Transparent Encryption Agent for Distributed Filesystem Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In distributed filesystems, particularly in multitenant environments, access control for data blocks is challenging due to the distributed nature of the system, where the operating system managing name nodes is not aware of the data owner, leading to difficulties in enforcing access controls and security, especially with Hadoop-based systems where administrators have unrestricted access as they share the same identity as the name node process.
Innovation Solution
A transparent encryption agent is implemented that maps access control rules and encryption keys to filenames in a first filesystem, allowing it to determine the owner of a data block based on an I/O request and apply appropriate access control and encryption/decryption transparently, using a server-based mapping mechanism that associates block filenames in a second filesystem with filenames and owners in the first filesystem.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If a distributed filesystem is used for large-scale data processing, then processing capability is improved, but data security and access control become problematic
Solution Approach 1:
The patent introduces an intermediary layer (encryption agent and mapping mechanism) between the distributed filesystem and the local filesystem. This intermediary translates block filenames from the distributed namespace to filenames in the local namespace, enabling access control rules to be applied transparently without compromising the distributed processing capability.
Solution Approach 2:
The patent segments the filesystem into two distinct namespaces: a first namespace (HDFS) where access control rules are defined, and a second namespace (local filesystem) where data blocks are actually stored. This segmentation allows each namespace to operate independently with its own security model while maintaining data integrity through mapping relationships.
2Reliability
If encryption keys are defined in the local filesystem namespace, then access control is achieved, but system complexity and user burden increase
Solution Approach 1:
The system automatically performs the mapping between distributed filenames and local filenames without requiring user intervention. The encryption agent autonomously intercepts I/O requests, resolves the mapping, and applies the appropriate encryption keys, making the complexity invisible to users while maintaining strong access control.
Solution Approach 2:
Access control rules and encryption keys are pre-configured in the first filesystem namespace before data is written to the distributed filesystem. When data is stored, the mapping relationship is established in advance, enabling automatic enforcement of access control without requiring real-time user configuration or intervention.
3Ease of operation
If administrators share the same identity as the name node process, then system operation is simplified, but unrestricted access creates security vulnerabilities
Solution Approach 1:
The patent applies different security policies to different levels of the system. At the HDFS namespace level, administrators have simplified access for operational purposes. However, at the local filesystem level where actual data blocks are stored, strict access control rules are enforced based on file ownership and permissions, preventing administrators from accessing encrypted data without proper authorization.
Data Source
Figure 1
Figure 2~3
Figure 4~5
AI summary
A method for access control of data in a filesystem is provided. The method includes storing a map in a server, the map coupled to an agent, the map associating access control rules, filenames in a namespace in a first filesystem, and owners of files. The method includes determining a block filename in a namespace in a second filesystem, based on an I/O request from a data node to the second filesystem regarding a data block. The method includes determining a username of the I/O request and determining a filename in the namespace in the first filesystem, based on the block filename in the namespace in the second filesystem. The method includes applying to the data block and the username an access control rule that the map associates with an owner of a file having the filename in the namespace in the first filesystem.