CS 111

Scribe Notes for 5/31/12

By Emily Kim

Media Faults

When disk, SSD, etc. fails, we want reliable crashes

1. Hard disk – lose the performance benefits of SSD

2. Backup battery – have to deal with maintaining the battery and switching it out when it dies

RAID: Redundant Array of Independent Disks

Types of RAID

· RAID 0

o Concatenation – connects several small disks to create a large disk

o Striping – splitting a block of data between disks to increase throughput

· RAID 1

o Mirroring – copy of the same data on two different disks

§ Slower writes, but faster reads

· RAID 4

o Easy to add disk (All 0's for new disk; no need to recalculate parity drive)

o Data blocks in parity disks are calculated by using exclusive or on the data blocks from the data disks

§ F=A^B^C^D^E

§ If block B is lost, B=A^C^D^E^(F)

· RAID 5

o Identical to RAID 4 except uses striping for the parity disk

§ Prevents the parity disk from becoming a hotspot

o More difficult to add more disks

What's the disk failure rate?

MTTR on RAID 4 (mean Time to Repair)

1. Notification

2. Replacement

3. Copying data over to replaced disk (SLOW!!)

NFS Security

What can go wrong?

· Mimics Linux behaviors

o Process 1: fd = open(“/tmp/foo”, O_RDONLY)

Process 2: chmod(“/tmp/foo”, 0000)

o Process 2 wants to make the file “foo” inaccessible, but since Process 1 already has the file open, it will still be able to read from that file

· Since the NFS server is stateless, the client kernel is trusted to do permission checking

o Allows bad kernels to masquerade as good users

How do we defend against these security problems?

· Physical protection

· Virtual Private Networks (VPNs)

· Individual Authentication

Security

Main Form of Attacks

· Privacy – unauthorized data release

· Integrity – Tampering with data

· Service – Denial of service

You want a system that:

1. Disallows unauthorized access

2. Allows authorized access

Threat Modeling

· Insiders – attack by getting inside the system

· Social Engineering – attack by pretending to be an insider

· Network Attacks – e.g. denial of service, viruses, drive by downloads, phishing

· Device attacks – e.g. USB viruses

General Functions Used for Defense

· Authentication (e.g. passwords, RSA keys)

· Integrity (e.g. timestamps, checksums)

· Authorization (e.g. access control lists)

· Auditing (e.g. logs)

· Efficiency

· Correctness

· Monitoring/Maintenance (for all of the above)