SBIR Phase I: PrivateMR: A Security, Privacy and Governance Policy Enforcement Framework for Big Data

小型企业创新研究(SBIR)第一阶段项目的更广泛影响/商业潜力将是创建一种新工具，该工具可以防止存储在大数据管理系统中的敏感数据因各种网络攻击而丢失。此外，建议的工具可以让组织审核大数据的使用情况，以防止存储数据的滥用和误用。这种新型工具的存在可能会增加人们对这些大数据管理系统的信任，并保护存储在此类系统中的敏感数据免受各种外部和内部攻击。该公司认为，随着越来越多的公司采用Hadoop和Spark等大数据管理技术，这样的工具将满足一个重要的客户需求，并有可能产生重大商业影响。该公司计划推行免费增值的商业模式，并将部分开发的代码开源。这反过来可能会提高现有免费提供的开源工具提供的数据保护能力，这些工具可以被许多不同的公司和组织使用。这个小型企业创新研究(SBIR)第一阶段项目将证明一种新型大数据隐私、安全和治理管理工具的可行性。这一新工具将在一个工具中提供增强的安全和隐私保护功能，例如使用动态数据掩蔽实施隐私策略，使用基于角色的访问控制技术实施安全策略，使用数据加密实施治理策略，并在一个工具中提供高级审计和问责功能，而无需修改/更改底层大数据管理系统。为了成功开发提议的原型，该公司将解决许多技术挑战，例如以极少的开销开发高效的隐私保护政策执行解决方案，以及设计支持轻松治理和隐私政策规范任务的交互式用户界面。为了应对这些技术挑战，该公司提议利用面向方面编程的最新进展，以无缝方式将代码直接注入提交的数据分析作业，以实现透明的数据加密、数据清理以及问责、合规和治理政策执行。使用这个注入的代码，以加密格式存储的数据可以在根据需要用于数据分析之前被解密和消毒。此外，还可以为问责目的生成必要的日志。

The broader impact/commercial potential of this Small Business Innovation Research (SBIR) Phase I project will be the creation of a new tool that could prevent the loss of sensitive data stored in big data management systems due to various cyberattacks. Furthermore, the proposed tool can allow organizations to audit big data usage to prevent abuse and misuse of the stored data. The existence of such a novel tool may increase trust in these big data management systems, and protect the sensitive data stored in such systems against various outsider and insider attacks. The company believes that such a tool would address an important customer need and has the potential to have significant commercial impact as more and more companies are adopting big data management technologies such as Hadoop and Spark. The company plans to pursue a freemium business model and open source some of the developed code. This in turn may improve the data protection capabilities provided by existing freely available open source tools that can be used by many different companies and organizations.This Small Business Innovation Research (SBIR) Phase I project will prove the feasibility of a novel big data privacy, security and governance management tool. This new tool will provide enhanced security and privacy protection capabilities such as enforcing privacy policies using on-the-fly data masking, enforcing security policies using role-based access control techniques, and enforcing governance policies using data encryption, and advanced auditing and accountability features in one tool without the need to modify/change the underlying big data management system. To successfully develop the proposed prototype, the company will address many technical challenges such as developing efficient privacy-preserving policy enforcement solutions with very little overhead, and designing an interactive user interface that supports easy governance and privacy policy specification tasks. To address these technical challenges, the company proposes to leverage recent advances in aspect oriented programming to inject code directly into submitted data analysis jobs in a seamless manner to enable transparent data encryption, data sanitization, and accountability, compliance and governance policy enforcement. Using this injected code, the data that is stored in encrypted format could be decrypted and sanitized before it is used for data analysis as needed. Furthermore, necessary logs could be generated for accountability purposes.