SBIR Phase I: PrivateMR: A Security, Privacy and Governance Policy Enforcement Framework for Big Data

这个小企业创新研究（SBIR）第一阶段项目的更广泛的影响/商业潜力将是创造一种新的工具，可以防止存储在大数据管理系统中的敏感数据因各种网络攻击而丢失。此外，建议的工具可以允许组织审计大数据的使用情况，以防止滥用和误用存储的数据。这种新型工具的存在可能会增加人们对这些大数据管理系统的信任，并保护存储在这些系统中的敏感数据免受各种外部和内部攻击。该公司认为，随着越来越多的公司采用Hadoop和Spark等大数据管理技术，这样的工具将满足重要的客户需求，并有可能产生重大的商业影响。该公司计划采取免费增值的商业模式，并开放部分开发代码的源代码。这反过来又可以改进现有的免费开放源代码工具提供的数据保护功能，这些工具可以被许多不同的公司和组织使用。这个小企业创新研究（SBIR）第一阶段项目将证明一种新的大数据隐私、安全和治理管理工具的可行性。这个新工具将提供增强的安全和隐私保护功能，例如使用动态数据屏蔽执行隐私策略，使用基于角色的访问控制技术执行安全策略，使用数据加密执行治理策略，以及在一个工具中使用高级审计和问责制功能，而无需修改/更改底层大数据管理系统。为了成功开发所提议的原型，该公司将解决许多技术挑战，例如以很小的开销开发高效的隐私保护策略实施解决方案，以及设计一个支持简单治理和隐私策略规范任务的交互式用户界面。为了应对这些技术挑战，该公司建议利用面向方面编程的最新进展，以无缝的方式将代码直接注入提交的数据分析作业中，以实现透明的数据加密、数据清理、问责制、遵从性和治理策略的实施。使用这个注入的代码，可以对以加密格式存储的数据进行解密和清理，然后根据需要将其用于数据分析。此外，可以为问责制目的生成必要的日志。

The broader impact/commercial potential of this Small Business Innovation Research (SBIR) Phase I project will be the creation of a new tool that could prevent the loss of sensitive data stored in big data management systems due to various cyberattacks. Furthermore, the proposed tool can allow organizations to audit big data usage to prevent abuse and misuse of the stored data. The existence of such a novel tool may increase trust in these big data management systems, and protect the sensitive data stored in such systems against various outsider and insider attacks. The company believes that such a tool would address an important customer need and has the potential to have significant commercial impact as more and more companies are adopting big data management technologies such as Hadoop and Spark. The company plans to pursue a freemium business model and open source some of the developed code. This in turn may improve the data protection capabilities provided by existing freely available open source tools that can be used by many different companies and organizations.This Small Business Innovation Research (SBIR) Phase I project will prove the feasibility of a novel big data privacy, security and governance management tool. This new tool will provide enhanced security and privacy protection capabilities such as enforcing privacy policies using on-the-fly data masking, enforcing security policies using role-based access control techniques, and enforcing governance policies using data encryption, and advanced auditing and accountability features in one tool without the need to modify/change the underlying big data management system. To successfully develop the proposed prototype, the company will address many technical challenges such as developing efficient privacy-preserving policy enforcement solutions with very little overhead, and designing an interactive user interface that supports easy governance and privacy policy specification tasks. To address these technical challenges, the company proposes to leverage recent advances in aspect oriented programming to inject code directly into submitted data analysis jobs in a seamless manner to enable transparent data encryption, data sanitization, and accountability, compliance and governance policy enforcement. Using this injected code, the data that is stored in encrypted format could be decrypted and sanitized before it is used for data analysis as needed. Furthermore, necessary logs could be generated for accountability purposes.