerabilities and backdoors in existing distributed storage systems,this paper proposes a feasible security construction method for system by introducing the Cyberspace Mimic Defense(CMD) theory and its related security mechanism.The architecture aims at enhancing the security protection ability of the system.During the design process,the main threats and attack ways to distribute storage systems are analyzed to locate system’s core weakness,and the cost and effectiveness of protection are also considered.Taking the Hadoop Distributed File System(HDFS) for big data as the target object,the mimic architecture for metadata services is designed.This paper builds the Dynamic Heterogeneous Redundancy(DHR) structure of metadata services to protect the core information and functions of the system.Then the heterogeneous placement of copies is implemented to protect user data.On the basis of this architecture,a collaborative arbitration and scheduling mechanism based on feedback information is proposed.Test results show that the proposed method can effectively improve the security of distributed storage system.

Key words: big data, data security, Cyberspace Mimic Defense(CMD), distributed storage system, arbitration and scheduling mechanism

中图分类号:

TP309

郭威, 谢光伟, 张帆, 李敏. 一种分布式存储系统拟态化架构设计与实现[J]. 计算机工程, 2020, 46(6): 12-19.

GUO Wei, XIE Guangwei, ZHANG Fan, LI Min. Design and Implementation of a Mimic Architecture for Distributed Storage System[J]. Computer Engineering, 2020, 46(6): 12-19.

https://www.ecice06.com/CN/Y2020/V46/I6/12

图/表 11

20200617085055

20200617085058

20200617085101

20200617085104

20200617085108

20200617085111

20200617085113

20200617085117

20200617085120

20200617085123

20200617085126

参考文献

[1] SIDDIQA A,KARIM A,GANI A.Big data storage technologies:a survey[J].Frontiers of Information Technology & Electronic Engineering,2017,18(8):1040-1070.
[2] ARMIN J,FOTI P,CREMONINI M.0-day vulnerabilities and cybercrime[C]//Proceedings of the 10th International Conference on Availability,Reliability and Security.Washington D.C.,USA:IEEE Press,2015:711-718.
[3] ZHANG Y,JUELS A,REITER M K,et al.Cross-tenant side-channel attacks in PaaS clouds[C]//Proceedings of 2014 ACM SIGSAC Conference on Computer and Communications Security.New York,USA:ACM Press,2014:990-1003.
[4] XIAO Zhifeng,XIAO Yang.Security and privacy in cloud computing[J].IEEE Communications Surveys & Tutorials,2013,15(2):843-859.
[5] WU Jiangxing.Research on cyber mimic defense[J].Journal of Cyber Security,2016,1(4):1-10.(in Chinese)邬江兴.网络空间拟态防御研究[J].信息安全学报,2016,1(4):1-10.
[6] JAJODIA S,GHOSH A K,SWARUP V,et al.Moving target defense:creating asymmetric uncertainty for cyber threats[M].[S.l.]:Springer Science & Business Media,2011.
[7] VOAS J,GHOSH A,CHARRON F,et al.Reducing uncertainty about common-mode failures[C]//Proceedings the 8th International Symposium on Software Reliability Engineering.Washington D.C.,USA:IEEE Press,1997:308-319.
[8] TONG Qing,ZHANG Zheng,ZHANG Weihua,et al.Design and implementation of mimic defense Web server[J].Journal of Software,2017,28(4):883-897.(in Chinese)仝青,张铮,张为华,等.拟态防御Web服务器设计与实现[J].软件学报,2017,28(4):883-897.
[9] MA Hailong,JIANG Yiming,BAI Bing,et al.Tests and analyses for mimic defense ability of routers[J].Journal of Cyber Security,2017,2(1):43-53.(in Chinese)马海龙,江逸茗,白冰,等.路由器拟态防御能力测试与分析[J].信息安全学报,2017,2(1):43-53.
[10] QI Chao,WU Jiangxing,HU Hongchao,et al.An intensive security architecture with multi-controller for SDN[C]//Proceedings of 2016 IEEE Conference on Computer Communications Workshops.Washington D.C.,USA:IEEE Press,2016:401-402.
[11] XU Mixue,YUAN Chao,WANG Yongjuan,et al.Mimic blockchain-solution to the security of blockchain[J].Journal of Software,2019,30(6):1681-1691.(in Chinese)徐蜜雪,苑超,王永娟,等.拟态区块链——区块链安全解决方案[J].软件学报,2019,30(6):1681-1691.
[12] WEI Shuai,YU Hong,GU Zeyu,et al.Architecture of mimic security processor for industry control system[J].Journal of Cyber Security,2016,2(1):54-73.(in Chinese)魏帅,于洪,顾泽宇,等.面向工控领域的拟态安全处理机架构[J].信息安全学报,2016,2(1):54-73.
[13] WANG Zhenpeng,HU Hongchao,CHENG Guozhen.A DNS architecture based on mimic security defense[J].Acta Electronica Sinica,2017,45(11):139-148.(in Chinese)王禛鹏,扈红超,程国振.一种基于拟态安全防御的DNS框架设计[J].电子学报,2017,45(11):139-148.
[14] LIN Zhili,LI Kedan,HOU Hanxu,et al.MDFS:a mimic defense theory based architecture for distributed file system[C]//Proceedings of 2017 IEEE International Conference on Big Data.Washington D.C.,USA:IEEE Press,2017:2670-2675.
[15] GHEMAWAT S,GOBIOFF H,LEUNG S T.The Google file system[C]//Proceedings of the 19th ACM Symposium on Operating Systems Principles.New York,USA:ACM Press,2003:20-43.
[16] CHEN Yue,WANG Longjiang,YAN Xincheng,et al.Mimic storage scheme based on regenerated code[J].Journal on Communications,2018,39(4):21-34.(in Chinese)陈越,王龙江,严新成,等.基于再生码的拟态数据存储方案[J].通信学报,2018,39(4):21-34.
[17] HU Hongchao,CHEN Fucai,WANG Zhenpeng.Performance evaluations on DHR for cyberspace mimic defense[J].Journal of Cyber Security,2016,1(4):40-51.(in Chinese)扈红超,陈福才,王禛鹏.拟态防御DHR模型若干问题探讨和性能评估[J].信息安全学报,2016,1(4):40-51.
[18] SHVACHKO K,KUANG H,RADIA S,et al.The Hadoop distributed file system[C]//Proceedings of MSST'10.Washington D.C.,USA:IEEE Computer Society,2010:1-10.
[19] SPIVEY B,ECHEVERRIA J.Hadoop security:protecting your big data platform[M].[S.l.]:O'Reilly Media,Inc.,2015.
[20] MOHSIN M,ANWAR Z.Where to kill the cyber kill-chain:an ontology-driven framework for iot security analytics[C]//Proceedings of 2016 International Conference on Frontiers of Information Technology.Washington D.C.,USA:IEEE Press,2016:23-28.

