HDFS Access Authentication Using Client Identity Challenges
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing authentication methods for Hadoop Distributed File System (HDFS) are either too weak or too complex, leading to potential unauthorized access and security vulnerabilities.
Innovation Solution
Implement a file system enforcement point that issues a challenge to clients to provide credentials for declared identities, ensuring only true credentials are submitted, thereby authenticating the identity and preventing unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional authentication methods are used for HDFS access, then the system is easier to operate, but security reliability is insufficient
Solution Approach 1:
The client system performs self-authentication by using its own identity credentials to verify tasks. The enforcement point leverages the client's inherent security context without requiring external authentication infrastructure, making the system both secure and self-sufficient.
Solution Approach 2:
An enforcement point is introduced as an intermediary between the client and HDFS. This enforcement point intercepts requests, validates task credentials against client identity, and either permits or blocks access, thereby simplifying the authentication flow while maintaining strong security.
2Reliability
If external authentication systems are implemented, then authentication capability is enhanced, but device complexity increases
Solution Approach 1:
The system uses the client's existing security context and identity credentials without requiring external authentication systems. The client itself provides the authentication mechanism by enforcing that tasks can only access credentials belonging to their declaring identity, eliminating the need for additional external authentication infrastructure.
Solution Approach 2:
The enforcement point serves multiple functions: it acts as an authentication gateway, validates task credentials, enforces identity binding policies, and controls HDFS access all in one component. This multi-functionality reduces overall system complexity by consolidating authentication-related operations.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Systems, computer program products and methods implementing access control on a distributed file system are described. A file system enforcement point protects an HDFS from unauthorized access by authenticating a declared identity of a task submitting a request from a client. Upon receiving the request, the file system enforcement point submits a challenge to the client, requesting the task to provide credentials of the declared identity. The task submits credentials. On the client, each task has access to credentials of a true identity of the task. Accordingly, in case a task submits a claimed identity that is different from the true identity of the task, the task cannot submit correct credentials in response to the challenge. The file system enforcement point authenticates the declared identity using the submitted credentials. The file system enforcement point allows the client to access the HDFS only upon successful authentication.