A Framework for Attribute-Based Access Control in Processing Big Data with Multiple Sensitivities
Source abstract
Abstract
There is an increasing demand for processing large volumes of unstructured data for a wide variety of applications. However, protection measures for these big data sets are still in their infancy, which could lead to significant security and privacy issues. Attribute-based access control (ABAC) provides a dynamic and flexible solution that is effective for mediating access. We analyzed and implemented a prototype application of ABAC to large dataset processing in Amazon Web Services, using open-source versions of Apache Hadoop, Ranger, and Atlas. The Hadoop ecosystem is one of the most popular frameworks for large dataset processing and storage and is adopted by major cloud service providers. We conducted a rigorous analysis of cybersecurity in implementing ABAC policies in Hadoop, including developing a synthetic dataset of information at multiple sensitivity levels that realistically represents healthcare and connected social media data. We then developed Apache Spark programs that extract, connect, and transform data in a manner representative of a realistic use case. Our result is a framework for securing big data. Applying this framework ensures that serious cybersecurity concerns are addressed. We provide details of our analysis and experimentation code in a GitHub repository for further research by the community.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Privacy-Preserving Technologies in Data · Cryptography and Data Security · Access Control and Trust
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
Department of Electrical and Computer Engineering, University of Central Florida, Orlando, FL 32816, USA
The MITRE Corporation, Orlando, FL 32817, USA
Department of Computer Science, University of Central Florida, Orlando, FL 32816, USA
Funding
U.S. National Science Foundation (NSF)
References (59)
Show source-provided references
1. Chandrakar, I., and Hulipalled, V.R. (2021, January 1–3). Privacy Preserving Big Data mining using Pseudonymization and Homomorphic Encryption. Proceedings of the 2021 2nd Global Conference for Advancement in Technology (GCAT), Bangalore, India.10.1109/GCAT52182.2021.9587765 ↗
2. Sellami, R., Zalila, F., Nuttinck, A., Dupont, S., Deprez, J.-C., and Mouton, S. (2020, January 10–13). FADI–A Deployment Framework for Big Data Management and Analytics. Proceedings of the 2020 IEEE 29th International Conference on Enabling Technologies: Infrastructure for Collaborative Enterprises (WETICE), Bayonne, France.10.1109/WETICE49692.2020.00038 ↗
3. Colombo, P., and Ferrari, E. (2018, January 13–15). Access Control in the Era of Big Data: State of the Art and Research Directions. Proceedings of the 23nd ACM on Symposium on Access Control Models and Technologies (SACMAT’18), Indianapolis, IN, USA.10.1145/3205977.3205998 ↗
4. Horton, N., and DeSimone, A. (2018). Sony’s Nightmare before Christmas: The 2014 North Korean Cyber Attack on Sony and Lessons for US Government Actions in Cyberspace, Defense Technical Information Center.
5. SoK: Anatomy of data breaches
6. Hart, M. (2015). Kerberos Attacks: What You Need to Know, Cyberark.
7. George, L. (2016). User Name Handling in Hadoop, OpenCore.
8. Hu, V., Ferraiolo, D., Kunn, R., Schnitzer, A., Sandlin, K., Miller, R., and Scarfone, K. (2014). Guide to Attribute Based Access Control (ABAC) Definition and Considerations SP 800-162, NIST.10.6028/NIST.SP.800-162 ↗
9. International National Committee for Information Technology Standards (INCITS) (2018). Information Technology—Next Generation Access Control—Implementation Requirements, Protocols and API Definitions (NGAC-IRPAD), InterNational Committee for Information Technology Standards.
10. Sen, S., Guha, S., Datta, A., Rajamani, S., Tsai, J., and Wing, J. (2014, January 18–21). Bootstrapping Privacy Compliance in Big Data Systems. Proceedings of the 2014 IEEE Symposium on Security and Privacy, San Jose, CA, USA.10.1109/SP.2014.28 ↗
11. Framework for the Formal Specification and Verification of Security Guidelines10.25046/aj030106 ↗
12. Hu, V., Ferraiolo, D., and Kuhn, R. (2019). Attribute Considerations for Access Control Systems, National Institute of Standards and Technology (NIST).10.6028/NIST.SP.800-205 ↗
13. Nguyen, D. (2014). Provenance-Based Access Control Models. [Ph.D Thesis, Department of Computer Science, University of Texas at San Antonio].
