面向HDFS的密钥资源控制机制

doi:10.11959/j.issn.1000-436x.2022165

Abstract

Abstract:

The big data environment presents the characteristics of multi-user cross-network cross-access, multi-service collaborative computing, cross-service data flow, and complex management of massive files.The existing access control models and mechanisms are not fully applicable for big data scenarios.In response to the needs of fine-grained access control and multi-service strategy normalization for cryptographic data in the big data environment, starting from the scene elements and attributes of access control, the HDFS-oriented CKCM was proposed by mapping the cyberspace-oriented access control (CoAC) model.Subsequently, a fine-grained access control management model for HDFS was proposed, including management sub-models and management supporting models.The Z-notation was used to formally describe the management functions and management methods in the management model.Finally, the CKCM system was implemented based on XACML to realize fine-grained secure access control for managing file and secret keys in HDFS.

Key words: big data platform, cryptographic key management, resource control, cyberspace-oriented access control

CLC Number:

TP302

Wei JIN, Fenghua LI, Mingjie YU, Yunchuan GUO, Ziyan ZHOU, Liang FANG. HDFS-oriented cryptographic key resource control mechanism[J]. Journal on Communications, 2022, 43(9): 27-41.

Figures/Tables 11

References 22

[1]	李凤华, 王彦超, 殷丽华 ,等．面向网络空间的访问控制模型［J］．通信学报, 2016,37(5): 9-20．
	LI F H , WANG Y C , YIN L H ,et al． Novel cyberspace-oriented access control model［J］． Journal on Communications, 2016,37(5): 9-20．
[2]	COLOMBO P , FERRARI E ． Access control in the era of big data:state of the art and research directions［C］// Proceedings of the 23rd ACM on Symposium on Access Control Models and Technologies． New York:ACM Press, 2018: 185-192．
[3]	ULUSOY H , COLOMBO P , FERRARI E ,et al． GuardMR:fine-grained security policy enforcement for MapReduce systems［C］// Proceedings of the 10th ACM Symposium on Information,Computer and Communications Security． New York:ACM Press, 2015: 285-296．
[4]	ULUSOY H , KANTARCIOGLU M , PATTUK E ,et al． Vigiles:fine-grained access control for MapReduce systems［C］// Proceedings of 2014 IEEE International Congress on Big Data． Piscataway:IEEE Press, 2014: 40-47．
[5]	GUPTA M , PATWA F , SANDHU R ． POSTER:access control model for the hadoop ecosystem［C］// Proceedings of the 22nd ACM on Symposium on Access Control Models and Technologies． New York:ACM Press, 2017: 125-127．
[6]	GUPTA M , PATWA F , SANDHU R ． Object-tagged RBAC model for the Hadoop ecosystem［C］// Data and Applications Security and Privacy (DBSec)． Berlin:Springer, 2017: 63-81．
[7]	SANDHU R S , COYNE E J , FEINSTEIN H L ,et al． Role-based access control models［J］． Computer, 1996,29(2): 38-47．
[8]	GUPTA M , PATWA F , SANDHU R ． An attribute-based access control model for secure big data processing in Hadoop ecosystem［C］// Proceedings of the 3rd ACM Workshop on Attribute-Based Access Control． New York:ACM Press, 2018: 13-24．
