WO2016127664A1 - 一种访问控制方法和系统 - Google Patents

一种访问控制方法和系统 Download PDF

Info

Publication number
WO2016127664A1
WO2016127664A1 PCT/CN2015/093208 CN2015093208W WO2016127664A1 WO 2016127664 A1 WO2016127664 A1 WO 2016127664A1 CN 2015093208 W CN2015093208 W CN 2015093208W WO 2016127664 A1 WO2016127664 A1 WO 2016127664A1
Authority
WO
WIPO (PCT)
Prior art keywords
node
service
trust value
user
trust
Prior art date
Application number
PCT/CN2015/093208
Other languages
English (en)
French (fr)
Inventor
罗圣美
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2016127664A1 publication Critical patent/WO2016127664A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols

Definitions

  • This application relates to, but is not limited to, the field of computer cluster technology.
  • Hadoop is a distributed open source framework that can be used not only to store large amounts of data, but also to support Google's Mapreduce distributed computing framework, which is currently used in cloud computing platforms.
  • SSL Secure Sockets Layer
  • Kerberos Kerberos-based Kerberos for Hadoop cluster access control to protect HDFS (Hadoop Distributed File System, Hadoop Distributed File System) and Mapreduce.
  • Kerberos is a network authentication protocol whose goal is to provide reliable and secure authentication services for C/S (client/server) applications through a symmetric key system. This protocol requires mutual authentication, that is, the client and server must authenticate each other before the client allows the use of server-side resources.
  • the purpose of Kerberos authentication is to allow applications on non-encrypted networks to authenticate their identity to each other in an encrypted manner while communicating.
  • the characteristics of Hadoop security protection mechanism using Kerberos are as follows: (1) Kerberos can reliably authenticate users and nodes; (2) After Kerberos authentication, the client obtains the token issued by the name node (NameNode) in the specified time domain. The user does not need to pass the KDC (Key Distribution Center) authentication again, which relieves the burden on the KDC; (3) The illegal user cannot bypass the Kerberos authentication when there is no node access token.
  • KDC Key Distribution Center
  • Kerberos also has limitations. For example, after the access token is maliciously stolen, the confidentiality and integrity of the data will still be at risk.
  • This document provides an access control method and system that can improve the security of Hadoop cluster systems. Sex.
  • An access control method comprising:
  • the method further includes the following features:
  • the method further includes:
  • the user When it is judged that the user is not trusted according to the trust degree information of the queried user, the user is denied to issue a token for accessing the service node.
  • the method further includes the following features:
  • the method further includes:
  • the behavior data of the node is collected, and the trust value of the node is calculated according to the trust value calculation model and the collected behavior data.
  • the method further includes the following features:
  • Collect the behavior data of the node calculate the trust value of the node according to the trust value calculation model and the collected behavior data, including:
  • the local trust value evaluated by all the peer nodes in the current statistical period for the node is weighted and averaged, and the obtained weighted average value is used as the global trust value of the node in the current statistical period;
  • the weighting coefficient corresponding to the local trust value is a normalized global trust value of the peer node in the last statistical period;
  • the global trust value of each node in the current statistical period is normalized, including: for any node, the node is in the current statistical period
  • the global trust value is divided by the sum of the global trust values of all nodes in the current statistical period, and the obtained quotient is used as the normalized global trust value of the node in the current statistical period.
  • the method further includes the following features:
  • the method further includes:
  • the security level of the node is also determined according to the trust value of the node;
  • the security level is: dangerous level, general security level or high security level.
  • the method further includes the following features:
  • the service node that provides the service for the user by combining the trusted information of the candidate service node that is queried includes:
  • the candidate service nodes capable of providing the service are sorted according to the trust value and the resource occupancy of the node, and the service node providing the service for the user is selected according to the sorting result.
  • the method further includes the following features:
  • the method further includes:
  • the service node is restricted from providing service when it is determined that the security level of one or more service nodes is a dangerous level.
  • An access control system comprising:
  • the node monitoring module is configured to: monitor the communication between the nodes, and report the trust relationship data between the nodes to the trust value calculation module;
  • a trust value calculation module configured to: calculate a trust value of the node
  • the scheduling and control module is configured to: after receiving the request for the user to apply for the service, query the trust degree information of the user, and when determining that the user is trusted according to the trusted information of the queried user, querying from the trust value calculation module The trust degree information of the candidate service node that provides the service to the user, and the service node that provides the service for the user in combination with the trust degree information of the candidate service node that is queried.
  • system further includes the following features:
  • the scheduling and control module is further configured to: when the user is not trusted according to the trusted information of the query, refuse to issue a token for accessing the service node for the user.
  • system further includes the following features:
  • the trust value calculation module is configured to: after collecting the behavior data of the node, calculate the trust value of the node according to the trust value calculation model and the collected behavior data.
