The invention discloses a
data sharing implementation method of asymmetric
encryption in a Hadoop multi-tenant environment. The method comprises the following steps: in a cluster with tenant-level symmetric
encryption isolation, generating an RSA key pair for each tenant, storing a public key in a
plaintext, and performing secondary
encryption protection on a private key by a tenant
master key; when a source tenant shares, the Ranger KMS internally decrypts the to-be-shared EZ-Key or DEK, a public key of a target tenant is used for encryption to generate a digital envelope, a
unique identifier is distributed, and the NameNode extension attribute of a
shared object is written; when a target tenant accesses the envelope, after the Ranger KMS verifies the effectiveness of the envelope, the private key of the envelope is used for decryption to obtain a symmetric key
plaintext, and transparent decryption is realized;
revocation only needs to mark envelope invalidation and clear extended attributes, and re-encryption is not needed. According to the method, the problems that symmetric keys cannot be revoked and plaintexts are leaked in cross-tenant sharing are solved, and the method has the advantages of key security, lossless performance, transparent access and full-link auditing.