【作者】 黄晶；

【导师】 李仁发；

【作者基本信息】 湖南大学 ， 计算机科学与技术， 2013， 硕士

【摘要】 Hadoop是一个开源的云计算平台,而云计算作为一种新的计算模式,是分布式计算、网格计算的延伸,通过将大规模的可利用的有效资源进行整合,把计算资源、存储资源等以服务的形式提供给用户。云计算通过高性能计算、大容量存储等改善了人们的生活,但云安全一直是云计算发展的瓶颈,在很多情况下,系统对安全的要求比计算更重要。本文针对Hadoop为基础的云平台作出以下工作。首先,本文针对用户与Hadoop云平台进行交互时在公共网络信道上进行数据通信存在不安全等因素的问题提出了基于身份认证与数据认证的混合认证方案。该方案从结构、性能、安全多方位进行了综合考虑与设计。结构方面针对云计算的特点与多方面的综合考虑采用B/S的方式,性能方面根据数据的密级进行分级加密以减少不必要的性能消耗,在安全方面既能保证用户身份的正确性同时也能确认云端接收到的数据的拥有者,保证数据确实来自对应用户。该方案包括了用户身份的认证,密钥的产生、分发、传送、获取,数据的加密、签名、抽样、检验、存储等多个子过程。每一步骤都进行了精心的考虑,使本方案最终能达到方便、高效、安全的通信效果。其次,针对Hadoop集群中可能出现合法用户对数据进行非法操作,提出在Hadoop节点上加入基于XACML的角色访问控制策略。用户数据上传到Hadoop后,Hadoop并没对数据进行严格的访问控制。Hadoop集成了Kerberos安全协议能有效防止非法用户对集群资源的访问,但并不能防止合法用户对资源的非法访问。在Hadoop节点中加入基于XACML的角色访问控制策略能有效阻止非法用户的访问与合法用户的非法访问,且策略被分布式地执行在数据节点上,除了能抵制外部攻击,还能防御内部攻击,保证整个Hadoop集群的安全性。最后,我们搭建了以Hadoop为基础的云平台,对提出的方案进行实验。通过功能测试与性能测试,我们证明了本文提出的方案虽然会带来部分性能消耗,但是可以提供预期的安全效果,且这种消耗对于系统来说是可以接受的。更多还原

【Abstract】 Hadoop is an open cloud computing platform. Cloud computing is a new computing model. It derives from distributed computing, grid computing etc, integrating available valid resources and providing computing resources, storage resource for user as service. The object faced by cloud computing could be enterprise, government, personal and so on, but Cloud computing is transparent to user who could not know the detail operation of the step in it, which can give user a feeling of high performance computing and large storage space and it begin to blend in human life. However, Cloud security issues have been blocking the development of cloud computing. To the majority of users, security is more important than computing power. In this paper, we made the following work for data security within cloud environment based on Hadoop platform.First, insecurity for the user interact with the cloud platform in the public network channel for data transmission, storage, etc, a mixed authentication method based on the authentication and data authentication are proposed. The scheme combined with the whole structure, performance and security of the program to design. The struck, combined with a wide range of comprehensive consideration, use B/S model. In order to reduce the unnecessary cost of the resource, the scheme adopt that the secret level of the data decide the encrypted degree of the data. Lastly, the security aspect involves several aspects which include the identity authentication, key generation, key distribution, key transmission, data encrypting, data signature, data sampling, data verification, data storage etc. Each step is carefully considered. Finally, the scheme can achieve convenient, efficient and security effect.Second, On Hadoop cluster, it may be out of control that a legitimate user can execute a illegal operation. After User data has been uploaded to the Hadoop, Hadoop distributed storage it in HDFS. However, Hadoop do not strictly control the data access. In2009, Hadoop, integrated with Kerberos, can prevent illegal users access to resources, but cannot prevent legitimate users’illegal access to resources. This paper proposed a method, adding XACML-based access control into Hadoop cluster. It can effectively prevent the illegal user’s access with the legitimate users’s illegal access by adding XACML-based Role access control policy, and the policy is performed distributed on the data nodes. In addition to able to boycott external attacks, it also can defense against internal attacks, ensuring the entire Hadoop cluster securityFinally, Set up Hadoop-based cloud platform, and do experiments on proposed scheme. Experiments are divided into functional test and performance test. Functional test is aim to verify whether proposed scheme can achieve desired security effect or not.experiment results show that it can definitely achieve the expect goals Performance test’s aim is to test the consumption of performance, even though, it makes some consumption to the performance, when it comes to the expect goal of security, it is acceptable.更多还原