  • system further includes the following features:
  • the trust value calculation module is set to:
  • weighting the local trust values evaluated by the peer nodes for the nodes in the current statistical period for each node After collecting the local trust value information that is evaluated between the nodes in the current statistical period, weighting the local trust values evaluated by the peer nodes for the nodes in the current statistical period for each node, and obtaining the weighted average value The global trust value of the node in the current statistical period; wherein the weighting coefficient corresponding to each local trust value is a normalized global trust value of the peer node in the last statistical period;
  • the global trust value of each node in the current statistical period is normalized, including: for any node, the node is in the current statistical period
  • the global trust value is divided by the sum of the global trust values of all nodes in the current statistical period, and the obtained quotient is used as the normalized global trust value of the node in the current statistical period.
  • system further includes the following features:
  • the system also includes:
  • the security level division module is configured to: determine the security level of the node according to the trust value of the node;
  • the security level is: dangerous level, general security level or high security level.
  • system further includes the following features:
  • the scheduling and control module is set to:
  • the candidate service nodes capable of providing the service are sorted according to the trust value and the resource occupancy of the node, and the service node providing the service for the user is selected according to the sorting result.
  • system further includes the following features:
  • the scheduling and control module is further configured to: when determining that the security level of the one or more service nodes is a dangerous level, restricting the service node from providing the service.
  • a computer readable storage medium storing computer executable instructions for performing the method of any of the above.
  • an access control method and system provided by the embodiment of the present invention can optimize the service node's scheduling by using the trust value calculated by the trust model, and use the trust value calculation to control the block through the user's trust degree information.
  • the token is issued to facilitate the fine-grained access control of the user by the NameNode, and the operation performed after the user obtains the token also affects the trust value of the user.
  • the embodiment of the present invention can improve the security of the Hadoop cluster system.
  • FIG. 1 is a flowchart of an access control method according to an embodiment of the present invention.
  • FIG. 2 is a schematic structural diagram of an access control system according to an embodiment of the present invention.
  • FIG. 3 is a schematic diagram of a trust value between nodes in an application example of the present invention.
  • FIG. 4 is a schematic diagram of deploying the access control system of the present invention on a NameNode node in an application example of the present invention.
  • FIG. 5 is a schematic diagram of issuing a token to a user according to a trust value in a Kerberos authentication environment according to an application example of the present invention.
  • an embodiment of the present invention provides an access control method, where the method includes:
  • the method may also include the following features:
  • the trust degree information of the user is queried.
  • the user is denied to issue a block token for accessing the service node.
  • the judging whether the user is trusted according to the trusted information that is queried includes:
  • the user is determined to be trusted. If the level of trust of the user is equal to or lower than the threshold, the user is determined to be untrustworthy.
  • the method further includes: collecting behavior data of the node, and calculating a trust value of the node according to the trust value calculation model and the collected behavior data, including:
  • the local trust value evaluated by all the peer nodes in the current statistical period for the node is weighted and averaged, and the obtained weighted average value is used as the global trust value of the node in the current statistical period;
  • the weighting coefficient corresponding to the local trust value is a normalized global trust value of the peer node in the last statistical period;
  • the global trust value of each node in the current statistical period is normalized, including: for any node, the node is in the current statistical period
  • the global trust value is divided by the sum of the global trust values of all nodes in the current statistical period, and the obtained quotient is used as the normalized global trust value of the node in the current statistical period.
  • any node i it is assumed that in the current statistical period t+1, a total of N nodes participate in the trust value calculation, and the local trust value of any node j to the node i is m ij , and the node j is in the previous one.
  • the normalized global trust value in the statistical period t is r j (t)
  • the global trust value v i (t+1) of the node i in the current statistical period t+1 is:
  • the node includes a service node and a node where the user is located;
  • the method further includes:
  • the security level of the node is also determined according to the trust value of the node;
  • the security level is: dangerous level, general security level or high security level.
  • the method further includes:
  • the service node is restricted from providing service when it is determined that the security level of one or more service nodes is a dangerous level.
  • the service node that provides the service for the user by combining the trusted information of the candidate service node that is queried includes:
  • the candidate service nodes capable of providing the service are sorted according to the trust value and the resource occupancy of the node, and the service node providing the service for the user is selected according to the sorting result.
  • a service node with a high trust value and sufficient remaining resources is preferentially selected to provide services for the user;
  • the user after determining the service node that provides the service to the user, the user sends a block token for accessing the service node providing the service.
  • an embodiment of the present invention provides an access control system, including:
  • the node monitoring module 21 is configured to: monitor the communication between the nodes, and report the trust relationship data between the nodes to the trust value calculation module 22;
  • the trust value calculation module 22 is configured to: calculate a trust value of the node
  • the scheduling and control module 23 is configured to: after receiving the request for the user to apply for the service, query the trust degree information of the user, and when determining that the user is trusted according to the trusted information of the queried user, the trust value calculation module 22 Querying the trust degree information of the candidate service node that can provide the service for the user, and providing the service for the user selection according to the trust degree information of the queried candidate service node Service node.
  • the system may also include the following features:
  • the scheduling and control module 23 is further configured to: when determining that the user is not trusted according to the trusted information of the query, refuse to issue a block token for accessing the service node for the user.
