Attribute-based Access Control Implementation Targeting Big Data Access Management Tools

这是一项在计算机安全的一般领域进行联合工作的建议，因为它需要扩展到大数据。一 该领域的挑战之一是访问管理--谁有权访问复杂数据中的哪些信息 系统？斯诺登事件和其他类似事件表明，对可扩展、用户友好的解决方案的普遍需求 这将使数据所有者能够设置访问策略，允许用户访问他们需要的数据，以及 只有那些数据。这是具有挑战性的：一方面，面向服务、虚拟化和企业云 架构正在创造前所未有的访问控制管理复杂性和风险。另一方面， 组织和法规要求规定了越来越细粒度的访问控制策略。 NoSQL数据库及相关的大数据技术和实现的出现正在进一步 推动了对显著改进的访问控制的需求。在NoSQL数据库市场中，Acumulo是 它独特地提供了它所描述的“细粒度的、基于单元的”访问控制。 在这个项目中，我们将研究并实现一个解决方案，该解决方案将能够定义单元级别的访问规则 使用事实上的标准XACML语言。该解决方案将Devera Logic定位为独一无二的合作伙伴 提供此功能的Acumulo。这项研究也将促进博士生工作的进步 就在这上面

This is a proposal for joint work in the general area of Computer Security as it needs to scale to Big Data. One of the challenges in that area is access management - who has access to what information in a complex data system? The Snowden incident and others like it indicate the general need for scalable, user-friendly solutions that would enable data owners to set up access policies that would allow users to access the data they need, and only that data. This is challenging: on the one hand, services-oriented, virtualized and enterprise cloud architectures are creating unprecedented access control management complexity and risk. On the other hand, organizational and regulatory requirements are dictating increasingly fine-grained access control policies. The emergence of "NoSQL" databases and related "big data" technologies and implementations are further driving the need for dramatically improved access control. Within the NoSQL database market, Accumulo is differentiated on the basis of uniquely providing what it describes as "fine grained, cell based" access control. We will, in this project, research and implement a solution that will enable defining cell-level access rules using the de facto standard XACML language. The solution will position Devera Logic as a unique partner to Accumulo providing this functionality. The research will also advance the progress of the PhD student working on it