面向Hive的基于安全域的数据隔离保护框架
|
摘要
针对Hive数据库中的数据共享所带来的敏感信息泄漏问题,以数据分级为前提,利用基于标签的访问控制技术,提出了一种基于安全域的数据隔离保护框架(SD-DIPF)。首先,通过设计层次安全标签树划分标签级别,用来对系统中的主客体进行标识;结合分级标签阐明安全域(SD)的设计思想,对安全域及其子域进行定义以及安全性的形式化证明;最后,利用安全域对平台数据进行逻辑划分保证不同敏感级别数据的有效隔离;针对该框架对Hive数据库的适用性进行说明,并结合现有的认证机制给出了其在Hive数据库中的实现。通过实验分析验证该框架可以保障敏感数据不被非法访问,证明了本框架的可行性和安全性。
Aiming at the problem of sensitive information leakage caused by data sharing in Hive database, a data isolation and protection framework(SD-DIPF) based on security domain is proposed, which is combined with data classification and tag-based access control technology. Firstly, the tag level is divided by the hierarchy security tag tree which is used to identify the subject and object in the system. Then, the design idea of security domain(SD) is illustrated with hierarchical tags, the definition of SD and its subdomains and formal proof of security are given. Finally, the platform data is logically partitioned by security domain to ensure the effective isolation of different sensitive levels data. The applicability of SD-DIPF to Hive database is illustrated, and its implementation in Hive database is given based on the existing authentication mechanism. The experimental results show that SD-DIPF can protect sensitive data from being illegally accessed, which proves the feasibility and security of the framework.
Aiming at the problem of sensitive information leakage caused by data sharing in Hive database, a data isolation and protection framework(SD-DIPF) based on security domain is proposed, which is combined with data classification and tag-based access control technology. Firstly, the tag level is divided by the hierarchy security tag tree which is used to identify the subject and object in the system. Then, the design idea of security domain(SD) is illustrated with hierarchical tags, the definition of SD and its subdomains and formal proof of security are given. Finally, the platform data is logically partitioned by security domain to ensure the effective isolation of different sensitive levels data. The applicability of SD-DIPF to Hive database is illustrated, and its implementation in Hive database is given based on the existing authentication mechanism. The experimental results show that SD-DIPF can protect sensitive data from being illegally accessed, which proves the feasibility and security of the framework.
引文
[1] THURAISINGHAM B. Big data security and privacy[C]//Proceedings of the 5th ACM Conference on Data and Application Security and Privacy. San Antonio: ACM, 2015: 279-280.
[2] FLESCA S, GRECO S, MASCIARI E, et al. A comprehensive guide through the italian database research over the last 25 years[M]. Switzerland: Springer, 2018.
[3] 冯登国, 张敏, 李昊. 大数据安全与隐私保护[J]. 计算机学报, 2014, 37(1): 246-258.FENG Dengguo, ZHANG Min, LI Hao. Big data security and privacy protection [J]. Chinese Journal of Computers, 2014, 37(1): 246-258.
[4] MORENO J, SERRANO M A, FERNáNDEZ-MEDINA E, et al. Towards a security reference architecture for big data[C]//Proceedings of the 20th International Workshop on Design, Optimization, Languages and Analytical Processing of Big Data co-located with 10th EDBT/ICDT Joint Conference (EDBT/ICDT 2018). Vienna: CEUR Workshop, 2018.
[5] SHAW S, VERMEULEN A F, GUPTA A, et al. Practical Hive: a guide to hadoop?s data warehouse system[M]. New York: Apress, 2016: 11-21.
[6] THUSOO A, SARMA J S, JAIN N, et al. An attribute-based access control model for secure big data processing in Hadoop ecosystem[C]//Proceedings of the Third ACM Workshop on Attribute-Based Access Control. New York: ACM, 2018: 13-24.
[7] 杨腾飞, 申培松, 田雪, 等. 对象云存储中分类分级数据的访问控制方法[J]. 软件学报, 2017, 28(9): 2334-2353.YANG Tengfei, SHEN Peisong, TIAN Xue, et al. Access control mechanism for classified and graded object storage in cloud computing[J]. Journal of Software, 2017, 28(9): 2334-2353.
[8] ZHANG H B, WANG J S, CHANG J. A multi-level security access control framework for cross-domain networks[C]//2017 IEEE International Conference on Computational Science and Engineering (CSE) and IEEE International Conference on Embedded and Ubiquitous Computing (EUC). New York: IEEE, 2017: 316-319.
[9] ROY K, BHOWMICK A. A Proposed mechanism for cross-domain authorization in grid computing environment[J]. International Journal of Emerging Technology and Advanced Engineering, 2012, 2(4): 163-166.
[10] 熊雄, 王福喜, 左海洋. 面向多级多域信息系统的访问控制方法研究[J]. 计算机工程与设计, 2011, 32(11): 3613-3617.XIONG Xiong, WANG Fuxi, ZUO Haiyang. Research of access control method on multi-level & multi-domain information system [J]. Computer Engineering and Design, 2011, 32(11): 3613-3617.
