Spolo\u010dnos\u0165 Kudelski Security, \u0161pecializuj\u00faca sa na audit bezpe\u010dnosti, zverejnila s\u00faborov\u00fd syst\u00e9m Oramfs s implement\u00e1ciou technol\u00f3gie ORAM (Oblivious Random Access Machine), ktor\u00e1 maskuje povahu pr\u00edstupu k d\u00e1tam (data access pattern). Projekt pon\u00faka FUSE modul pre Linux s implement\u00e1ciou FS vrstvy, ktor\u00e1 neumo\u017e\u0148uje sledova\u0165 \u0161trukt\u00faru oper\u00e1ci\u00ed z\u00e1pisu a \u010d\u00edtania. K\u00f3d Oramfs je nap\u00edsan\u00fd v jazyku Rust a \u0161\u00edri sa pod licenciou GPLv3. <\/p>\n
Technol\u00f3gia ORAM predpoklad\u00e1 vytvorenie \u010fal\u0161ej vrstvy okrem \u0161ifrovania, ktor\u00e1 neumo\u017e\u0148uje ur\u010di\u0165 charakter aktu\u00e1lnej aktivity pri pr\u00e1ci s d\u00e1tami. Napr\u00edklad, ak sa pou\u017e\u00edva \u0161ifrovanie pri ukladan\u00ed d\u00e1t do extern\u00e9ho servisu, vlastn\u00edci tohto servisu nem\u00f4\u017eu zisti\u0165 samotn\u00e9 d\u00e1ta, ale m\u00f4\u017eu ur\u010di\u0165, ku ktor\u00fdm blokom sa pristupuje a ak\u00e9 oper\u00e1cie sa vykon\u00e1vaj\u00fa. ORAM skr\u00fdva inform\u00e1cie o tom, ku ktor\u00fdm \u010dastiam FS sa pristupuje a ak\u00e1 konkr\u00e9tna oper\u00e1cia sa vykon\u00e1va (\u010d\u00edtanie alebo z\u00e1pis). <\/p>\n
Oramfs poskytuje univerz\u00e1lny s\u00faborov\u00fd syst\u00e9m, ktor\u00fd zjednodu\u0161uje organiz\u00e1ciu ukladania d\u00e1t na ak\u00fdchko\u013evek extern\u00fdch \u00falo\u017eisk\u00e1ch. D\u00e1ta sa ukladaj\u00fa v \u0161ifrovanej forme s volite\u013enou mo\u017enos\u0165ou autentifik\u00e1cie. Na \u0161ifrovanie m\u00f4\u017eu by\u0165 pou\u017eit\u00e9 algoritmy ChaCha8, AES-CTR a AES-GCM. Vzorci pri pr\u00edstupe na z\u00e1pis a \u010d\u00edtanie s\u00fa skryt\u00e9 pomocou sch\u00e9my Path ORAM. V bud\u00facnosti sa pl\u00e1nuje implement\u00e1cia aj in\u00fdch sch\u00e9m, ale v s\u00fa\u010dasnej podobe je v\u00fdvoj st\u00e1le v \u0161t\u00e1diu prototypu, ktor\u00fd sa neodpor\u00fa\u010da pou\u017e\u00edva\u0165 v prev\u00e1dzkov\u00fdch syst\u00e9moch. <\/p>\n
Oramfs m\u00f4\u017ee by\u0165 pou\u017eit\u00fd s ak\u00fdmiko\u013evek s\u00faborov\u00fdmi syst\u00e9mami a nez\u00e1vis\u00ed od typu cie\u013eov\u00e9ho extern\u00e9ho \u00falo\u017eiska \u2014 je mo\u017en\u00e9 synchronizova\u0165 s\u00fabory do akejko\u013evek slu\u017eby, ktor\u00fa je mo\u017en\u00e9 pripoji\u0165 ako lok\u00e1lny adres\u00e1r (SSH, FTP, Google Drive, Amazon S3, Dropbox, Google Cloud Storage, Mail.ru Cloud, Yandex.Disk a \u010fal\u0161ie slu\u017eby podporovan\u00e9 v rclone alebo pre ktor\u00e9 existuj\u00fa FUSE-moduly na pripojenie). Ve\u013ekos\u0165 \u00falo\u017eiska nie je fixn\u00e1 a v pr\u00edpade potreby m\u00f4\u017ee by\u0165 ve\u013ekos\u0165 ORAM dynamicky zv\u00e4\u010d\u0161en\u00e1. <\/p>\n
Nastavenie Oramfs spo\u010d\u00edva v definovan\u00ed dvoch adres\u00e1rov \u2014 verejn\u00e9ho a priv\u00e1tneho, ktor\u00e9 plnia \u00falohu servera<\/a> a klienta. Verejn\u00fd adres\u00e1r m\u00f4\u017ee by\u0165 ak\u00fdmko\u013evek adres\u00e1rom v lok\u00e1lnom FS, ktor\u00fd je spojen\u00fd s extern\u00fdmi \u00falo\u017eiskami prostredn\u00edctvom ich pripojenia cez SSHFS, FTPFS, Rclone a ak\u00e9ko\u013evek in\u00e9 FUSE moduly. S\u00fakromn\u00fd adres\u00e1r je poskytovan\u00fd FUSE modulom Oramfs a je ur\u010den\u00fd na priamu pr\u00e1cu s s\u00fabormi ulo\u017een\u00fdmi v ORAM. V verejnom adres\u00e1ri sa umiest\u0148uje s\u00fabor s obrazom ORAM. Ak\u00e1ko\u013evek oper\u00e1cia so s\u00fakromn\u00fdm adres\u00e1rom sa odr\u00e1\u017ea na stave tohto s\u00faborov\u00e9ho obrazu, av\u0161ak tento s\u00fabor vyzer\u00e1 pre vonkaj\u0161ieho pozorovate\u013ea ako \u010dierna skrinka, pri\u010dom zmeny v \u0148om nie je mo\u017en\u00e9 asociova\u0165 s aktivitou v s\u00fakromnom adres\u00e1ri, vr\u00e1tane nemo\u017enosti zisti\u0165, \u010di bola vykonan\u00e1 oper\u00e1cia z\u00e1pisu alebo \u010d\u00edtania. <\/p>\n Oramfs m\u00f4\u017ee by\u0165 pou\u017eit\u00fd v oblastiach, kde je potrebn\u00e9 dosiahnu\u0165 najvy\u0161\u0161\u00ed stupe\u0148 d\u00f4vernosti a je mo\u017en\u00e9 obetova\u0165 v\u00fdkon. V\u00fdkon sa zni\u017euje, preto\u017ee ka\u017ed\u00fd oper\u00e1cia s \u00falo\u017eiskom, vr\u00e1tane oper\u00e1ci\u00ed \u010d\u00edtania d\u00e1t, vedie k prebudovaniu blokov v obraznej s\u00faborovej s\u00fastave. Napr\u00edklad \u010d\u00edtanie s\u00faboru s ve\u013ekos\u0165ou 10 MB trv\u00e1 pribli\u017ene 1 sekundu, zatia\u013e \u010do 25 MB \u2014 3 sekundy. Z\u00e1pis 