The Seagate ClusterStor Secure Data Appliance (SDA) is the HPC industry’s first scale-out secure storage system officially ICD-503 certified to consolidate multiple previously isolated systems, maintain data security, enforce security access controls, segregate data at different security levels, and provide audit trails, all in a single scale-out file system with proven linear performance and storage scalability. The ClusterStor SDA is built on Seagate’s successful ClusterStor family of high performance storage solutions for HPC and Big Data.
Download the Multilevel Security White Paper from the Editors of insideHPC
This is the forth article in a series designed to address the needs of government and business or collaborative and secure information sharing within a Multilevel Security (MLS) framework.
The new approach from Seagate packs a scalable high performance parallel file system into a single scale-out data storage solution designed to meet ICD 503 (DCID 6/3 PL4) cross domain solution requirements. A high performance parallel file system provides higher performance I/O throughput, higher access request metadata operations and larger file system data storage capacity than Network File System (NFS). Combining Security-Enhanced Linux (SELinux) with the Lustre® file system, the ClusterStor™ Secure Data Appliance is designed to deliver the industry’s first ICD 503 (DCID 6/3 PL4) certified compliant and secure scale-out parallel file system solution, providing the means to implement all the necessary Mandatory Access Control (MAC), explicit audit logging / tracking, encryption and support capabilities to enforce ICD 503 requirements for “least privilege” access control.
Security-Enhanced Linux
The National Security Agency (NSA) originated a set of security-enhanced patches to the Linux kernel that are now fully integrated into Linux source tree. The security enhancements add Mandatory Access Controls to the standard Discretionary Access Control functions already provided by standard Linux, such as file permissions and access control lists. SELinux utilizes a model of least-privilege where everything is denied and explicit policies are written granting the minimal access needed for an action. If a user tries to modify or use an action without sufficient permissions, access is denied and the activity is logged.
SELinux uses a security context, or security label, to classify resources, and enforces rules controlling how a given resource can be accessed. These contexts can be applied to processes, users, and data files.
SELinux is a proven operating system for secure environments that complies with the government standards required for Multilevel Security. Users may access only data and programs they have been granted access. The OS ensures they cannot access information they are not authorized to see. In addition, the OS can enforce these restrictions independent of the actions of programs, users, or administrators on that system, to protect against data leaks or unauthorized access.
When comprehensively integrated into the ClusterStor Secure Data Appliance, Seagate adds further enhancements to the combination of both SELinux and the Lustre parallel file system, as well as functional tuning and low level software optimization, all hosted on high performance scalable hardware building blocks with world-class storage management and support. No other system in the world combines the full set of these capabilities delivering secure scale-out storage at massive scale.
Lustre File System
At the center of the integrated ClusterStor solution is the Lustre file system, a scalable, high performance, parallel file system running on over 60% of today’s top 100 supercomputer centers worldwide (http://www.opensfs.org/lustre/). The Lustre file system provides a shared-file global namespace with manageable storage that can handle many thousands of clients and over 500 PB of data.
Development of the open source Lustre file system has been driven by growth in scientific, commercial and technical computing markets focused around data intensive simulation and modeling applications requiring high performance data processing, massively parallel I/O performance, low latency, high data storage capacity and high availability.
Architecturally, the Lustre file system separates metadata processing from data movement operations. This allows Lustre to complete file creation and access tasks (metadata requests) uninterrupted while movement of data completes via a separate and direct path between clients and end data storage targets. This state of the art architecture is the key to Lustre’s ability to provide a single shared global namespace that can dynamically scale both capacity and performance, as demonstrated in the largest HPC and Big Data installations in the world.
The next article in this series looks at ClusterStor Solution for HPC and Big Data. If you prefer you can download the entire article series in PDF format from the insideHPC White Paper Library courtesy of Seagate.