14. Liao, C., and Squicciarini, A. (2015, January 4–7). Towards Provenance-Based Anomaly Detection in MapReduce. Proceedings of the IEEE/ACM International Symposium on Cluster Computing and the Grid (CCGRID), Shenzhen, China.10.1109/CCGrid.2015.16 ↗
15. A Provenance-Aware Access Control Framework with Typed Provenance10.1109/TDSC.2015.2410793 ↗
16. Advanced Resource Management with Access Control for Multitenant Hadoop10.1109/JCN.2015.000106 ↗
17. Solanki, N., Huang, Y., Yen, I.-L., Bastani, F., and Zhan, Y. (2018, January 23–27). Resource and Role Hierarchy Based Access Control for Resourceful Systems. Proceedings of the 2018 IEEE 42nd Annual Computer Softwae and Applications Conference (COMPSAC), Tokyo, Japan.10.1109/COMPSAC.2018.10280 ↗
18. Yu, Y., Chen, Y., and Wen, Y. (2013, January 28–30). Task-role based access control model in logistics management system. Proceedings of the 2013 IEEE International Conference on Service Operations and Logistics, and Informatics, Dongguan, China.10.1109/SOLI.2013.6611396 ↗
19. Alshammari, S., Albeshri, A., and Alsubhi, K. (2021). Integrating a High-Reliability Multicriteria Trust Evaluation Model with Task Role-Based Access Control for Cloud Services. Symmetry, 3.10.3390/sym13030492 ↗
20. Wang, P., and Jiang, L. (2015, January 29–30). Task-role-based Access Control Model in Smart Health-care System. Proceedings of the MATEC Web of Conferences International Conference on Engineering Technology and Application (ICETA 2015), Nagoya, Japan.10.1051/matecconf/20152201011 ↗
21. Ma, L., Tao, L., Zhong, Y., and Gai, K. (2016, January 9–10). RuleSN: Research and Application of Social Network Access Control Model. Proceedings of the 2016 IEEE 2nd International Conference on Big Data Security on Cloud (BigDataSecurity), IEEE International Conference on High Performance and Smart Computing (HPSC), and IEEE International Conference on Intelligent Data and Security (IDS), New York, NY, USA.10.1109/BigDataSecurity-HPSC-IDS.2016.67 ↗
22. An Access Control Model for Online Social Networks Using User-to-User Relationships10.1109/TDSC.2015.2406705 ↗
23. Rizvi, S.Z.R., Fong, P.W., Crampton, J., and Sellwood, J. (2015, January 1–3). Relationship-Based Access Control for an Open-Source Medical Records System. Proceedings of the SACMAT’15: 20th ACM Symposium on Access Control Models and Technologies, Vienna, Austria.10.1145/2752952.2752962 ↗
24. A novel social network access control model using logical authorization language in cloud computing
25. Role-based and time-bound access and management of EHR data10.1002/sec.817 ↗
26. Time-Domain Attribute-Based Access Control for Cloud-Based Video Content Sharing: A Cryptographic Approach10.1109/TMM.2016.2535728 ↗
27. Gupta, M., Patwa, F., and Sandhu, R. (2017, January 19–21). Object-Tagged RBAC Model for the Hadoop Ecosystem. Proceedings of the IFIP Annual Conference on Data and Applications Security and Privacy DBSEC 2017, Philadelphia, PA, USA.10.1007/978-3-319-61176-1_4 ↗
28. An ontological framework for situation-aware access control of software services10.1016/j.is.2015.03.011 ↗
29. Content sensitivity based access control framework for Hadoop10.1016/j.dcan.2017.07.007 ↗
30. Zeng, W., Yang, Y., and Luo, B. (July, January 27). Access control for big data using data content. Proceedings of the 2013 IEEE International Conference on Big Data, Silicon Valley, CA, USA.10.1109/BigData.2013.6691798 ↗
31. Federated Security: The Shibboleth Approach
32. OASIS (2019). Cross-Enterprise Security and Privacy Authorization (XSPA) Profile of SAML v2.0 for Healthcare, Version 2.0, Committee Specification 01, OASIS.
33. HL7 International (2014). HL7 Healthcare Privacy and Security Classification System (HCS), Release 1, Ann, HL7 International.