  • the trust value calculation module 22 is configured to: after collecting the behavior data of the node, calculate the trust value of the node according to the trust value calculation model and the collected behavior data.
  • the trust value calculation module 22 is configured to:
  • weighting the local trust values evaluated by the peer nodes for the nodes in the current statistical period for each node After collecting the local trust value information that is evaluated between the nodes in the current statistical period, weighting the local trust values evaluated by the peer nodes for the nodes in the current statistical period for each node, and obtaining the weighted average value The global trust value of the node in the current statistical period; wherein the weighting coefficient corresponding to each local trust value is a normalized global trust value of the peer node in the last statistical period;
  • the global trust value of each node in the current statistical period is normalized, including: for any node, the node is in the current statistical period
  • the global trust value is divided by the sum of the global trust values of all nodes in the current statistical period, and the obtained quotient is used as the normalized global trust value of the node in the current statistical period.
  • system may further comprise:
  • the security level division module is configured to: determine the security level of the node according to the trust value of the node;
  • the security level is: dangerous level, general security level or high security level.
  • the scheduling and control module 23 is configured to:
  • the candidate service nodes capable of providing the service are sorted according to the trust value and the resource occupancy of the node, and the service node providing the service for the user is selected according to the sorting result.
  • the scheduling and control module 23 is further configured to restrict the service node from providing a service when determining that the security level of one or more service nodes is a dangerous level.
  • the trust value is calculated by assigning the initial value, and the update calculation is performed according to the update strategy in the expert database.
  • the directed graph shown in FIG. 3 is used to represent the trust value of each node.
  • the value on each directed edge in the directed graph is the trust value of the local node assessed by the peer node.
  • the trust value is a decimal between (0, 1), and 0 means no trust (or no interaction). 1 means 100% trust, the value in the node is the normalized global trust value of the node in the last statistical period t.
  • the global trust value of a node is obtained by weighted averaging the trust values evaluated by the peer node for the node, wherein the trust value assessed by each peer node is used by the peer node in the last statistical period t
  • the normalized global trust value is weighted. That is, when calculating the global trust value of a node, the trust model considers the opinions of all nodes interacting with the node. A node will feedback the nodes it interacted with after an operation is completed for use in future interactions.
  • the global trust values of the N1, N2, N3, N4, and N5 nodes in the current statistical period t are as follows. under:
  • the normalized global trust value for each node can be obtained by dividing the global trust value of each node by the sum of the global trust values of all nodes:
  • a trust value calculation module As shown in FIG. 4, a trust value calculation module, a level division module, a control module, and a node scheduling module are deployed on the NameNode node of Hadoop.
  • Node monitoring module monitors the communication between nodes, establishes the trust value between nodes by reading and writing the frequency of data blocks, and the success rate of reading and writing data blocks.
  • the main parameters include: storage space occupancy rate, successful service submission ratio, Network occupancy.
  • Trust value calculation module Calculate the trust value of the node according to the trust model.
  • Level division module According to the security policy of the system, different levels are divided to optimize the scheduling of nodes.
  • Control module Analyze the security requirements of the service and control the service according to the security level of the node.
  • control module can suspend the current service of the node with a low level and send a warning packet to the system administrator.
  • Scheduling module a set of optional nodes for generating services, using trust values, security levels, real-time network access
  • the capability of the letter is calculated by weighting the ordered list of the node set, selecting the node with the strongest and most reliable service capability to provide the service, and selecting the next node for service when the node has an abnormality such as suspension.
  • This module is used to control the node scheduling of the NameNode. That is, the priority list is calculated based on the set of serviceable nodes, and the optimal service nodes are sequentially selected.
  • Step 1 Start the node monitoring module to keep it active.
  • Step 2 Record the interaction record between the nodes in the time domain t, the number of tasks submitted by the node, the task description completed by the node, the task description of the node failure, and the network bandwidth occupancy of the node.
  • Step 3 The node monitoring module submits the data record set in the time domain t to the trust value calculation module.
  • Step 4 The trust value calculation module adopts a trust model, constructs a trust matrix of the node, and calculates a trust value of each node.
  • Step 5 The trust value calculation module passes the node trust value list to the level division module.
  • Step 6 The level dividing module divides the security level of the node according to the system partitioning rule and the trust value of the node, for example, the dangerous level, the general security level, and the high security level.
  • Step 7 The level division module marks the trust level of the node into the trust value data packet and passes it to the control module.
  • Step 8 After receiving the trust value packet, the control module checks the level. When the dangerous node is found, the control module sends a request to the scheduling module, and the scheduling module suspends the service of the dangerous node after receiving the request.
  • Step 9 The user requests a service from the master node (NameNode), and the master node forwards the data packet of the service request to the control module for parsing, and the control module parses out the service node and the optional node of the service.
  • the master node NameNode
  • the control module parses out the service node and the optional node of the service.
  • Step 10 Capture the current node load, the network state quantized value, perform weighted calculation with the trust value, generate a priority list of the serviceable node, and eliminate the dangerous level node.
