Hayato Ishibashi

NFS‐based secure file sharing over multiple administrative domains with minimal administration

Although several schemes of file sharing for Unixes have been proposed so far, file sharing by these schemes between different administrative domains is difficult and imposes enormous burden on the administrators even if file sharing is possible since the user information differs by such computers in general. In this paper, the file system PNFS (Proxy/Private Network File System), which makes file sharing based on NFS easy between different administrative domains, is proposed. With PNFS, a user can share files of a server that has his account without intervention of its administrator. Although, in general, a decrease in security occurs when intervention of an administrator is omitted, security is enhanced by encryption and the like by the PNFS. In addition, the efficacy of the proposed system has been verified by performance evaluation of a prototype system, which shows a practically sufficient throughput even with simultaneous accesses from a multiple number of clients.

Toward Fault-Tolerant P2P Systems: Constructing a Stable Virtual Peer from Multiple Unstable Peers

P2P systems must handle unexpected peer failure and leaving, and thus it is more difficult to implement than server-client systems. In this paper, we propose a novel approach to implement P2P systems by using virtual peers. A virtual peer consists of multiple unstable peers. A virtual peer is a stable entity; application programs run on a virtual peer are not compromised unless a majority of the peers fail within a short time duration. If a peer in a virtual peer fails, the failed peer is replaced by another (non-failed) one to restore the number of working peers. The primary contribution of this paper is to propose a method to form a stable virtual peer over multiple unstable peers. The major challenges are to maintain consistency between multiple peers and to replace a failed peer with another one. For the first issue, the Paxos consensus algorithm is used. For the second issue, the process migration technique is used to replicate and transfer a running process to a remote peer. Furthermore, the relation between the reliability of a virtual peer and the number of peers assigned to a virtual peer is evaluated. The proposed method is implemented in our musasabi P2P platform. An overview of musasabi and its implementation is also given.

An Efficient Management Method of Access Policies for Hierarchical Virtual Private Networks

VPN (virtual private network) is one of the most important technologies on the Internet. With VPN, we can securely access to resources in the organizational network via the Internet. In VPNs having hierarchical structure, since each VPN domain has different access policy (whether VPN gateway should perform authentication, data encryption, and so on or not), an administrator of a VPN domain may need to configure access policies which are different from every VPN sub-domain. However, in the existing VPN methods, since access policies are stored in a static configuration file of each VPN gateway, an administrator of a VPN domain has to cooperate with the other administrators of its sub-domains. Therefore, management cost of access policies becomes considerably large if the organization has large and complicated structure. In this paper, we propose an efficient management method of access policies for hierarchical VPNs. In order to reduce management cost, we introduce a database with hierarchical structure to represent access policies easily and policy servers to get access policies automatically. The effectiveness of our proposed method is confirmed by an experiment on an actual network using policy servers based on the proposed method.

New Approach for Configuring Hierarchical Virtual Private Networks Using Proxy Gateways

VPN is one of key technologies on the Internet that allows users to access securely to resources in a domain via unsecure networks. For hierarchically nested security domains, such as an RD and by incorporating a proxy gateway to accommodate communication between clients and the security gateway, this permits secure and highly efficient communications without modifying the client or server.