Institute for Cyber Security ObjectTagged RBAC Model for

Institute for Cyber Security Object-Tagged RBAC Model for the Hadoop Ecosystem Maanak Gupta, Farhan Patwa, and Ravi Sandhu Institute for Cyber Security and Department of Computer Science University of Texas at San Antonio 31 st Annual IFIP WG 11. 3 Working Conference on Data and Applications Security and Privacy (DBSec 2017), Philadelphia, Pennsylvania, July 19 -21, 2017 © Maanak Gupta World-Leading Research with Real-World Impact! 1

Outline Ø Introduction and Motivation Ø Multi-layer Access Control Ø Authorization Architecture Ø Hadoop Ecosystem Access Control Model Ø OT-RBAC Model Ø Proposed Implementation Ø Attribute Based Extensions to OT-RBAC Ø Conclusion © Maanak Gupta World-Leading Research with Real-World Impact! 2

Big Data and Big Challenges Ø IDC 2025 : v global “datasphere” – 163 zettabytes v 10 x than 2016 Ø Opportunities: 21 st century gold for data miners Ø Big Data require “Big Systems” Security: Ø Secure Storage Ø Privacy Concerns (eg: HIPPA) Ø Fine granular access requirements © Maanak Gupta World-Leading Research with Real-World Impact! 3

Hadoop Ecosystem Ø Hadoop: resilient, cost efficient distributed storage (HDFS) and processing framework (Map. Reduce) and YARN Ø Ecosystem = Hadoop core + Open-Source Projects Ø Hadoop Data Lake Ø Security Concerns © Maanak Gupta World-Leading Research with Real-World Impact! 4

Multi-Layer Access Control Data and Service Objects Services HDFS Name. Node, YARN Resource. Manager Apache Hive © Maanak Gupta HDFS Files, Hive Tables Kafka Topics Cluster Resources and Applications World-Leading Research with Real-World Impact! YARN Queues, Cluster Nodes 5

Hadoop and Data Services Access Hadoop Daemons Access Configuration Web. HDFS Access via Apache Knox © Maanak Gupta World-Leading Research with Real-World Impact! 6

Data Objects Access Hive and HDFS Access Configurations © Maanak Gupta World-Leading Research with Real-World Impact! 7

Tag Based Objects Access Tag Based Policy Configuration © Maanak Gupta World-Leading Research with Real-World Impact! 8

Context Enricher and Policy Conditions Geo Location Based Policies © Maanak Gupta World-Leading Research with Real-World Impact! 9

Cluster Resource and Application Access access rights root default new. Queue YARN Queue Access Control Configuration © Maanak Gupta World-Leading Research with Real-World Impact! 10

Hadoop Ecosystem Authorization Architecture Policy Manager : Apache Ranger, Apache Sentry Gateway : Apache Knox Ecosystem Service (ES) : Apache Hive, HDFS, Apache Storm, Apache Kafka, YARN © Maanak Gupta World-Leading Research with Real-World Impact! 11

AC Model: Hadoop View Users (U), Groups (G) , Subjects (S) Hadoop Services (HS) : Name. Node, YARN Resource. Manager Hadoop Service Operations (OPHS) : access / communicate Objects (OB) : Files and Directories in HDFS Operations (OP) : read, write, execute © Maanak Gupta World-Leading Research with Real-World Impact! 12

AC Model: Ranger View Ecosystem Service (ES) : Hive, HDFS, Kafka, HBase Objects (OB) : Files and Directories in HDFS; Tables, columns in Hive Operations (OP) : read, write, execute, select, create Tag : PII, top-secret © Maanak Gupta World-Leading Research with Real-World Impact! 13

AC Model: Sentry View Roles (R) © Maanak Gupta World-Leading Research with Real-World Impact! 14

He. AC Model: Consolidated View Hadoop Ecosystem Access Control Model © Maanak Gupta World-Leading Research with Real-World Impact! 15

OT-RBAC Model Object-Tagged RBAC © Maanak Gupta World-Leading Research with Real-World Impact! 16

Group Based Role Inheritance Roles: {Staff, Grader, TA} Roles: {student} URA G 1 in he rit an ce Bob Roles: {TA} Roles: {Grader} Roles: {student, Staff, Grader, TA} Direct & effective membership UGA ctive Effe rship ive p t i be ec rsh f mem f e E b m me Effective Roles Bob G 3 G 2 Group Hierarchy Major Benefits: Easy Administration where multiple roles can be assigned to user with single administrative operation. © Maanak Gupta World-Leading Research with Real-World Impact! 17

Implementation Approach © Maanak Gupta World-Leading Research with Real-World Impact! 18

Adding Attributes to OT-RBAC User Attributes (UA) Service Attributes (SA) Object Attributes (OA) © Maanak Gupta World-Leading Research with Real-World Impact! 19

NIST Strategies Ø Dynamic Roles © Maanak Gupta World-Leading Research with Real-World Impact! 20

NIST Strategies Ø Attribute Centric © Maanak Gupta World-Leading Research with Real-World Impact! 21

NIST Strategies Ø Role Centric © Maanak Gupta World-Leading Research with Real-World Impact! 22

Defense in Depth Data and Service Objects Hadoop Daemons and Services Cluster Resource and Application Secure Hadoop Ecosystem © Maanak Gupta World-Leading Research with Real-World Impact! 23

Conclusion and Future Work Ø Formalized Conceptual He. AC Model Ø Object-Tagged-RBAC Model Ø Attributes based extensions Some Future Goals: Ø Introduce Data ingestion security Ø Privacy concerns and finer grained approaches in Multi-Tenant Hadoop Lake © Maanak Gupta World-Leading Research with Real-World Impact! 24