  • Step 11 Send the optimal node and the sub-optimal node to the scheduling module, and the scheduling module establishes a connection between the user and the service, and the service is enabled.
  • the above method uses the trust value calculated by the trust model to optimize the scheduling of the node, and also refers to the performance of the service node and other factors. For example, a number with a high security level and a large amount of storage space remaining The data node will be called preferentially when the client initiates a store file service request, and the backup of the file will be stored on the next optimal node.
  • the client client performs the authentication service to the KDC.
  • the client obtains the ticket TGT (Ticket Granting Ticket)
  • the client holds the TGT application service
  • the NameNode reads the user trust from the trust value database.
  • Value when the trust value is lower than the threshold, the service is denied, and instead a block token is sent to the user, the user can hold the block token to access the corresponding node data, and the client behavior tracking module continues to track the behavior of the user, according to the behavior record and
  • the trust value calculation module modifies the user trust value table.
  • Steps 1 to 4 As shown in Figure 1-4, the client obtains the ticket TGT through Kerberos authentication.
  • Step 5 The client accesses the NameNode node by using the TGT.
  • Step 6 The NameNode parses the data block of the service request and enters the trust value database to read the user trust value.
  • the user trust value is greater than the threshold and is a non-hazardous user
  • the block token with the time node is issued, which is less than the threshold or is dangerous.
  • the block token is not issued at the level.
  • Step 7 The Client Behavior Tracking module tracks the user holding the block token acquisition service, records the relevant behavior data, and collects evidence for the calculation of the trust value in the next time domain t.
  • the above method uses the trust value calculation and the method of establishing the trust value database, and the threshold control block token is issued, which helps the NameNode node to perform fine-grained access control on the client, and the operation performed by the client after acquiring the token also affects Its own trust value.
  • the access control method and system provided by the foregoing embodiment can optimize the scheduling of the service node by using the trust value calculated by the trust model, and use the trust value calculation to facilitate the issuance of the token by the threshold control block token.
