TDACS：一种基于ABAC和信任的Hadoop动态访问控制方案
TDACS: an ABAC and Trust-based Dynamic Access Control Scheme in Hadoop
摘要：
大数据时代推动了许多行业的蓬勃发展，推动了整体数据驱动分析的充分潜力。Hadoop已经成为利益相关者处理大数据的主流平台的主要选择。此后，Hadoop平台的安全性在全球范围内引起了极大的关注。在本文中，我们主要集中在加强对用户的访问控制，以确保平台的安全性。首先，利用访问代理结合基于属性的访问控制（ABAC）模型实现前端授权，充分体现和应对Hadoop平台复杂访问控制过程的灵活性，并通过访问代理将后端资源从复杂的授权过程中释放出来。此外，为了保证授权的细粒度，访问代理维护由每个资源根据其重要性提供的信任阈值组成的列表。访问代理与区块链网络交互，获取用户的信任评估值，作为动态授权判定的重要依据。更具体地说，区块链网络以链上和链下模式共同工作。用户的历史行为数据存储在链下，相应的哈希值锚定在链上。因此，基于存储在区块链平台上的用户的历史行为来评估用户的信任值。同时，可以保证用户行为数据的真实性，从而保证信任评估结果的可靠性。实验结果表明，该模型能够动态灵活地调整用户权限，保证平台的安全性，同时时间和金钱的消耗在合理的范围内。
英文摘要：
The era of big data has promoted the vigorous development of many industries, boosting the full potential of holistic data-driven analysis. Hadoop has become the primary choice for mainstream platforms used by stakeholders to process big data. Thereafter, the security of Hadoop platform has arisen tremendous attention worldwide. In this paper, we mainly concentrate on enforcing access control on users to ensure platform security. First, we leverage access proxy integrated with attribute-based access control (ABAC) model to implement front-end authorization, which can fully reflect and cope with the flexible nature of the complex access control process in Hadoop platform, as well as can release back-end resources from complex authorization process through access proxy. Moreover, in order to ensure the fine-granularity of authorization, the access proxy maintains a list composed of trust threshold value provided by each resource according to its importance. The access proxy interacts with the blockchain network to obtain the user's trust evaluation value, which serves as an important basis for dynamic authorization determination. More specifically, blockchain network works together on-chain and off-chain modes. The user's historical behavior data is stored off-chain, and the corresponding hash value is anchored on-chain. Consequently, the user's trust value is evaluated based on his historical behavior stored on the blockchain platform. Meanwhile, the authenticity of user behavior data can be guaranteed, thereby ensuring the reliability of trust assessment results. Our experiment demonstrates that the proposed model can dynamically and flexibly adjust user permissions to ensure the security of the platform, while time and money are consumed within a reasonable range.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
