Home / server / Questions / 17664
Accepted
Chopper3
Asked: 2009-06-03 03:55:11 +0800 CST

Secure storage solution sought

  • 772

I need an end-to-end multi-client/multi-supplier secure storage system, I can build it using various bits and pieces but it feels overcomplex - am I missing a trick?

Specifically I need to offer multiple clients VPN-secured, secure file transfer into a secure filesystem (as in encrypted on the disk/over fibre) then served out, again via VPN-secured, secure file transfer to a range of other suppliers. No client files can 'mix' at any point and ALL points in the chain must be secure. Oh and it has to be highly resilient, so this must all be clustered/load-balanced. Expecting around 500GB/client/supplier per day, total storage is unlikely to go over 30TB.

My current thought is to use a combination of Checkpoint Virtual Firewalls, 2/3 VMware hosts with lots of NICs connected to the FW, each host connected via Brocade secure FC HBAs to a secure FC SAN box, with each client's VPN tunnel being truncated inside their own VM (which will be clustered using a front-end load balancer), the VMs will then SFTP over the tunnel from the client, drop the files over the secure FC into a dedicated disk-group/LUN/datastore/VMDK chain. Then I'd do the same the other way out to suppliers (except we do apply some DRM as we transmit).

I'd appreciate any suggestions of how to make this simpler, more secure or both.

Thank you.

security storage-area-network sftp storage

4 Answers

  1. Best Answer

    Seems like you've covered it.

    We use a secure file transfer vendor - Accellion - as they provide a pretty decent all-in-one solution, that also runs on top of VMWare (they provide a complete vm image).

    One requirement is that everything be encrypted - so you have to get on the VPN to access the service. Once in, the vm appliance takes over, authenticates users, stores the files where you need them to be on the SAN, encrypting everything in its path.

    • 3

  2. You can also look at IBM ISS solutions as well for securing your file and data transfer protocols using the IPS appliance. This would help maintain security of these systems.

    • 1

  3. I'd be doing a lot of research into which VM solution to use. There are some known exploits in VMWare (and likely other solutions as well) that will allow one compromised virtual machine to access the memory space of the host (and thus, other virtual machines).

    • 1

  4. NetApp has some secure storage options as well, even with integration into tape encryption etc.

    • 1