KNFS: A High-Performance, Security-Enhanced NFS Based on eBPF

NFS, which is commonly used in local area networks for sharing files and data, is frequently employed in setting up internal network storage systems for enterprises. In these scenarios, performance and security are the main concerns for users. NFS-Ganesha is the user-space version of NFS that offers a lot of extensions and powerful features. However, compared to kernel-based NFS, it has some performance drawbacks and more security implications.To address these issues, the paper proposes kNFS, which builds on NFS-Ganesha by integrating eBPF for performance optimization and security enhancement. kNFS offers a higher-performing and more secure network file system by using caching for quick replies to repeated requests and achieving faster handling of read requests in the kernel. It also uses a more efficient algorithm for packet filtering, providing more fine-grained ACL rules and network traffic monitoring to enhance security. The experimental results indicate that kNFS significantly improves performance for various operations, with almost no impact on unoptimized operation handling. In terms of resource overhead, it requires only a small amount of additional memory and does not demand extra CPU resources. In addition, compared to IpTables, kNFS’s ACL rule checking is faster, especially when there are a large number of rules.