《山东大学学报(理学版)》 ›› 2019, Vol. 54 ›› Issue (3): 1-9.doi: 10.6040/j.issn.1671-9352.2.2018.073
• • 下一篇
常天天1(
),陈兴蜀2,3,*(),罗永刚3,兰晓3
Tian-tian CHANG1(),Xing-shu CHEN2,3,*(),Yong-gang LUO3,Xiao LAN3
摘要：
针对Hive数据库中的数据共享所带来的敏感信息泄漏问题,以数据分级为前提,利用基于标签的访问控制技术,提出了一种基于安全域的数据隔离保护框架(SD-DIPF)。首先,通过设计层次安全标签树划分标签级别,用来对系统中的主客体进行标识;结合分级标签阐明安全域(SD)的设计思想,对安全域及其子域进行定义以及安全性的形式化证明;最后,利用安全域对平台数据进行逻辑划分保证不同敏感级别数据的有效隔离;针对该框架对Hive数据库的适用性进行说明,并结合现有的认证机制给出了其在Hive数据库中的实现。通过实验分析验证该框架可以保障敏感数据不被非法访问,证明了本框架的可行性和安全性。
中图分类号:
| 1 | THURAISINGHAM B. Big data security and privacy[C]//Proceedings of the 5th ACM Conference on Data and Application Security and Privacy. San Antonio: ACM, 2015: 279-280. |
| 2 | FLESCA S , GRECO S , MASCIARI E , et al. A comprehensive guide through the italian database research over the last 25 years[M]. Switzerland: Springer, 2018. |
| 3 | 冯登国, 张敏, 李昊. 大数据安全与隐私保护[J]. 计算机学报, 2014, 37 (1): 246- 258. |
| FENG Dengguo , ZHANG Min , LI Hao . Big data security and privacy protection[J]. Chinese Journal of Computers, 2014, 37 (1): 246- 258. | |
| 4 | MORENO J, SERRANO M A, FERNÁNDEZ-MEDINA E, et al. Towards a security reference architecture for big data[C]//Proceedings of the 20th International Workshop on Design, Optimization, Languages and Analytical Processing of Big Data co-located with 10th EDBT/ICDT Joint Conference (EDBT/ICDT 2018). Vienna: CEUR Workshop, 2018. |
| 5 | SHAW S , VERMEULEN A F , GUPTA A , et al. Practical Hive: a guide to hadoop's data warehouse system[M]. New York: Apress, 2016: 11- 21. |
| 6 | THUSOO A, SARMA J S, JAIN N, et al. An attribute-based access control model for secure big data processing in Hadoop ecosystem[C]//Proceedings of the Third ACM Workshop on Attribute-Based Access Control. New York: ACM, 2018: 13-24. |
| 7 | 杨腾飞, 申培松, 田雪, 等. 对象云存储中分类分级数据的访问控制方法[J]. 软件学报, 2017, 28 (9): 2334- 2353. |
| YANG Tengfei , SHEN Peisong , TIAN Xue , et al. Access control mechanism for classified and graded object storage in cloud computing[J]. Journal of Software, 2017, 28 (9): 2334- 2353. | |
| 8 | ZHANG H B, WANG J S, CHANG J. A multi-level security access control framework for cross-domain networks[C]//2017 IEEE International Conference on Computational Science and Engineering (CSE) and IEEE International Conference on Embedded and Ubiquitous Computing (EUC). New York: IEEE, 2017: 316-319. |
| 9 | ROY K , BHOWMICK A . A Proposed mechanism for cross-domain authorization in grid computing environment[J]. International Journal of Emerging Technology and Advanced Engineering, 2012, 2 (4): 163- 166. |
| 10 | 熊雄, 王福喜, 左海洋. 面向多级多域信息系统的访问控制方法研究[J]. 计算机工程与设计, 2011, 32 (11): 3613- 3617. |
| XIONG Xiong , WANG Fuxi , ZUO Haiyang . Research of access control method on multi-level & multi-domain information system[J]. Computer Engineering and Design, 2011, 32 (11): 3613- 3617. | |
| 11 | 沈晴霓, 杨雅辉, 禹熹, 等. 一种面向多租户云存储平台的访问控制策略[J]. 小型微型计算机系统, 2011, 32 (11): 2223- 2229. |
| SHEN Qingni , YANG Yahui , YU Xi , et al. An access control policy for multi-tenancy cloud storage platform[J]. Journal of Chinese Computer Systems, 2011, 32 (11): 2223- 2229. | |
| 12 | BISWAS P, SANDHU R, KRISHNAN R. Label-based access control: an ABAC model with enumerated authorization policy[C]//Proceedings of the 2016 ACM International Workshop on Attribute Based Access Control. New York: ACM, 2016: 1-12. |
| 13 | LANGSTON M E . Materials in an Atlas-Agena shroud[J]. Metal Progress, 1967, 91 (2): 125- 128. |
| 14 |
SANDHU R S . Lattice-based access control models[J]. Computer, 1993, 26 (11): 9- 19.
doi: 10.1109/2.241422 |
| 15 |
KUHN D R , COYNE E J , WEIL T R . Adding attributes to role-based access control[J]. Computer, 2010, 43 (6): 79- 81.
doi: 10.1109/MC.2010.155 |
| 16 |
NEUMAN B C , TS'O T . Kerberos: an authentication service for computer networks[J]. IEEE Communications Magazine, 1994, 32 (9): 33- 38.
doi: 10.1109/35.312841 |
| [1] | 李宇溪,王恺璇,林慕清,周福才. 基于匿名广播加密的P2P社交网络隐私保护系统[J]. 山东大学学报（理学版）, 2016, 51(9): 84-91. |
| [2] | 唐乾,杨飞,黄琪,林果园. 基于TCB子集的访问控制信息安全传递模型[J]. 山东大学学报（理学版）, 2016, 51(7): 98-106. |
| [3] | 蔡红云,马晓雪. 在线社会网络中基于关系强度的访问控制机制[J]. 山东大学学报（理学版）, 2016, 51(7): 90-97. |
| [4] | 赵斌,何泾沙,张伊璇. 基于信息熵隶属度的决策属性权重确定方法[J]. 山东大学学报（理学版）, 2016, 51(3): 86-90. |
| [5] | 吕盟, 刘哲, 刘建伟. 企业级无线局域网可信域间访问控制方案[J]. 山东大学学报（理学版）, 2014, 49(11): 82-88. |
| [6] | 邹德清, 杨凯, 张晓旭, 苑博阳, 冯明路. 虚拟域内访问控制系统的保护机制研究[J]. 山东大学学报（理学版）, 2014, 49(09): 135-141. |
| [7] | 杨晓晖, 王虹, 江丽军, 常思远. 一种基于信任度量的Web服务跨域访问控制模型[J]. 山东大学学报（理学版）, 2014, 49(09): 115-122. |
| [8] | 高枫1,何泾沙2. 基于信任和信息流模型的隐私保护方法[J]. J4, 2011, 46(5): 39-43. |
| [9] | 刘琚,郑丽娜. 多跳无线网络中协作ARQ机制和协作MAC技术[J]. J4, 2011, 46(10): 57-65. |
| [10] | 陈 钦,冯建华 . 一个企业级多媒体数据库的设计与实现[J]. J4, 2007, 42(9): 46-50 . |
|
