6

I need an end-to-end multi-client/multi-supplier secure storage system, I can build it using various bits and pieces but it feels overcomplex - am I missing a trick?

Specifically I need to offer multiple clients VPN-secured, secure file transfer into a secure filesystem (as in encrypted on the disk/over fibre) then served out, again via VPN-secured, secure file transfer to a range of other suppliers. No client files can 'mix' at any point and ALL points in the chain must be secure. Oh and it has to be highly resilient, so this must all be clustered/load-balanced. Expecting around 500GB/client/supplier per day, total storage is unlikely to go over 30TB.

My current thought is to use a combination of Checkpoint Virtual Firewalls, 2/3 VMware hosts with lots of NICs connected to the FW, each host connected via Brocade secure FC HBAs to a secure FC SAN box, with each client's VPN tunnel being truncated inside their own VM (which will be clustered using a front-end load balancer), the VMs will then SFTP over the tunnel from the client, drop the files over the secure FC into a dedicated disk-group/LUN/datastore/VMDK chain. Then I'd do the same the other way out to suppliers (except we do apply some DRM as we transmit).

I'd appreciate any suggestions of how to make this simpler, more secure or both.

Thank you.

Chopper3
  • 101,299
  • 9
  • 108
  • 239
  • I'm torn between jealousy of your cool project and thanking God that I don't have to do it – Matt Simmons Jun 02 '09 at 12:04
  • Also, when you complete it, you need to submit a paper to one of the IT journals, because this can be a learning experience for so many people – Matt Simmons Jun 02 '09 at 12:06
  • Oh man, this is a TINY subcomponent of a much bigger project - the bigger challenges keep me up at night :( – Chopper3 Jun 02 '09 at 12:43

4 Answers4

3

Seems like you've covered it.

We use a secure file transfer vendor - Accellion - as they provide a pretty decent all-in-one solution, that also runs on top of VMWare (they provide a complete vm image).

One requirement is that everything be encrypted - so you have to get on the VPN to access the service. Once in, the vm appliance takes over, authenticates users, stores the files where you need them to be on the SAN, encrypting everything in its path.

Mike Fiedler
  • 2,162
  • 1
  • 17
  • 34
1

NetApp has some secure storage options as well, even with integration into tape encryption etc.

pfo
  • 5,700
  • 24
  • 36
1

You can also look at IBM ISS solutions as well for securing your file and data transfer protocols using the IPS appliance. This would help maintain security of these systems.

1

I'd be doing a lot of research into which VM solution to use. There are some known exploits in VMWare (and likely other solutions as well) that will allow one compromised virtual machine to access the memory space of the host (and thus, other virtual machines).

Mark Henderson
  • 68,823
  • 31
  • 180
  • 259