34. Large universe attribute based access control with efficient decryption in cloud storage system10.1016/j.jss.2017.10.020 ↗
35. Attribute Based Encryption with Privacy Protection and Accountability for CloudIoT10.1109/TCC.2020.2975184 ↗
36. Attribute-Based Access Control with Constant-Size Ciphertext in Cloud Computing10.1109/TCC.2015.2440247 ↗
37. Wang, J., Crawl, D., Purawat, S., Nguyen, M., and Altintas, I. (November, January 29). Big data provenance: Challenges, state of the art and opportunities. Proceedings of the 2015 IEEE International Conference on Big Data, Santa Clara, CA, USA.10.1109/BigData.2015.7364047 ↗
38. Hellerstein, J., Sreekanti, V., Gonzalez, J., Dalton, J., Dey, A., Nag, S., Ramachandran, K., Arora, S., Bhattacharyya, A., and Das, S. (2017, January 8–11). A Data Context Service. Proceedings of the CIDR 2017, Chaminade, CA, USA.
39. M-SANIT: A Framework for Effective Big Data
40. Data Anonymization Technique for Privacy Preservation Using MapReduce Framework
41. A Scalable Two-Phase Top-Down Specialization Approach for Data Anonymization Using MapReduce on Cloud10.1109/TPDS.2013.48 ↗
42. Big Data and Hadoop-a Study in Security Perspective10.1016/j.procs.2015.04.091 ↗
43. Cloud Security Alliance, and Top Threats Working Group (2019). Top threats to Cloud Computing: Egregious Eleven, Cloud Security Alliance.
44. Khandelwal, S. (2017). Insecure Hadoop Clusters Expose Over 5,000 Terabytes of Data, The Hacker News.
45. Big Data: Hadoop framework vulnerabilities, security issues and attacks
46. Security Threats to Hadoop: Data Leakage Attacks and Investigation10.1109/MNET.2017.1500095NM ↗
47. Mondal, P. (2021). Thousands of Unauthenticated Databases Exposed on the Internet, RedHunt Labs.
48. Kolesnikov, O., and Parashar, H. (2019). Detecting Persistent Cloud Infrastructure/Hadoop/YARN Attacks Using Security Analytics: Moanacroner, XBash, and Others, Securonix Threat Research.
49. Sinha, S., Gupta, S., and Kumar, A. (2019, January 18–19). Emerging Data Security Solutions in HADOOP based Systems: Vulnerabilities and Their Countermeasures. Proceedings of the 2019 International Conference on Computing, Communication, and Intelligent Systems (ICCCIS), Greater Noida, India.10.1109/ICCCIS48478.2019.8974535 ↗
50. Cheng, L., Shen, Q., and Dong, C. (2018). Invader Job: A Kind of Malicious Failure Job on Hadoop YARN, IEEE.10.1109/ICC.2018.8422331 ↗
51. Geenens, P. (2018). Hadoop YARN: An Assessment of the Attack Surface and Its Exploits, Radware.
52. Antony, B. (2016). Secure Communication in Hadoop without Hurting Performance, Ebay.
53. Bhamidimarri, V.R. (2021). Introducing Amazon EMR Integration with Apache Ranger, AWS.
54. Tall, A., Zou, C., and Wang, J. (2020, January 1–3). Generating Connected Synthetic Electronic Health Records and Social Media Data for Modeling and Simulation. Proceedings of the Interservice/Industry Training, Simulation and Education Conference (I/ITSEC), Orlando, FL, USA.
55. Bhatt, S., Patwa, F., and Sandhu, R. (2017, January 24). ABAC with Group Attributes and Attribute Hierarchies Utilizing the Policy Machine. Proceedings of the 2nd ACM Workshop on Attribute-Based Access Control (ABAC’17), New York, NY, USA.10.1145/3041048.3041053 ↗
56. IEEE Computer Society Center for Secure Design (2015). Avoiding the Top 10 Software Security Design Flaws, IEEE.
57. Veracode (2020). State of Software Security Volume 11, Veracode.
58. Attribute based honey encryption algorithm for securing big data: Hadoop distributed file system perspective10.7717/peerj-cs.259 ↗
59. Gupta, E., Sural, S., Vaidya, J., and Atluri, V. (2022). Enabling Attribute-based Access Control in NoSQL Databases. IEEE Trans. Emerg. Top. Comput., 1–15.10.1145/3422337.3450323 ↗