  • the fine-grained access control of the user, and the operation performed after the user obtains the token also affects the trust value of the user.
  • the embodiment of the present invention can improve the security of the Hadoop cluster system.
  • the computer program can be implemented in a computer readable storage medium, the computer program being executed on a corresponding hardware platform (such as a system, device, device, device, etc.), when executed, including One or a combination of the steps of the method embodiments.
  • all or part of the steps of the above embodiments may also be implemented by using an integrated circuit. These steps may be separately fabricated into individual integrated circuit modules, or multiple modules or steps may be fabricated into a single integrated circuit module. achieve.
  • the devices/function modules/functional units in the above embodiments may be implemented by a general-purpose computing device, which may be centralized on a single computing device or distributed over a network of multiple computing devices.
  • the device/function module/functional unit in the above embodiment When the device/function module/functional unit in the above embodiment is implemented in the form of a software function module and sold or used as a stand-alone product, it can be stored in a computer readable storage medium.
  • the above mentioned computer readable storage medium may be a read only memory, a magnetic disk or an optical disk or the like.
  • the trust value of the service node calculated by the trust model can optimize the scheduling of the service node, and the trust value calculation is used to control the issuance of the block token through the trust information of the user, which helps the NameNode node to fine-grain the user. Access control.
  • the embodiments of the present invention can improve the security of the Hadoop cluster system.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Storage Device Security (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本文公布一种访问控制方法和系统，该方法包括：在接收到用户申请服务的请求后，查询该用户的信任度信息；在根据查询到的用户的信任度信息判断该用户可信时，查询能够为该用户提供服务的候选服务节点的信任度信息，结合查询到的候选服务节点的信任度信息为所述用户选择提供服务的服务节点。

Description

一种访问控制方法和系统 技术领域
本申请涉及但不限于计算机集群技术领域。
背景技术
Hadoop是一个分布式开源的框架，不仅可以用来存储海量数据，还支持Google公司的Mapreduce分布式计算框架，目前已被应用在云计算平台中。为提高Hadoop集群安全，使用基于SSL(Secure Sockets Layer，安全套接层)的Kerberos进行Hadoop集群的访问控制来保护HDFS(Hadoop Distributed File System，Hadoop分布式文件系统)和Mapreduce。
Kerberos是一种网络认证协议，其目标是通过对称密钥体制为C/S(客户端/服务器)应用程序提供可靠安全的认证服务。这一协议要求共同认证，也就是说，在客户端允许使用服务器端资源之前，客户端和服务器端必须相互认证对方身份。Kerberos认证的目的在于让非加密网络的应用程序在通信时，通过加密的方式向对方认证它们的身份。采用Kerberos的Hadoop安全防护机制的特点在于：(1)Kerberos能够可靠地进行用户和节点的认证；(2)通过Kerberos认证后客户端会获得名称节点(NameNode)发放的令牌，在指定时间域内用户不需要再次经过KDC(Key Distribution Center，密钥分发中心)认证，为KDC减轻了负担；(3)非法用户在没有节点访问令牌时无法绕过Kerberos认证。
