Virtualization-aware access control for multitenant filesystems

Giorgos Kappes, Andromachi Hatzieleftheriou, Stergios V. Anastasiadis
2014 2014 30th Symposium on Mass Storage Systems and Technologies (MSST)  
In a virtualization environment that serves multiple tenants, storage consolidation at the filesystem level is desirable because it enables data sharing, administration efficiency, and performance optimizations. The scalable deployment of filesystems in such environments is challenging due to intermediate translation layers required for networked file access or identity management. First we present several security requirements in multitenant filesystems. Then we introduce the design of the
more » ... authorization architecture. It combines native access control with tenant namespace isolation and compatibility to object-based filesystems. We use a public cloud to experimentally evaluate a prototype implementation of Dike that we developed. At several thousand tenants, our prototype incurs limited performance overhead up to 16%, unlike an existing solution whose multitenancy overhead approaches 84% in some cases.
doi:10.1109/msst.2014.6855543 dblp:conf/mss/KappesHA14 fatcat:xrqiiluxl5fw7onaql6flc5q6y