for update operations it is possible that potentially
many processes try to change the same value.
2.2 Locking
In conventional distributed file systems, file locking
is essential for coordinating access to shared informa-
tion among cooperating processes. If multiple pro-
cesses are writing to the same file it is necessary
to regulate the access through some kind of locking
mechanism. In SNMPFS, locking is performed by the
agent, in accordance with the managed object defini-
tion, since SNMP agents may also be updated by net-
work management applications concurrently. Some
MIBs provide a mechanism to regulate concurrent ac-
cess. The Expression MIB (Kavasseri, 2000), for ex-
ample, has tables with a special column used to in-
stantiate the row – RowStatus (McCloghrie et al.,
1999b).
2.3 Security
SNMP is inherently insecure. Although true for the
versions 1 and 2c, SNMPv3 present a modular se-
curity architecture based on cryptographic protocols
and algorithms. It is mandatory that SNMPv3 im-
plementations support the HMAC-MD5-96 protocol
for authentication. They can also support the HMAC-
SHA-96 for authentication and the CBC-DES for pri-
vacy (Blumenthal and Wijnen, 2002). More recently,
a new privacy protocol was added. (Blumenthal et al.,
2004) describes the Advanced Encryption Standard
(AES) for SNMPv3 in the SNMP User-based Secu-
rity Model which can be used as an alternative to the
CBC-DES.
The SNMPv3 security service provides data in-
tegrity, data origin authentication, data confidential-
ity and message timeliness as well as limited replay
protection. It is based on the concept of a user, identi-
fied by a userName, with which security information
is associated. In addition to the user name, an authen-
tication key (authKey) is shared between the commu-
nicating SNMP engines, ensuring authentication and
integrity. A privacy key (privKey), also symmetric,
ensures confidentiality.
Complementing the communication security, the
SNMPv3 model also provides access control through
a view-based access control model (Wijnen et al.,
2002). This model grants or denies access to MIB
portions (view subtrees) according to the predefined
configuration and the current user permissions.
The security details for SNMPv3, either for
authentication, integrity, confidentiality and ac-
cess control, dictates the security functions for the
SNMPFS. We have to pass to the file system the
authentication and the access control required by
the SNMP model. The authentication problem is
performed by the system when mounting the file
system. A similar approach is followed for NFS or
SMB shares:
mount -t smb //server/share /mnt -o
username=aUser,password=xxx.
If the server recognizes the username and password,
the host is allowed to access the file system and a
user ID (uid) is associated with it.
Access control is enforced by file permissions. In
Unix, each file has a set of permissions (read, write,
execute) for the file owner, group and others. For ex-
ample, the permissions
-rwxr-x---
gives the owner the possibility to read, write and ex-
ecute the file, the group to read and execute and no
other user can read, write or execute.
SNMPFS translates each file permission to the
View-based Access Control mechanism of the SN-
MPv3.
2.4 Attributes
File system entries, such as files or directories, are
characterized by a set of attributes which describes
their fundamental aspects, such as size, date, permis-
sions, name and others. The name and number of at-
tributes is typically static, meaning that it is not pos-
sible to add or remove further information to each file
system entry latter on.
An attribute which is necessary to better describe
the data types and the structure of an SNMP agent is
the MIB tree it implements. The MIB tree is described
in a set of MIB files which contain each node name,
data type, restrictions and role. With this information,
the SNMPFS can present to the user a more meaningful
set of file names as well as file types (a table, a string,
an int, etc). In particular, this information is valuable
for tables, which the SNMPFS exports as Coma Sep-
arated Values (CSV) format and can be opened and
edited by a spreadsheet, such as Microsoft Excel or
OpenOffice Calc.
To be able to access the meta-information about
management data, the SNMPFS has the possibility to
load MIB files from a specific directory. This infor-
mation will allow the files to have a more meaningful
name as well as adapting the content to the nature of
the information it stores.
ICEIS2012-14thInternationalConferenceonEnterpriseInformationSystems
68