基于SSH的安全iSCSI技术研究

Research of an Security iSCSI Based SSH

iSCSI是一种基于TCP/IP的网络存储协议标准.本文首先分析了iSCSI面临的安全与性能问题,指出了采用IPSec提高iSCSI安全性的局限性,然后提出了基于SSH的安全iSCSI方案,利用SSH的端口转发功能,在TCP层建立安全的加密连接,从而保证iSCSI会话的安全.试验表明,与基于IPSec的安全iSCSI相比,在采用同样的加密算法和保证同样的安全级别的情况下,基于SSH的安全iSCSI吞吐量可以提高20%,CPU占用率也大幅度下降达50%,性能明显好于基于IPSec的安全iSCSI方案.对于iSCSI应用来讲,性能与安全都是至关重要的.因此,本文对于在二者之间寻找一个平衡点具有一定的启发意义.

iSCSI is a standard that enable block storage accesses over TCP/IP networks. This paper analyzed the security and performance problems of iSCSI, pointed out the limitations in using IPSec for improving the security of iSCSI and presented the iSCSI security scheme based on SSH. With application of SSH port forward, a secure connection can be built in TCP layer to ensure the security of iSCSI session. Experiments showed that with the same encrypt algorithm and security grade, throughput of the security iSCSI based on SSH increases 20%, furthermore, CPU utilized percent greatly decrease 50%, compared with the security iSCSI based on IPSec, so, the quality of the security iSCSI based on SSH is obviously superior to the one based on IPSec. As to the application of iSCSI, both performance and security are important. Therefore, this paper had some enlightening significance in finding out a good balance between the two sides.