Ground System Architectures Workshop (GSAW 2013), Los Angeles, California, USA, March 201

Irvine, Cynthia E.

Khosalim, Jean

Nguyen, Thuy D.

Calhoun, Institutional Archive of the Naval Postgraduate School

Calhoun: The NPS Institutional ArchiveFaculty and Researcher Publications Faculty and Researcher Publications2013-03A Multilevel Secure MapReduceFramework for Cross-DomainInformation Sharing in the CloudNguyen, Thuy D.http://hdl.handle.net/10945/35001 GSAW 2013 1    A Multilevel Secure MapReduce Framework for Cross-Domain Information Sharing in the Cloud  Thuy D. Nguyen, Cynthia E. Irvine, Jean Khosalim Department of Computer Science    Ground System Architectures Workshop  March 18-21, 2013 Published by The Aerospace Corporation with permission. • Motivation - Develop a cross-domain MapReduce framework for a multilevel secure (MLS) cloud, allowing users to analyze data at different security classifications   • Topics - Apache Hadoop framework - MLS-aware Hadoop Distributed File System • Concept of operations • Requirements, design, implementation - Future work and conclusion  Introduction 2  GSAW 2013 • Open source software framework for reliable, scalable, distributed computing • Inspired by Google’s MapReduce computational paradigm and Google File System (GFS) • Two main subprojects: - Hadoop Distributed File System, Hadoop MapReduce  • Support distributed computing on massive data sets on clusters of commodity computers • Common usage patterns - ETL (Extract  Transform  Load) replacement - Data analytics, machine learning - Parallel processing platforms (Map without Reduce) Apache Hadoop  3  GSAW 2013 Hadoop Architecture 4   GSAW 2013 Name Node Job Tracker Task Tracker Task Tracker Client HDFS access HDFS access MapReduce Job Submission HDFS block access Intra-MR Engine operations Secondary NameNode Intra-HDFS operations Data Node Intra-HDFS operations HDFS metadata access Internal server-to-server communications Client-to-Server communications Data Node a b d c 1 2 3 1 y 5 MLS-Aware: A Definition A component is considered MLS-aware if it executes without privileges in an MLS environment, and yet takes advantage of that environment to provide useful functionality.  Examples: - Reading from resources labeled at the same or lower security levels - Making access decisions based on the security level of the data - Returning the security level of the data  GSAW 2013 6 Objective and Approach • Objective - Extend Hadoop to provide a cross-domain read-down capability without requiring  the Hadoop server components to be trustworthy • Approach - Modify Hadoop to run on a trusted platform that enforces an MLS policy on local file system • Use Security Enhanced Linux (SELinux) for initial prototype - Modify HDFS to be MLS-aware • Multiple single-level HDFS instances – each is cognizant of HDFS namespaces at lower security levels  • HDFS servers running at a security level can access file objects at lower levels as permitted by underlying trusted computing base (TCB) - No trusted processes outside TCB boundary  GSAW 2013 • User session level - Implicitly established by security level of receiving network interface and TCP/IP ports • File access policy rules - A user can read and write file objects at user’s session level - A user can read file objects if the user’s session level dominates the level of the requested object • File system abstraction - HDFS interface is similar to UNIX file system  - Traditional Hadoop cluster: one file system - MLS-enhanced cluster: multiple file systems, one per security level  HDFS Concept of Operation 7   GSAW 2013 • Root directory at a particular level is expressed as  /<user-defined security-level-indicator>   • Security-level-indicator is administratively assigned to an SELinux sensitivity level • Traditional root directory (/) is root at the user’s session level   HDFS File Organization 8   GSAW 2013 • Multiple single-level HDFS server instances co-locate on same physical node • All NameNode instances run on same physical node • DataNode instances are distributed across multiple physical nodes - Authoritative DataNode instance:  owner of local files used to store HDFS blocks  - Surrogate DataNode instance: handles read-down requests on behalf of an authoritative DataNode instance running at a lower level • Configuration file defines allocation of authoritative and surrogate DataNode instances on different physical nodes • Design does not impact MapReduce subsystem - JobTracker and TaskTracker only interact with NameNode and DataNode as HDFS clients   MLS-aware Hadoop Design 9   GSAW 2013 MLS-enhanced Hadoop Cluster 10   GSAW 2013 Process Physical node • Client running at user’s session level - Contact NameNode at same level to request a file at a lower level • NameNode instance at session level - Obtain metadata of requested file and storage locations of associated blocks from NameNode instance running at lower security level - Direct client to contact surrogate DataNode instances that co-locate with the file’s primary DataNode instances • Surrogate DataNode instance at session level - Look up locations of local files used to store requested blocks  - Read local files and return requested blocks • Security level of local files is lower than session level   Cross-domain Read-down 11   GSAW 2013 Read-down Example 12   GSAW 2013 • Use open source Count Lines of Code (CLOC) tool  - Can calculate differences in blank, comment, and source lines • Summary of code modification - Delta value is the sum of addition, removal, and modification of source lines - Overall change is less than 5%  Source Lines of Code (SLOC) Metric 13   GSAW 2013 • Future work - Adding read-down support to HDFS Federation - Implementing an external Cache Manager - Investigating Hadoop’s use of Kerberos for establishing user sessions at different security levels - Performing benchmark testing with larger datasets • Prototype is the first step towards developing a highly secure MapReduce platform  • Does not introduce any trusted processes outside the pre-existing TCB boundary • Only affects HDFS servers   Future Work and Conclusions 14   GSAW 2013  GSAW 2013 15 Contact  Cynthia E. Irvine, PhD, irvine@nps.edu Thuy D. Nguyen, tdnguyen@nps.edu  Center for Information Systems Security Studies and Research Department of Computer Science Naval Postgraduate School, Monterey, CA  93943   U.S.A  http://www.cisr.us  

A Multilevel Secure MapReduce Framework for Cross-Domain Information Sharing in the Cloud

http://calhoun.nps.edu/bitstream/handle/10945/35001/13GSAW-MLSHadoop-v3-NA.pdf?sequence=3&isAllowed=y

A Multilevel Secure MapReduce Framework for Cross-Domain Information Sharing in the Cloud

Abstract

Similar works

Full text

Available Versions

Calhoun, Institutional Archive of the Naval Postgraduate School