SEHive:基于类型增强的Hive强制访问控制模型与实现  

SEHIVE: TYPE-ENHANCED MANDATORY ACCESS CONTROL MODEL AND ENFORCEMENT FOR HIVE

作　　者：汤定一 韩伟力[1] Tang Dingyi;Han Weili(School of Software,Fudan University,Shanghai 200433,China)

机构地区：[1]复旦大学软件学院,上海200433

出　　处：《计算机应用与软件》2022年第7期281-286,294,共7页Computer Applications and Software

基　　金：国家自然科学基金重点项目(U1836207);上海市创新行动计划项目(18511103600)。

摘　　要：在借鉴SELinux模型的基础上,提出面向Hive的基于类型增强的强制访问控制模型TE-MAC。该模型将主体与域关联,客体与类型关联,根据域与类型之间的访问规则控制访问,最大限度地减小用户可访问资源的范围,实现最小特权原则。同时引入组层次关系,便于结构化的权限管理。基于原型系统SEHive的实现,显示其对Hive中敏感数据强制访问控制的可行性。Referred to SELinux, this paper proposes a type-enhanced mandatory access control model named TE-MAC for Hive. The model associated subject with domain, object with type, and controlled access according to the access policies between domains and types. It minimized the range of accessible resources, and implemented the principle of least privilege. And group hierarchical relationships were introduced to facilitate structured authority management. Based on the implementation of the prototype system SEHive, it shows the feasibility of mandatory access control over sensitive data in Hive.

关 键 词：大数据 HADOOP Hive 类型增强 强制访问控制 

分 类 号：TP3[自动化与计算机技术—计算机科学与技术]