Lipaul0623's Blog

Celerra Basic

lipaul0623 — Fri, 16 Oct 2009 07:44:29 +0000

The Celerra File Server cabinet contains a cluster of up to 14 independent Data Movers that
Channels between operate as autonomous dedicated file servers, establishing highly efficient channels between the
Data and the Network data and the network. Data Movers enable concurrent access to file systems by heterogeneous
network clients using multiple network technologies (including Ethernet, Gigabit Ethernet, FDDI,
and ATM). Celerra supports industry-standard Network File System (NFS), Common Internet File
Systems (CIFS), FTP, and WebNFS protocols.

Celerra File Server Hardware

The hardware architecture of Celerra File Server (Figure 3) includes four backplanes, each with the
capacity of four hardware slots. The lower left slot is reserved for the Control Station. A second
(e.g., redundant) Control Station can use the lower right slot to support non-disruptive Control
Station failover. (Data Mover failover does not require redundant Control Stations.) The remaining
14 hardware slots are for Data Movers, each composed of an Intel®-based motherboard, PCI bus,
network cards, SCSI cards, and/or fibre connections. The minimum configuration provides two Data
Movers. Data Movers can be added to increase capacity and performance as environments grow.

Cluster Processing

A group of independent systems working together as a single system (e.g., cluster) appears to
and Data Movers system managers as a single high-performance, highly available server. Cluster configurations
ensure availability and scalability in business-critical computing applications.

Clustering assumes many forms in delivering scalability and high performance. Adding another
server, for example, provides additional processing power to handle more complex, or a greater
number of, requests from clients. Clustered servers assume the workload of a failed server without
impacting client or network performance.

The fine granularity and the autonomous nature of the servers in the Celerra cluster — the Data
Movers — provide superior fault isolation and containment. Their unique design isolates and
limits the impact of failures to individual Data Movers, allows for seamless Data Mover failover
and replacement, and permits near-linear scaling of performance by achieving parallelism across
Data Movers. Data Movers mount and export file systems and respond to client requests for data
access. In addition, the diskless Data Movers and Control Stations maintain a database of all information
pertaining to their configurations, the file systems mounted by them, and file locks on the
highly reliable and available Symmetrix storage systems.

Celerra DART

The Data Movers run Data Access in Real Time (DART), an optimized, embedded operating
Operating System Software system designed exclusively for high-performance network file access with multi-protocol support.
This realtime, multi-threaded operating system ensures highly optimized network file access, as
illustrated in Figure 4.

DART separates control and data paths, enables high throughput rates, maintains responsiveness
to user requests and enhances data availability. Its intelligent scheduling algorithms maintain
sustained throughput under increasing loads and avoid throughput degradation, even under
overload conditions.
DART’s transaction-based file system, UxFS, maintains a log of all the file system metadata
changes. In the event of a failure and reboot, only the log needs recovery through a short, constantduration
operation, independent of the number of file systems and the amount of storage involved,
eliminating the need to use fscheck in the majority of cases.
Note: Celerra’s metadata logging typically handles reboot recovery in minutes. General-purpose
computers without metadata logging can require hours for rebooting and file system checking.
Write gathering, a DART optimization feature, contributes to Celerra’s superior write performance.
Additional write performance improvements include the non-volatile Symmetrix system,
which uses batteries to protect cache from power loss and prevent corruption. As required by NFS,
Symmetrix provides synchronous data writes (and asynchronous destaging) to disk before
acknowledging writes to clients.

System Administration

The Control Station performs Celerra’s system configuration and administrative functions and
and Ease of Use offers three types of management interface:
• Local management using a UNIX-like command line interface.
• Remote management using a Web-based graphical user interface (GUI).
• Over the network by using either SNMP MIB II management or Telnet.

Celerra File Server Benefits

As a high-capacity network attached storage system, Celerra File Server delivers availability, scalability, and high-performance file services.

Availability

The high-availability architecture of Celerra delivers simple, robust failover with minimal
performance impact. A Data Mover failure prompts a cluster software response and the transfer of
tasks from the failed server to one of the standby servers in the cluster.

The Celerra File Server ensures high data availability and virtually non-stop file access by combining
Celerra File Server technology with EMC’s powerful Symmetrix Enterprise Storage system.

Redundant power supplies, redundant fans, environmental control, single-system management
umbrella (e.g., setup, configuration, installation, and administration from a single, optionally
redundant point of control), and reduced footprint packaging give Celerra’s Data Movers
extensive reliability and availability. Specifically, Celerra creates high-availability through
redundancy, failover, information protection with TimeFinder/FS for mirroring, remote
diagnostics and maintenance, and disaster recovery.