[9]	AWAYSHEH F M , ALAZAB M , GUPTA M ,et al． Next-generation big data federation access control:a reference model［J］． Future Generation Computer Systems, 2020,108: 726-741．
[10]	GUPTA M , PATWA F , BENSON J ,et al． Multi-layer authorization framework for a representative Hadoop ecosystem deployment［C］// Proceedings of the 22nd ACM on Symposium on Access Control Models and Technologies． New York:ACM Press, 2017: 183-190．
[11]	UGOBAME U U , SCHNEIDER K A , HOSSEINZADEH K S ,et al． Blockchain access control ecosystem for big data security［C］// Proceedings of 2018 IEEE International Conference on Internet of Things (iThings) and IEEE Green Computing and Communications (GreenCom) and IEEE Cyber,Physical and Social Computing (CPSCom) and IEEE Smart Data． Piscataway:IEEE Press, 2018: 1373-1378．
[12]	HU V C , FERRAIOLO D , KUHN R ,et al． Guide to attribute based access control (ABAC) definition and considerations［R］． 2014．
[13]	MELL P , SHOOK J , HARANG R ,et al． Linear time algorithms to restrict insider access using multi-policy access control systems［J］． Journal of Wireless Mobile Networks,Ubiquitous Computing,and Dependable Applications, 2017,8(1): 4-25．
[14]	SANDHU R , PARK J ． Usage control:a vision for next generation access control［C］// Computer Network Security． Berlin:Springer, 2003: 17-31．
[15]	BALDI G , DIAZ-TELLEZ Y , DIMITRAKOS T ,et al． Session-dependent usage control for big data［J］． Journal of Internet Services and Information Security, 2020,10(3): 76-92．
[16]	OASIS Open ． OASIS eXtensible access control markup language (XACML) TC version 3.0[EB]. 2013．
[17]	PREMKAMAL P K , PASUPULETI S K , ALPHONSE P J A ． A new verifiable outsourced ciphertext-policy attribute based encryption for big data privacy and access control in cloud［J］． Journal of Ambient Intelligence and Humanized Computing, 2019,10(7): 2693-2707．
[18]	KAPIL G , AGRAWAL A , ATTAALLAH A ,et al． Attribute based honey encryption algorithm for securing big data:Hadoop distributed file system perspective［J］． PeerJ Computer Science, 2020,6:e259．
[19]	SHAFAGH H , BURKHALTER L , RATNASAMY S ,et al． Droplet:decentralized authorization and access control for encrypted data streams［C］// Proceedings of the 29th USENIX Conference on Security Symposium． Berkeley:USENIX Association, 2020: 2469-2486．
[20]	金伟, 余铭洁, 李凤华 ,等．支持高并发的Hadoop高性能加密方法研究［J］．通信学报, 2019,40(12): 29-40．
	JIN W , YU M J , LI F H ,et al． High-performance and high-concurrency encryption scheme for Hadoop platform［J］． Journal on Communications, 2019,40(12): 29-40．
[21]	李凤华, 陈天柱, 王震 ,等．复杂网络环境下跨网访问控制机制［J］．通信学报, 2018,39(2): 1-10．
	LI F H , CHEN T Z , WANG Z ,et al． Cross-network access control mechanism for complex network environment［J］． Journal on Commu-nications, 2018,39(2): 1-10．
[22]	D?RNYEI Z ． Motivational strategies in the language classroom［M］． Cambridge: Cambridge University Press, 2001．