但是，Kerberos也存在局限性，比如，在访问令牌被恶意窃取后，数据的保密性与完整性仍然会遭遇风险。
发明内容
以下是对本文详细描述的主题的概述。本概述并非是为了限制权利要求的保护范围。
本文提供一种访问控制方法和系统，能够提高Hadoop集群系统的安全 性。
一种访问控制方法，该方法包括：
在接收到用户申请服务的请求后，查询该用户的信任度信息；
在根据查询到的用户的信任度信息判断该用户可信时，查询能够为该用户提供服务的候选服务节点的信任度信息，结合查询到的候选服务节点的信任度信息为所述用户选择提供服务的服务节点。
可选地，该方法还包括下述特点：
所述方法还包括：
在根据查询到的用户的信任度信息判断该用户不可信时，拒绝为所述用户发放访问服务节点的令牌。
可选地，该方法还包括下述特点：
所述方法还包括：
收集节点的行为数据，根据信任值计算模型和收集到的行为数据计算节点的信任值。
可选地，该方法还包括下述特点：
收集节点的行为数据，根据信任值计算模型和收集到的行为数据计算节点的信任值，包括：
收集当前统计周期内的节点之间评定的本地信任值信息；
对每一个节点，将当前统计周期内所有对端节点为所述节点评定的本地信任值进行加权平均，获得的加权平均值作为所述节点在当前统计周期内的全局信任值；其中，每一个本地信任值所对应的加权系数为所述对端节点在上一个统计周期内的归一化全局信任值；
在获得所有目标节点在当前统计周期内的全局信任值后，对每一个节点在当前统计周期内的全局信任值进行归一化处理，包括：对任意一个节点，将所述节点在当前统计周期内的全局信任值除以所有节点在当前统计周期内的全局信任值的和，得到的商作为所述节点在当前统计周期内的归一化全局信任值。
可选地，该方法还包括下述特点：
所述方法还包括：
在确定节点的信任值后，还根据节点的信任值确定节点的安全等级；
其中，所述安全等级为：危险级、一般安全级或高安全级。
可选地，该方法还包括下述特点：
结合查询到的候选服务节点的信任度信息为所述用户选择提供服务的服务节点，包括：
根据节点的信任值和资源占用情况对能够提供服务的候选服务节点进行排序，根据排序结果挑选为所述用户提供服务的服务节点。
可选地，该方法还包括下述特点：
所述方法还包括：
在确定一个或多个服务节点的安全等级为危险级时，限制所述服务节点提供服务。
一种访问控制系统，包括：
节点监测模块，设置为：监测节点之间的通信，将节点之间的信任关系数据上报给信任值计算模块；
信任值计算模块，设置为：计算节点的信任值；
调度及控制模块，设置为：在接收到用户申请服务的请求后，查询该用户的信任度信息，在根据查询到的用户的信任度信息判断该用户可信时，从信任值计算模块查询能够为所述用户提供服务的候选服务节点的信任度信息，结合查询到的候选服务节点的信任度信息为所述用户选择提供服务的服务节点。
可选地，该系统还包括下述特点：
调度及控制模块，还设置为：在根据查询到的信任度信息判断该用户不可信时，拒绝为所述用户发放访问服务节点的令牌。
可选地，该系统还包括下述特点：
信任值计算模块，是设置为：收集到节点的行为数据后，根据信任值计算模型和收集到的行为数据计算节点的信任值。
可选地，该系统还包括下述特点：
信任值计算模块，是设置为：
收集到当前统计周期内的节点之间评定的本地信任值信息后，对每一个节点，将当前统计周期内所有对端节点为所述节点评定的本地信任值进行加权平均，获得的加权平均值作为所述节点在当前统计周期内的全局信任值；其中，每一个本地信任值所对应的加权系数为所述对端节点在上一个统计周期内的归一化全局信任值；
在获得所有目标节点在当前统计周期内的全局信任值后，对每一个节点在当前统计周期内的全局信任值进行归一化处理，包括：对任意一个节点，将所述节点在当前统计周期内的全局信任值除以所有节点在当前统计周期内的全局信任值的和，得到的商作为所述节点在当前统计周期内的归一化全局信任值。
可选地，该系统还包括下述特点：
所述系统还包括：
安全等级划分模块，设置为：根据节点的信任值确定节点的安全等级；
其中，所述安全等级为：危险级、一般安全级或高安全级。
可选地，该系统还包括下述特点：
调度及控制模块，是设置为：
根据节点的信任值和资源占用情况对能够提供服务的候选服务节点进行排序，根据排序结果挑选为所述用户提供服务的服务节点。
可选地，该系统还包括下述特点：
调度及控制模块，还设置为：在确定一个或多个服务节点的安全等级为危险级时，限制所述服务节点提供服务。
一种计算机可读存储介质，存储有计算机可执行指令，所述计算机可执行指令用于执行上述任一项的方法。
与相关技术相比，本发明实施例提供的一种访问控制方法和系统，通过信任模型计算出的服务节点信任值可以优化服务节点的调度，采用信任值计算，通过用户的信任度信息控制块令牌的发放，有助于NameNode节点对用户的细粒度的访问控制，并且用户获取到令牌后进行的操作也影响着自身的信任值，本发明实施例能够提高Hadoop集群系统的安全性。
在阅读并理解了附图和详细描述后，可以明白其他方面。
附图概述
图1为本发明实施例的一种访问控制方法的流程图。
图2为本发明实施例的一种访问控制系统的结构示意图。
图3为本发明应用示例中节点间的信任值有向图示意。
图4为本发明应用示例中在NameNode节点上部署本发明的访问控制系统的示意图。
图5为本发明应用示例中在Kerberos认证环境下根据信任值向用户发放令牌的示意图。
本发明的实施方式
下文中将结合附图对本发明的实施方式进行详细说明。需要说明的是，在不冲突的情况下，本申请中的实施例及实施例中的特征可以相互任意组合。
如图1所示，本发明实施例提供了一种访问控制方法，该方法包括：
S10，在接收到用户申请服务的请求后，查询该用户的信任度信息；
S20，在根据查询到的用户的信任度信息判断该用户可信时，查询能够为该用户提供服务的候选服务节点的信任度信息，结合查询到的候选服务节点的信任度信息为所述用户选择提供服务的服务节点。
所述方法还可以包括下述特点：
其中，在接收到用户申请服务的请求后，查询该用户的信任度信息，包括：
在接收到通过了密钥分发中心KDC认证的用户申请服务的请求后，查询该用户的信任度信息。
其中，在根据查询到的信任度信息判断该用户不可信时，拒绝为所述用户发放访问服务节点的块令牌。
其中，根据查询到的信任度信息判断该用户是否可信，包括：
如查询到所述用户的信任度等级高于阈值，则判断该用户可信，如查询到所述用户的信任度等级等于或低于阈值，则判断该用户不可信；