Celerra’s flexible failover configurations include a full set of critical components:

• Redundant data paths within the Symmetrix
• Redundant connection paths between the Symmetrix and the Data Movers (Fibre Channel and
SCSI)
• Standby Data Movers (customer configurable)
• Redundant Control Stations (optional)
• At least two internal network paths on each Data Mover and Control Station
• Load-sharing power supplies (n + 1)
• On-board battery backup
• Dual AC power lines

Redundancy

Celerra File Server ensures continuous data availability by creating multiple data access paths
throughout the system, from the disk drives to the network. In addition, the Celerra cabinet
provides redundancy of all critical components, ensuring high availability of data on the network.
Dual data paths throughout the file server eliminate single points of failure, protect data, and
promote data availability. Celerra offers:

• Redundant Network Interface Cards (NICs) per Data Mover that provide multiple access paths to
the network and maintain high availability in the event of a network card failure.
• Dual connections between the Data Movers and the Control Station that handle internal communications.
• The Celerra Fibre Channel driver uses the dual-port Emulex adapter to support 256 devices per
controller port. EMC has tested and qualified this driver with Connectrix and Brocade switches.
• Dual SCSI connections between Symmetrix and each Data Mover that support load-balancing.
• Ethernet Trunking helps Celerra maintain high availability because other ports assume the load if
one port fails. Ethernet Trunking combines up to four Ethernet ports into a single logical device.
Trunking-capable switches handle statistical load balancing by connecting different clients to
different ports. Ethernet Trunking provides higher aggregate throughput for a single IP address and
avoids any increase in single-client throughput (subject to limitations on the overall aggregate
throughput per Data Mover).

• Standby Data Movers ensure virtually uninterrupted access to data through automatic and quick
failover support in the event of a Data Mover failure.
• Independent Data Mover/Control Station Architecture makes Data Mover operations independent
of the Control Station (except during configuration or failover). Control Station failure impacts
only installation and management features in single Control Station configurations and does not
impact users’ continued access to data.
• Online file system duplication allows creation of multiple file system copies for other business uses.
• Advanced Volume Management offers hyper volumes, meta volumes, slicing, and striping.
• Dual internal Ethernet provides control and management with redundant load-sharing power supplies,
battery backup, environmental controls, Auto-Call remote maintenance parameter
monitoring, and redundant critical components.
• Warranty includes one year for hardware, 90-day warranty for software with 7-day-a-week,
24-hour coverage.

• Backup and proactive maintenance with full system battery backup and support for multiple
backup options, including the EMC Data Manager (EDM™) for network-based backup, and the
industry-standard Network Data Management Protocol (NDMP) for local backup.

The Data Mover failover capability (configurable from manual to completely automatic) allows a
hot spare Data Mover to transparently take over from a failing Data Mover. This cost-effective
failover capability enhances data availability while maintaining performance and ease
of management. Failover typically occurs in 20 seconds to four minutes, depending on
implementation factors.

To achieve this level of availability, two redundant internal networks connect the Control Station
and all the Data Movers in the Celerra cabinet. The Control Station continuously monitors the
health and status of the Data Movers. When the Control Station detects a failure, it powers down
the failed Data Mover and notifies the spare. The diskless Data Movers can see all Symmetrix
disks, allowing the spare Data Mover to assume control of the failed Data Mover’s files and
configuration information.

The standby Data Mover assumes the IP and MAC addresses, the interface host names, and all
information about the configuration and file systems of the failed Data Mover. Client service
continues. The standby Data Mover transparently resumes NFS services to clients, with no
requirement to unmount and remount the file system (Figure 5).

• Once configured, failover operates automatically and requires no intervention.
• Failover appears transparent to NFS clients but not to CIFS clients*.
• The standby Data Mover is already booted; there is no need to wait for boot time.
• Failover does not degrade system throughput.

A single standby Data Mover can act as standby for any number of primary Data Movers when it
connects to the same network as the primary Data Movers. Primary Data Movers located on
different networks, however, require configuration of multiple standbys.

