Protection method and system for HDFS access mode

Abstract

The invention relates to a protection method and system for an HDFS access mode. The method comprises the following steps: decomposing a reading operation and a writing operation on a data node of an HDFS cluster into two atomic operations of reading first and writing second so as to hide an operation type of a file; adding obfuscated data blocks for the file before writing the file to the data node so as to hide the number of blocks of the file; deleting the file from the data node after reading the file each time, and randomly selecting one file in the file buffer area of the client to write back to the data node so as to hide the position of the data node stored in the file; and hiding the access frequency and the access sequence of the file through the continuous change of the storage position of the file. According to the invention, the design and implementation of the HDFS access mode protection scheme based on the ORAM technology are provided, the blank of HDFS access mode protection is filled, and the brought performance overhead is in an acceptable range while the HDFS security is enhanced.

Description

technical field [0001] The invention relates to data protection of Hadoop distributed file system (HDFS), in particular to a protection method and system for HDFS access mode. Background technique [0002] HDFS (Hadoop Distributed File System) is the core distributed file system of Hadoop. HDFS is often used to store large files, similar to traditional distributed systems. When the size of a data set exceeds the storage limit of a computer, the data set is divided and stored on a large number of cheap servers. HDFS is currently widely used in industry and academia. In recent years, people have higher and higher requirements for data privacy protection, which undoubtedly brings greater challenges to the data privacy protection capabilities of HDFS. For the current version of the HDFS system, the system design focuses on data availability and data integrity in terms of data security, and there are relatively few strategies for protecting data confidentiality. For example, a...

AI Technical Summary

Problems solved by technology

ORAM can hide the data access mode and confuse each access, so that the attacker cannot distinguish whether the access is real or fake, so the attacker will not be able to obtain privacy information such as user data storage location, access frequency, and access sequence. It is also impossible to further infer information such as the content and importance of user data

[0004] The shortcomings and limitations of existing methods are: HDFS, as a distributed storage system widely used in industry and academia, cannot resist all types of attacks only by data encryption, and attackers can still infer privacy through user access patterns. Information, there is no relevant research to realize the protection scheme for HDFS user access mode, which undoubtedly creates a huge security risk for many companies and individual users who use HDFS for distributed storage

The number of nodes in the cluster may be large in magnitude. If an attacker cannot grasp the user's access frequency, he needs to attack tens of thousands of nodes. This is obviously unrealistic, so the leakage of access frequency greatly reduces the attack cost

Images