其中，所述方法还包括：收集节点的行为数据，根据信任值计算模型和收集到的行为数据计算节点的信任值，包括：
收集当前统计周期内的节点之间评定的本地信任值信息；
对每一个节点，将当前统计周期内所有对端节点为所述节点评定的本地信任值进行加权平均，获得的加权平均值作为所述节点在当前统计周期内的全局信任值；其中，每一个本地信任值所对应的加权系数为所述对端节点在上一个统计周期内的归一化全局信任值；
在获得所有目标节点在当前统计周期内的全局信任值后，对每一个节点在当前统计周期内的全局信任值进行归一化处理，包括：对任意一个节点，将所述节点在当前统计周期内的全局信任值除以所有节点在当前统计周期内的全局信任值的和，得到的商作为所述节点在当前统计周期内的归一化全局信任值。
也即，对任意一个节点i，假设在当前统计周期t+1内，一共有N个节点参与信任值计算，任意一个节点j对节点i评定的本地信任值为mij，节点j在上一个统计周期t内的归一化全局信任值为rj(t)，则节点i在当前统计周期t+1内的全局信任值vi(t+1)为：
Figure PCTCN2015093208-appb-000001
将节点i在当前统计周期t+1内的全局信任值vi(t+1)进行归一化处理，则 节点i在当前统计周期t+1内的归一化全局信任值ri(t+1)为：
Figure PCTCN2015093208-appb-000002
其中，所述节点包括服务节点和用户所在的节点；
其中，所述方法还包括：
在确定节点的信任值后，还根据节点的信任值确定节点的安全等级；
其中，所述安全等级为：危险级、一般安全级或高安全级。
其中，所述方法还包括：
在确定一个或多个服务节点的安全等级为危险级时，限制所述服务节点提供服务。
其中，结合查询到的候选服务节点的信任度信息为所述用户选择提供服务的服务节点，包括：
根据节点的信任值和资源占用情况对能够提供服务的候选服务节点进行排序，根据排序结果挑选为所述用户提供服务的服务节点。
比如，优先选择信任值高的和剩余资源充足的服务节点为用户提供服务；
其中，在确定为用户提供服务的服务节点后，向所述用户发送用于访问所述提供服务的服务节点的块令牌。
如图2所示，本发明实施例提供了一种访问控制系统，包括：
节点监测模块21，设置为：监测节点之间的通信，将节点之间的信任关系数据上报给信任值计算模块22；
信任值计算模块22，设置为：计算节点的信任值；
调度及控制模块23，设置为：在接收到用户申请服务的请求后，查询该用户的信任度信息，在根据查询到的用户的信任度信息判断该用户可信时，从信任值计算模块22查询能够为所述用户提供服务的候选服务节点的信任度信息，结合查询到的候选服务节点的信任度信息为所述用户选择提供服务 的服务节点。
所述系统还可以包括下述特点：
其中，调度及控制模块23，还设置为：在根据查询到的信任度信息判断该用户不可信时，拒绝为所述用户发放访问服务节点的块令牌。
其中，信任值计算模块22，是设置为：收集到节点的行为数据后，根据信任值计算模型和收集到的行为数据计算节点的信任值。
其中，信任值计算模块22，是设置为：
收集到当前统计周期内的节点之间评定的本地信任值信息后，对每一个节点，将当前统计周期内所有对端节点为所述节点评定的本地信任值进行加权平均，获得的加权平均值作为所述节点在当前统计周期内的全局信任值；其中，每一个本地信任值所对应的加权系数为所述对端节点在上一个统计周期内的归一化全局信任值；
在获得所有目标节点在当前统计周期内的全局信任值后，对每一个节点在当前统计周期内的全局信任值进行归一化处理，包括：对任意一个节点，将所述节点在当前统计周期内的全局信任值除以所有节点在当前统计周期内的全局信任值的和，得到的商作为所述节点在当前统计周期内的归一化全局信任值。
其中，所述系统还可包括：
安全等级划分模块，设置为：根据节点的信任值确定节点的安全等级；
其中，所述安全等级为：危险级、一般安全级或高安全级。
其中，调度及控制模块23，是设置为：
根据节点的信任值和资源占用情况对能够提供服务的候选服务节点进行排序，根据排序结果挑选为所述用户提供服务的服务节点。
其中，调度及控制模块23，还设置为：在确定一个或多个服务节点的安全等级为危险级时，限制所述服务节点提供服务。
应用示例
基于用户的行为分析，判断行为的友好性，需要引入用户信任值的概念，信任值采用赋初值的方式计算，根据专家库里的更新策略进行更新计算。
为了完成信任值的计算，需要对用户和服务节点的行为进行细致的跟踪记录。通过服务节点进行用户行为的跟踪，记录行为开始与结束时的可信证据，返回给NameNode，生成每个用户的行为数据集合，根据行为数据集合，通过建立全局的信任模型，计算出用户与服务节点的信任值。
举例如下：
如图3所示，假设Hadoop系统中有5个节点，分别是：N1、N2、N3、N4、N5，图3所示的有向图是用来表示每个节点的信任值的。有向图中每一条有向边上的数值是对端节点评定的本端节点的信任值，信任值是(0,1)之间的一个小数，0表示没有任何信任(或者没有交互)，1表示百分之百信任，节点内的数值是上一个统计周期t内该节点的归一化全局信任值。
一个节点的全局信任值是根据所有对端节点对该节点评定的信任值进行加权平均后得到的，其中，每一个对端节点评定的信任值用该对端节点在上一个统计周期内t内的归一化全局信任值来加权。也即，计算一个节点的全局信任值时，信任模型考虑所有与该节点交互过的节点对它的意见。一个节点在一个操作完成之后将对与它交互过的节点进行反馈，以便在以后的交互中使用。
假设在上一统计周期t内，N1、N2、N3、N4、N5的归一化的全局信任值依次是：
r1(t)＝0.32；
r2(t)＝0.001；
r3(t)＝0.009；
r4(t)＝0.04；
r5(t)＝0.63；
N1、N2、N3、N4、N5节点在当前统计周期t内的全局信任值分别如 下：
V1(t+1)＝0.001*0.6+*0.009*0.5＝0.0051；
V2(t+1)＝0.32*0.3+0.009*0.2＝0.0978；
V3(t+1)＝0.32*0.3+0.001*0.4+0.63*0.8＝0.6004；
V4(t+1)＝0.32*0.3+0.009*0.3+0.63*0.2＝0.2247；
V5(t+1)＝0.32*0.1＝0.032；
通过把每一个节点的全局信任值除以所有节点的全局信任值之和，可以得到每一个节点的归一化全局信任值：
r1(t+1)＝0.0051/(0.0051+0.0978+0.6004+0.2247+0.032)＝0.005313；