选择文件类型/文献管理软件名称

选择包含的内容

一种分布式存储系统拟态化架构设计与实现

Design and Implementation of a Mimic Architecture for Distributed Storage System

RichHTML

PDF

可视化

被引次数

摘要/Abstract

引用本文

使用本文

图/表 11

参考文献

相关文章 15

编辑推荐

Metrics

本文评价

[1]	周小华, 周园春, 孟珍, 王学志. 大规模开放遥感影像地图渲染与缓存优化[J]. 计算机工程, 2024, 50(7): 227-239.
[2]	熊世强, 何道敬, 王振东, 杜润萌. 联邦学习及其安全与隐私保护研究综述[J]. 计算机工程, 2024, 50(5): 1-15.
[3]	王新迪, 杨夙, 张思源, 罗午阳, 李杰, 刘辉. 基于时空大数据与卫星图像的城市火灾风险预测[J]. 计算机工程, 2023, 49(6): 242-249.
[4]	杨珂, 张帆, 郭威, 赵博, 穆清. 一种拟态存储元数据随机性问题解决方法[J]. 计算机工程, 2022, 48(2): 140-146,155.
[5]	张利华, 曹宇, 张赣哲, 黄阳, 陈世宏. 基于区块链的微电网数据安全共享方案[J]. 计算机工程, 2022, 48(1): 43-50.
[6]	周远林, 陶洋, 李正阳, 杨柳. 基于双簇头的无线传感器网络反馈信任模型[J]. 计算机工程, 2021, 47(3): 174-182.
[7]	李凌书, 邬江兴. 面向云网融合SaaS安全的虚拟网络功能映射方法[J]. 计算机工程, 2021, 47(12): 30-39.
[8]	王芝辉, 王晓东. 基于神经网络的文本分类方法研究[J]. 计算机工程, 2020, 46(3): 11-17.
[9]	张海军, 陈映辉. 基于类图像处理与向量化的大数据脚本攻击智能检测[J]. 计算机工程, 2020, 46(3): 129-137,143.
[10]	王重仁, 王雯, 佘杰, 凌晨. 融合深度神经网络的个人信用评估方法[J]. 计算机工程, 2020, 46(10): 308-314.
[11]	白玲玲, 宁振虎, 薛菲, 杨永丽. 隐马尔可夫模型在恶意域名检测中的应用[J]. 计算机工程, 2019, 45(9): 161-168.
[12]	张玺君, 袁占亭, 张红, 高玮军, 张恩展. 交通轨迹大数据预处理方法研究[J]. 计算机工程, 2019, 45(6): 26-31.
[13]	钱雪忠,姚琳燕. 面向稀疏高维大数据的扩展增量模糊聚类算法[J]. 计算机工程, 2019, 45(6): 75-81.
[14]	胡子杰,张帆,沈继忠,赵新杰. 针对民用无人机的遥控数据保护方法[J]. 计算机工程, 2019, 45(4): 100-107.
[15]	蒋猛,禹明刚,王智学. 多策略自适应大规模本体映射算法[J]. 计算机工程, 2019, 45(3): 14-19.

模态框（Modal）标题

选择文件类型/文献管理软件名称

选择包含的内容

一种分布式存储系统拟态化架构设计与实现

Design and Implementation of a Mimic Architecture for Distributed Storage System

RichHTML

PDF

可视化

被引次数

摘要/Abstract

引用本文

使用本文

图/表 11

参考文献

相关文章 15

编辑推荐

Metrics

本文评价