Re: [Vrs-development] Cluster image security/privacy question

[Eric Altendorf]

On Saturday 27 April 2002 06:08, Bill Lance wrote:
> This is a very good question.
>
> BTW, it's not possible to be too paranoid when dealing
> with security and privacy.
>
> Chris's recent discussion of graphing connected nodes
> might address this.

I've been thinking about this for a while, and I think that in general it's
just going to be too problematic to try to implement a VRS as a union of
"sub-clusters"...  and that it's probably not necessary.

Unless the VRS is quite large and has very high redundancy, each node will
generally need to be able to talk directly to each other node.  For instance,
take the distributed filesystem... when a machine needs to load block X of a
file, it's going to want to talk directly to one of the machines that
physically hosts block X.  I suppose it depends on the redundancy of physical
hosting of data blocks, but in general I expect that each node will need to
be able to talk to each other node on the VRS.

We should probably just be very careful with our table of VRS nodes.  We
should also make sure that we only a few IP addresses in
tables, and instead use node ID's that are defined within the given VRS.
Then we can have a lookup service that will return the IP of a node given its
ID.  In that case, if someone gets a copy of the node table, they'll know
only some virtual ID numbers, and the capabilities of those hosts, which
should not do them any good unless they themselves can authenticate into the
VRS and use the lookup service to obtain actual IP addresses of the nodes.
Basically, as we are distributing everything else, we should distribute the
storage of the node ID -> IP address mapping.

Eric

--
"First they ignore you.  Then they laugh at you.
 Then they fight you.  And then you win."             -Gandhi