HDFS access control method based on role and user trust value

Abstract

The invention provides an HDFS access control method based on a role and a user trust value and belongs to the field of computer cloud storage access control. The HDFS access control method of the invention firstly combines with a role-based access control policy RBAC to replace a discretionary access control policy of an HDFS, thereby reducing complexity and management expenditure of HDFS authorization management and improving flexibility of the authorization management. When a user accesses the HDFS for the first time, a role is granted to the user, so that users are isolated from authorization through roles, and the management is facilitated. On this basis, the HDFS access control method of the invention further introduces a concept of the user trust value and sets one trust value for each user so that different users with the same role could obtain different access permissions because of their different trust values, and the trust value of the user is dynamically updated according to the later behavior of the user, thereby dynamically and effectively controlling the access of the user to a resource in the HDFS.

Description

technical field [0001] The invention relates to an HDFS access control method based on roles and user trust values, and belongs to the field of computer cloud storage access control. Background technique [0002] With the rapid development of cloud storage technology, more and more users and enterprises use cloud storage to save data or backup data to enhance data mobility, but the resulting security issues have not been effectively resolved. The core of cloud storage is actually a distributed file system, so the data security problem of cloud storage is actually the data security problem of distributed file system. [0003] The original design of Hadoop assumed that HDFS was running in a safe and closed environment, and all nodes in the cluster were reliable and trustworthy, and provided to a group of users who cooperated with each other, so the main consideration of HDFS at the beginning of the design was performance issues for large-scale data storage, and not much atten...

AI Technical Summary

Problems solved by technology

HDFS does not provide sufficient security authentication between users and services. By default, HDFS uniquely determines the identity of the client through the user name and user group of the running process. However, since the client is remote, users can simply log in remotely. Create an account in your own name on the system, so that the user can pretend to be any identity, thereby bypassing HDFS permission verification and accessing data in HDFS at will

In addition, since the Data Node node does not enforce any access control measures for client access, this may cause an unauthorized client to directly read the data block as long as it knows the BlockID of the data block, bypassing the communication with the Name Node node At the same time, anyone can write arbitrary data blocks to the Data Node node, or pretend to be a legitimate Data Node node to receive the tasks and data of the Name Node node

Although HDFS itself supports permission control, it only provides simple autonomous access control, which is represented by 9-bit bits, which has weak support and has a large security risk.

Images