基于信息流控制的HDFS敏感数据安全增强  

Enhancing sensitive data security with information flow control for HDFS

作　　者：吴泽智[1,2] 陈性元 杜学绘[1] 杨智 Wu Zezhi;Chen Xingyuan;Du Xuehui;Yang Zhi(College of Cryptogram Engineering,Information Engineering University,Zhengzhou 450001,China;State Key Laboratory of Cryptology,Beijing 100094,China)

机构地区：[1]信息工程大学密码工程学院,郑州450001 [2]密码科学技术国家重点实验室,北京100094

出　　处：《计算机应用研究》2018年第11期3432-3435,共4页Application Research of Computers

基　　金：国家"863"计划资助项目(2015AA016006;2012AA012704);国家重点研发计划资助项目(2016YFB0501900)

摘　　要：针对HDFS已有保护方法如认证授权、数据加密、访问控制和审计方法都不能保证敏感数据端到端的安全性,提出了一个用于HDFS的安全代数语言SALH(security algebra language for HDFS),给出了SALH的语义和语法;采用SALH形式化描述了HDFS信息流跟踪和控制模型并证明了模型的无干扰安全性。最后,给出了原型系统IF-HDFS设计与实现关键技术,原型系统的功能和性能测试结果表明IF-HDFS可实时、有效、准确地实现信息流跟踪与控制。Existing protection method for HDFS such as authentication and authorization,data encryption,access control and audit cannot guarantee the end-to-end security of sensitive data.First,this paper proposed a security algebra language for HDFS(SALH)and gave the semantics and grammar of SALH.Then it formal descried the model of the information flow trac-king and controlling for HDFS by SALH,and proved the interference security property of the model.Finally,it gave the key technologies of design and implementation of prototype system(IF-HDFS).The function and performance test results show that IF-HDFS is an effective and accurate system that tracking and controlling information flow at runtime.

关 键 词：分布式文件系统 信息流跟踪 安全代数 无干扰 形式化分析 

分 类 号：TP309.2[自动化与计算机技术—计算机系统结构]