1

lets assume the following scenario; i need to open a encrypted filesystem (like i'm able to do with TrueCrypt locally) over a network, but

  • i want the encryption/decryption to happen strictly in the client, so no magic tokens get outside my machine
  • i want to read/write the filesystem on-demand basis: my encrypted filesystem might contain 3Gb of files, but i only need to edit a file of 1Mb, so my bandwidth consumption should not exceed a significant portion of that

it seems to me the only way to satisfy both requirement is with block-level encryption, so the client will decrypt the filesystem structure, request specific blocks over the network, edit some of the requested blocks, send updated (already encrypted) blocks.

What tools do exist for that? I've heard that eCryptFS does block-level encryption, but i'm not sure if there is a nice frontend for it as with TrueCrypt

My understanding is that with TrueCrypt you would need to download the full 3Gb partition, open it, edit some files, unmount and then resend the whole 3Gb. Is this correct?

4

3 回答 3

2

如果您正在寻找文件系统库，那么我们的SolFS正是您所需要的。您可以将存储保留在服务器上（加密）并从客户端打开它。打开时，只会下载一些页面并在客户端解密（并在更改时重新加密并上传回来）。

于 2011-03-21T06:02:58.220 回答
2

您可以使用允许您通过网络连接到原始磁盘的协议，然后在其上运行标准的分区加密工具（如 TrueCrypt）。

此类协议的示例是 NBD（网络块设备）和 iSCSI（基于 IP 的 SCSI）。

于 2011-03-21T04:01:41.253 回答
1

网络块设备应该使这成为可能。不确定该协议有多稳定，或者它是否支持多个客户端。

于 2011-03-21T01:39:02.187 回答