[11] 沈晴霓, 杨雅辉, 禹熹, 等.一种面向多租户云存储平台的访问控制策略[J].小型微型计算机系统, 2011, 32(11):2223-2229.SHEN Qingni, YANG Yahui, YU Xi, et al. An access control policy for multi-tenancy cloud storage platform [J]. Journal of Chinese Computer Systems, 2011, 32(11): 2223-2229.
[12] BISWAS P, SANDHU R, KRISHNAN R. Label-based access control: an ABAC model with enumerated authorization policy[C]//Proceedings of the 2016 ACM International Workshop on Attribute Based Access Control. New York: ACM, 2016: 1-12.
[13] LANGSTON M E. Materials in an Atlas-Agena shroud [J]. Metal Progress, 1967, 91(2): 125-128.
[14] SANDHU R S. Lattice-based access control models[J]. Computer, 1993, 26(11): 9-19.
[15] KUHN D R, COYNE E J, WEIL T R. Adding attributes to role-based access control [J]. Computer, 2010, 43(6): 79-81.
[16] NEUMAN B C, TS'O T. Kerberos: an authentication service for computer networks [J]. IEEE Communications Magazine, 1994, 32(9):33-38.
[2] FLESCA S, GRECO S, MASCIARI E, et al. A comprehensive guide through the italian database research over the last 25 years[M]. Switzerland: Springer, 2018.
[3] 冯登国, 张敏, 李昊. 大数据安全与隐私保护[J]. 计算机学报, 2014, 37(1): 246-258.FENG Dengguo, ZHANG Min, LI Hao. Big data security and privacy protection [J]. Chinese Journal of Computers, 2014, 37(1): 246-258.
[4] MORENO J, SERRANO M A, FERNáNDEZ-MEDINA E, et al. Towards a security reference architecture for big data[C]//Proceedings of the 20th International Workshop on Design, Optimization, Languages and Analytical Processing of Big Data co-located with 10th EDBT/ICDT Joint Conference (EDBT/ICDT 2018). Vienna: CEUR Workshop, 2018.
[5] SHAW S, VERMEULEN A F, GUPTA A, et al. Practical Hive: a guide to hadoop?s data warehouse system[M]. New York: Apress, 2016: 11-21.
[6] THUSOO A, SARMA J S, JAIN N, et al. An attribute-based access control model for secure big data processing in Hadoop ecosystem[C]//Proceedings of the Third ACM Workshop on Attribute-Based Access Control. New York: ACM, 2018: 13-24.
[7] 杨腾飞, 申培松, 田雪, 等. 对象云存储中分类分级数据的访问控制方法[J]. 软件学报, 2017, 28(9): 2334-2353.YANG Tengfei, SHEN Peisong, TIAN Xue, et al. Access control mechanism for classified and graded object storage in cloud computing[J]. Journal of Software, 2017, 28(9): 2334-2353.
[8] ZHANG H B, WANG J S, CHANG J. A multi-level security access control framework for cross-domain networks[C]//2017 IEEE International Conference on Computational Science and Engineering (CSE) and IEEE International Conference on Embedded and Ubiquitous Computing (EUC). New York: IEEE, 2017: 316-319.
[9] ROY K, BHOWMICK A. A Proposed mechanism for cross-domain authorization in grid computing environment[J]. International Journal of Emerging Technology and Advanced Engineering, 2012, 2(4): 163-166.
[10] 熊雄, 王福喜, 左海洋. 面向多级多域信息系统的访问控制方法研究[J]. 计算机工程与设计, 2011, 32(11): 3613-3617.XIONG Xiong, WANG Fuxi, ZUO Haiyang. Research of access control method on multi-level & multi-domain information system [J]. Computer Engineering and Design, 2011, 32(11): 3613-3617.
[11] 沈晴霓, 杨雅辉, 禹熹, 等.一种面向多租户云存储平台的访问控制策略[J].小型微型计算机系统, 2011, 32(11):2223-2229.SHEN Qingni, YANG Yahui, YU Xi, et al. An access control policy for multi-tenancy cloud storage platform [J]. Journal of Chinese Computer Systems, 2011, 32(11): 2223-2229.
[12] BISWAS P, SANDHU R, KRISHNAN R. Label-based access control: an ABAC model with enumerated authorization policy[C]//Proceedings of the 2016 ACM International Workshop on Attribute Based Access Control. New York: ACM, 2016: 1-12.
[13] LANGSTON M E. Materials in an Atlas-Agena shroud [J]. Metal Progress, 1967, 91(2): 125-128.
[14] SANDHU R S. Lattice-based access control models[J]. Computer, 1993, 26(11): 9-19.
[15] KUHN D R, COYNE E J, WEIL T R. Adding attributes to role-based access control [J]. Computer, 2010, 43(6): 79-81.
[16] NEUMAN B C, TS'O T. Kerberos: an authentication service for computer networks [J]. IEEE Communications Magazine, 1994, 32(9):33-38.