Metrics

Recommended 0

No Suggested Reading articles found!

操作类型	操作	涉及修改和访问的资源
		KMS			HDFS		EZM
		一级密钥	二级密钥	三级密钥	NN	DN	EZM
	创建二级密钥	√	√	—	—	—	—
	更新二级密钥	√	√	—	○	—	○
密钥管理操作（KMO）	删除二级密钥	—	√	—	○	○	○
	三级密钥缓冲池管理	√	√	√	—	—	—
	查二级密钥名	—	√	—	—	—	—
	查二级密钥内容	√	√	—	—	—	—
加密区操作（EZO）	绑定加密区	—	√		√	—	√
	向加密区上传/下载文件	√	√	○	√	√	√
	初始化文件系统	—	—	—	√	√	—
HDFS操作（DFSO）	创建空文件夹	—	—	—	√	—	—
	非加密区文件上传/下载	—	—	—	√	√	—
	修改文件默认权限	—	—	—	√	—	—

函数	描述
创建属性元数据	添加元素的属性元数据，需选择数据类型、管理对象，填写属性名、属性描述（可选），若添加成功，返回true；
createMetaAttr	否则返回false
	createMetaAttr(METAATTR?, p?:AttrName, ds?:DataSturcture, elt?:Element, des?:Description, result!:Boolean)?
	if p?elt.MetaAttr
	then meta=<p, ds, elt, des>, METAATTR’= METAATTR∪{ meta }, result=true
	else result=false?
删除属性元数据	删除元素的属性元数据及已配置的属性值，若删除成功，返回true；否则返回false
deleteMetaAttr	deleteMetaAttr(METAATTR?, p?:AttrName, result!:Boolean)?
	if p?meta∈METAATTR,
	then METAATTR’=METAATTR?{p?meta}, result=true
	else result=false?
选取场景描述函数	选择场景描述函数，如各数据类型元素的对比和计算函数，根据属性的数据类型输出
selectFunction	selectFunction(elt?:Element, func!:Function)?
	getFunction(getDataStructure(elt))→func?
创建场景	选取已有要素、属性和函数，搭建场景，若创建成功，返回true；否则返回false
createScene	createScene(SCENE?, q?:Quantity, rsc?Resource, (t, ap, dev, bdn)?:Name, result!:Boolean)?
	sc=selectFunction((t, ap, dev, bdn), getAttr(q, rsc))
	if sc?SCENE
	then SCENE’=SCENE∪{sc}, result=true
	else result=false?
修改场景	修改已有场景中的要素、属性和函数，若修改成功，返回true；否则返回false
modScene	modScene(SCENE?, sca?,scb?:Scene, result!:Boolean)?
	if sca∈SCENE and scb?SCENE
	then SCENE’=SCENE∪{scb}?{sca}, result=true
	else result=false?
删除场景	删除已有场景，若删除成功，返回true；否则返回false
deleteScene	deleteScene(SCENE?, sc?:Scene, result!:Boolean)?
	if sc∈SCENE
	then SCENE’=SCENE?{sc}, result=true
	else result=false?

函数	描述
授予场景权限	为已创建的场景分配权限，若分配成功，返回true；否则返回false
assignScPerm	assignScPerm(PERM?, sc?:Scene, p?:Perm, result!: Boolean)?
	if sc∈SCENE and p?PERM
	then PERM’=PERM∪{p}, result=true
	else result=false?
撤销场景权限	撤销场景所具有的权限，若撤销成功，返回true；否则返回false
revokeScPerm	assignScPerm(PERM?, p?:Perm, result!: Boolean)?
	if p∈PERM
	then PERM’=PERM?{p}, result=true
	else result=false?

函数	描述
添加/修改属性值	添加或修改元素的属性值，若添加成功，返回true；否则返回false
modAttr	modAttr(ATTRVALUE?, p?:AttrName, elt?:Element, vlu?:Value, result!:Boolean)?
	if (p∈elt.MetaAttr) and (vlu∈allowedValue)
	then attrValue=<p,elt, vlu>, ATTRVALUE’= ATTRVALUE∪{ attrValue }, result=true
	else result=false?
选取/查询属性	选取/查询各元素的属性，用于构建场景，若查询成功，返回属性集合；否则返回null
getAttr	getAttr(ATTR?, elt?:Element, result!: AttrSet)?
	if checkId(elt)
	then result=elt?ATTR
	else result=null?
查询属性值	查询访问请求实体的所有属性值，用于匹配场景，若查询成功，返回属性值集合；否则返回null
getAttrValue	getAttrValue(ATTRVALUE?, q?:Quantity, result!: AttrValueSet)?
	if checkId(q)
	then result=q?ATTRVALUE
	else result=null?
验证时间	验证时间在场景的允许范围内，若通过验证，返回true；否则返回false
verifyTime	verifyTime(sc?:SCENE, t?:Name, result!:Boolean)?
	if t∈sc.t
	then result=true
	else result=false?
验证接入点	验证接入点在场景的允许范围内，若通过验证，返回true；否则返回false
verifyAP	verifyAP(sc?:SCENE, ap?:Name, result!:Boolean)?
	if ap∈sc.ap
	then result=true
	else result=false?
验证设备	验证设备在场景的允许范围内，若通过验证，返回true；否则返回false
verifyDevice	verifyDevice(sc?:SCENE, dev?:Name, result!:Boolean)?
	if dev∈sc.dev
	then result=true
	else result=false?
验证网络	验证设备在场景的允许范围内，若通过验证，返回true；否则返回false
verifyBDNetwork	verifyBDNetwork(sc?:SCENE, bdn?:Name, result!:Boolean)?
	if bdn∈sc.bdn
	then result=true
	else result=false?