10 MB trv\u00e1 15 sek\u00fand a 25 MB \u2014 50 sek\u00fand. V tomto pr\u00edpade je Oramfs pribli\u017ene 9-kr\u00e1t r\u00fdchlej\u0161\u00ed pri \u010d\u00edtan\u00ed a 2-kr\u00e1t r\u00fdchlej\u0161\u00ed pri z\u00e1pise v porovnan\u00ed so s\u00faborov\u00fdm syst\u00e9mom UtahFS, ktor\u00fd vyv\u00edja spolo\u010dnos\u0165 Cloudflare a volite\u013ene podporuje re\u017eim ORAM. \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Kudelski Security, \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0437\u0438\u0440\u0443\u044e\u0449\u0430\u044f\u0441\u044f \u043d\u0430 \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u0438 \u0430\u0443\u0434\u0438\u0442\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0444\u0430\u0439\u043b\u043e\u0432\u0443\u044e \u0441\u0438\u0441\u0442\u0435\u043c\u0443 Oramfs \u0441 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 ORAM (Oblivious Random Access Machine), \u043c\u0430\u0441\u043a\u0438\u0440\u0443\u044e\u0449\u0435\u0439 \u0445\u0430\u0440\u0430\u043a\u0442\u0435\u0440 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0434\u0430\u043d\u043d\u044b\u043c (data access pattern). \u041f\u0440\u043e\u0435\u043a\u0442\u043e\u043c \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d FUSE-\u043c\u043e\u0434\u0443\u043b\u044c \u0434\u043b\u044f Linux \u0441 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439 \u0441\u043b\u043e\u044f \u0424\u0421, \u043d\u0435 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0433\u043e \u043e\u0442\u0441\u043b\u0435\u0434\u0438\u0442\u044c \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u0438 \u0447\u0442\u0435\u043d\u0438\u044f. \u041a\u043e\u0434 Oramfs \u043d\u0430\u043f\u0438\u0441\u0430\u043d \u043d\u0430 \u044f\u0437\u044b\u043a\u0435 Rust \u0438 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u0442\u0441\u044f \u043f\u043e\u0434 \u043b\u0438\u0446\u0435\u043d\u0437\u0438\u0439 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-100680","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Publikovan\u00fd FS Oramfs, skr\u00fdvaj\u00faci charakter pr\u00edstupu k d\u00e1tam | ProHoster","description":"Spolo\u010dnos\u0165 Kudelski Security, \u0161pecializuj\u00faca sa na audit bezpe\u010dnosti, publikovala s\u00faborov\u00fd syst\u00e9m Oramfs s implement\u00e1ciou technol\u00f3gie ORAM (Oblivious Random Access Machine), ktor\u00e1 maskuje charakter pr\u00edstupu k d\u00e1tam.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/opublikovana-fs-oramfs-skryvayushhaya-harakter-dostupa-k-dannym","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430 \u0424\u0421 Oramfs, \u0441\u043a\u0440\u044b\u0432\u0430\u044e\u0449\u0430\u044f \u0445\u0430\u0440\u0430\u043a\u0442\u0435\u0440 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0434\u0430\u043d\u043d\u044b\u043c | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Kudelski Security, \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0437\u0438\u0440\u0443\u044e\u0449\u0430\u044f\u0441\u044f \u043d\u0430 \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u0438 \u0430\u0443\u0434\u0438\u0442\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0444\u0430\u0439\u043b\u043e\u0432\u0443\u044e \u0441\u0438\u0441\u0442\u0435\u043c\u0443 Oramfs \u0441 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0435\u0439 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 ORAM (Oblivious Random Access Machine), \u043c\u0430\u0441\u043a\u0438\u0440\u0443\u044e\u0449\u0435\u0439 \u0445\u0430\u0440\u0430\u043a\u0442\u0435\u0440 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a.","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/opublikovana-fs-oramfs-skryvayushhaya-harakter-dostupa-k-dannym","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-07-05T08:22:35+00:00","article:modified_time":"2021-07-05T08:22:35+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"100680","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-07-05 08:43:18","updated":"2026-02-22 15:30:21","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/100680","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=100680"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/100680\/revisions"}],"predecessor-version":[{"id":162256,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/100680\/revisions\/162256"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=100680"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=100680"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=100680"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"