TimeFinder/FS

TimeFinder/FS, an implementation of EMC’s leading information protection software
TimeFinder™, creates a point-in-time copy or a dynamic mirror of a file system. Integrated into the
Celerra Control Station, the TimeFinder/FS option allows users to create file system copies (with
only a brief suspension of access to the original file system). These copies permit independent
non-disruptive file backups, “live copy” test beds for new applications, and mirror copies of files
for redundancy and business continuity, as well as:

• Backup and restore of older versions of a specific file, directory, or complete file system.
• Mirroring and continuous updates of an active file system.

Note: File system copies require that the configuration of the Symmetrix system attached to the
Celerra File Server include business continuance volumes (BCVs). A BCV, which attaches to a
standard volume on which a file system resides, provides the foundation for the file system copy.
File systems can share BCVs, although the BCV remains dedicated to a volume.

MAC & Hash

lipaul0623 — Wed, 25 Feb 2009 03:15:28 +0000

determine automatically if incoming ciphertext decrypts to intelligible plaintext

It may be difficult to determine automatically if incoming ciphertext decrypts to intelligible plaintext. If the plaintext is, say, a binary object file or digitized X-rays, determination of properly formed and therefore authentic plaintext may be difficult. Thus, an opponent could achieve a certain level of disruption simply by issuing messages with random content purporting to come from a legitimate user.

One solution to this problem is to force the plaintext to have some structure that is easily recognized but that cannot be replicated without recourse to the encryption function. We could, for example, append an error-detecting code, also known as a frame check sequence (FCS) or checksum, to each message before encryption, as illustrated in Figure 11.2a. A prepares a plaintext message M and then provides this as input to a function F that produces an FCS. The FCS is appended to M and the entire block is then encrypted. At the destination, B decrypts the incoming block and treats the results as a message with an appended FCS. B applies the same function F to attempt to reproduce the FCS. If the calculated FCS is equal to the incoming FCS, then the message is considered authentic. It is unlikely that any random sequence of bits would exhibit the desired relationship.

Note that the order in which the FCS and encryption functions are performed is critical. The sequence illustrated in Figure 11.2a is referred to in [DIFF79] as internal error control, which the authors contrast with external error control (Figure 11.2b). With internal error control, authentication is provided because an opponent would have difficulty generating ciphertext that, when decrypted, would have valid error control bits. If instead the FCS is the outer code, an opponent can construct messages with valid error-control codes. Although the opponent cannot know what the decrypted plaintext will be, he or she can still hope to create confusion and disrupt operations.

Message Authentication Code

An alternative authentication technique involves the use of a secret key to generate a small fixed-size block of data, known as a cryptographic checksum or MAC that is appended to the message. This technique assumes that two communicating parties, say A and B, share a common secret key K. When A has a message to send to B, it calculates the MAC as a function of the message and the key:MAC = C(K, M), where

M	= input message
C	= MAC function
K	= shared secret key
MAC	= message authentication code

The message plus MAC are transmitted to the intended recipient. The recipient performs the same calculation on the received message, using the same secret key, to generate a new MAC. The received MAC is compared to the calculated MAC (Figure 11.4a). If we assume that only the receiver and the sender know the identity of the secret key, and if the received MAC matches the calculated MAC, then

The receiver is assured that the message has not been altered. If an attacker alters the message but does not alter the MAC, then the receiver’s calculation of the MAC will differ from the received MAC. Because the attacker is assumed not to know the secret key, the attacker cannot alter the MAC to correspond to the alterations in the message.
The receiver is assured that the message is from the alleged sender. Because no one else knows the secret key, no one else could prepare a message with a proper MAC.
If the message includes a sequence number (such as is used with HDLC, X.25, and TCP), then the receiver can be assured of the proper sequence because an attacker cannot successfully alter the sequence number.

Requirements for MACs

When an entire message is encrypted for confidentiality, using either symmetric or asymmetric encryption, the security of the scheme generally depends on the bit length of the key. Barring some weakness in the algorithm, the opponent must resort to a brute-force attack using all possible keys. On average, such an attack will require 2^(k-1) attempts for a k-bit key. In particular, for a ciphertext-only attack, the opponent, given ciphertext C, would perform P_i = D(K_i, C) for all possible key values K_i until a P_i was produced that matched the form of acceptable plaintext.

Hash Function

A variation on the message authentication code is the one-way hash function. As with the message authentication code, a hash function accepts a variable-size message M as input and produces a fixed-size output, referred to as a hash code H(M). Unlike a MAC, a hash code does not use a key but is a function only of the input message. The hash code is also referred to as a message digest or hash value. The hash code is a function of all the bits of the message and provides an error-detection capability: A change to any bit or bits in the message results in a change to the hash code.