函数	描述
用户实体注册	注册未重名的用户实体，并更新，若注册成功，返回true；否则返回false
QuantitySignUp	QuantitySignUp(Quantity?, Password?, Certification?, q?:Name, result!:Boolean)?
	if q?Quantity
	then Quantity’= Quantity∪{q}, Password’=Password∪{q?pwd}, Certification’=Certification∪{q?cert}
	result=true
	else result=false?
用户实体删除/注销	删除用户实体，若删除成功，返回true；否则返回false
QuantityLogOff	QuantityLogOff(Quantity?, Password?, Certification?, q?:Name, result!:Boolean)?
	if q∈Quantity
	then Quantity’= Quantity?{q}, Password’=Password?{q?pwd}, Certification’=Certification?{q?cert}
	result=true
	else result=false?
口令/证书的初始化、更新、撤销	更新用户实体的口令和证书，若更新成功，返回true；否则返回false
updateAuthentication	updateAuthentication(Quantity?, q?:Name, result!:Boolean)?
	if q∈Quantity
	then Password’=Password∪{q?NewPwd}, Certification’=Certification∪{q?NewCert}, result=true
	else result=false ?
口令/证书认证	验证用户身份与口令/证书，若验证成功，返回true；否则返回false
CheckId	CheckId(Quantity?, q?:Name, pwd?:Password, cert?:Certification, result!:Boolean)?
	if (q∈Quantity) and ( (pwd?(q?password)) or (cert?(q?certification)) )
	then result=true
	else result=false?
用户列表查询	返回当前用户列表
getQuantityList	getQuantityList(Quantity?, list!:QuantityList)?
	getId(Quantity)→list?

HDFS-oriented cryptographic key resource control mechanism

RichHTML

PDF

Knowledge

Abstract

Cite this article

share this article

Figures/Tables 11

References 22

Related Articles 2

Metrics

Recommended 0

函数	描述
为通过认证的用户分配会话	认证用户身份并分配会话，若分配成功，返回true；否则返回false
assignQSession	assignSession(QSession?, q?:Name, result!:Boolean)?
	if checkId(q)
	then QSesson’=QSession∪{<q, s>}, result=true
	else result=false?
为会话分配场景	获取场景，并分配给会话，若分配成功，返回true；否则返回false
assignScSession	assignScSession(ScSession?, q?,s?:Name, result!:Boolean)?
	if createScene(q)→sc
	then ScSession’=ScSession∪{<s, sc>}, result=true
	else result=false?
关闭会话	关闭会话，若关闭成功，返回true；否则返回false
closeSession	closeSession(QSession?, ScSession?, q?,s?:Name, sc?Scene, result!:Boolean)?
	if ( <q, s>∈QSession ) and ( <s, sc>∈ScSession )
	then QSesson’=QSession?{<q, s>}, ScSession’=ScSession?{<s, sc>}
	else result=false ?

总访问请求连接数/个	并发访问请求连接数占比	平均响应时间/ms	内存占用/GB
2 000	50%	0.237 4	0.5
2 000	75%	0.264 2	0.6
5 000	50%	0.309	0.7
5 000	75%	0.326 3	0.8
10 000	50%	0.555 5	0.8
10 000	75%	0.784 9	0.9
15 000	50%	0.967 8	1.3
15 000	75%	1.689 9	1.4

[1]	Le-tian SHA,Fu XIAO,Wei CHEN,Jing SUN,Ru-chuan WANG. Sensitive information leakage awareness method for big data platform based on multi-attributes decision-making and taint tracking [J]. Journal on Communications, 2017, 38(7): 56-69.
[2]	Yan-sheng QU,Jun-zhou LUO,Wei LI,Peng WANG,Jing TAN. Resource control conflict detection mechanism in trustworthy and controllable network [J]. Journal on Communications, 2010, 31(10): 79-87.