r2(t+1)＝0.0978/(0.0051+0.0978+0.6004+0.2247+0.032)＝0.101875；
r3(t+1)＝0.6004/(0.0051+0.0978+0.6004+0.2247+0.032)＝0.625417；
r4(t+1)＝0.2247/(0.0051+0.0978+0.6004+0.2247+0.032)＝0.234063；
r5(t+1)＝0.032/(0.0051+0.0978+0.6004+0.2247+0.032)＝0.033333；
如图4所示，在Hadoop的NameNode节点部署信任值计算模块、等级划分模块、控制模块和节点调度模块。
节点监测模块：监测节点之间的通信，通过读写数据块的频率、读写数据块的成功率，建立节点之间的信任值，主要参数包括：存储空间占用率、成功的服务提交比率、网络占用率。
信任值计算模块：根据信任模型，计算节点的信任值。
等级划分模块：根据系统的安全策略，划分不同的等级，以优化节点的调度。
控制模块：对服务的安全要求进行解析，根据节点的安全等级进行服务的控制。
比如，控制模块可以中止等级过低的节点当前的服务，发送警示数据包给系统管理员。
调度模块：生成服务的可选节点集合，用信任值、安全级、实时网络通 信能力，加权计算出节点集合的排序列表，选择服务能力最强最可靠的节点提供服务，在该节点出现挂起等异常时选择下一节点进行服务，本模块用来控制NameNode的节点调度。也即，基于可服务节点集计算优先次序表，依次选择最优的服务节点。
实施步骤：
步骤1：启动节点监测模块，使其保持活跃状态。
步骤2：记录时间域t内节点之间的交互记录、节点提交的任务数、节点完成的任务描述、节点失败的任务描述、节点的网络带宽占用率。
步骤3：节点监测模块将时间域t内的数据记录集提交给信任值计算模块。
步骤4：信任值计算模块采用信任模型，构建节点的信任矩阵，计算出每个节点的信任值。
步骤5：信任值计算模块将节点信任值列表传递给等级划分模块。
步骤6：等级划分模块根据系统划分规则与节点的信任值划分出节点的安全等级，比如，划分危险级、一般安全级和高安全级。
步骤7：等级划分模块将节点的信任等级标记到信任值数据包中，传递给控制模块。
步骤8：控制模块收到信任值包后，查看等级，发现有危险级节点时，发送请求给调度模块，调度模块收到请求后中止危险级节点的服务。
步骤9：用户向主节点(NameNode)申请服务，主节点将服务请求的数据包交给控制模块解析，控制模块解析出服务类型与服务的可选节点。
步骤10：捕获当前节点负载、网络状态量化值，与信任值进行加权计算，生成可服务节点的优先次序表，剔除危险级节点。
步骤11：发送最优节点与次优节点给调度模块，调度模块建立用户与服务的连接，服务启用。
上述方法采用信任模型计算出的节点信任值可以优化节点的调度，同时也参考服务节点的性能等因素。例如一个安全等级高且存储空间剩余多的数 据节点(DataNode)将在客户端发起存储文件服务请求时被优先调用，文件的备份将会被存储在下一个最优节点上。
如图5所示，客户端Client向KDC进行认证服务，Client获得了访问NameNode的票据TGT(Ticket Granting Ticket，票据授权票据)后，Client持TGT申请服务，NameNode从信任值库中读取用户信任值，当信任值低于阈值时，拒绝服务，反之发送一个块令牌给用户，用户便可持块令牌访问相应的节点数据，Client行为跟踪模块继续跟踪该用户的行为，根据行为记录和信任值计算模块修正用户信任值表。
步骤1～4：如图5中的1-4环节，Client通过Kerberos认证获取到票据TGT；
步骤5：Client持TGT访问NameNode节点；
步骤6：NameNode解析服务请求的数据块并进入信任值数据库中读取用户信任值；判断用户信任值，大于阈值且为非危险级用户时发放带时间节点的块令牌，小于阈值或者属于危险级时不发放块令牌。
步骤7：Client行为跟踪模块跟踪持块令牌获取服务的用户，记录相关行为数据，为下一时域t内信任值的计算收集证据。
上述方法采用信任值计算和建立信任值数据库的方法，通过阈值控制块令牌的发放，有助于NameNode节点对Client的细粒度的访问控制，并且Client获取到令牌后进行的操作也影响着自身的信任值。
上述实施例提供的一种访问控制方法和系统，通过信任模型计算出的服务节点信任值可以优化服务节点的调度，采用信任值计算，通过阈值控制块令牌的发放，有助于NameNode节点对用户的细粒度的访问控制，并且用户获取到令牌后进行的操作也影响着自身的信任值，本发明实施例能够提高Hadoop集群系统的安全性。
本领域普通技术人员可以理解上述实施例的全部或部分步骤可以使用计 算机程序流程来实现，所述计算机程序可以存储于一计算机可读存储介质中，所述计算机程序在相应的硬件平台上(如系统、设备、装置、器件等)执行，在执行时，包括方法实施例的步骤之一或其组合。
可选地，上述实施例的全部或部分步骤也可以使用集成电路来实现，这些步骤可以被分别制作成一个个集成电路模块，或者将它们中的多个模块或步骤制作成单个集成电路模块来实现。
上述实施例中的装置/功能模块/功能单元可以采用通用的计算装置来实现，它们可以集中在单个的计算装置上，也可以分布在多个计算装置所组成的网络上。
上述实施例中的装置/功能模块/功能单元以软件功能模块的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。上述提到的计算机可读取存储介质可以是只读存储器，磁盘或光盘等。
工业实用性
本发明实施例通过信任模型计算出的服务节点信任值可以优化服务节点的调度，采用信任值计算，通过用户的信任度信息控制块令牌的发放，有助于NameNode节点对用户的细粒度的访问控制。本发明实施例能够提高Hadoop集群系统的安全性。

Claims (15)

  1. 一种访问控制方法，该方法包括：
    在接收到用户申请服务的请求后，查询该用户的信任度信息；
    在根据查询到的用户的信任度信息判断该用户可信时，查询能够为该用户提供服务的候选服务节点的信任度信息，结合查询到的候选服务节点的信任度信息为所述用户选择提供服务的服务节点。
  2. 如权利要求1所述的方法，还包括：
    在根据查询到的用户的信任度信息判断该用户不可信时，拒绝为所述用户发放访问服务节点的令牌。
  3. 如权利要求1所述的方法，还包括：
    收集节点的行为数据，根据信任值计算模型和收集到的行为数据计算节点的信任值。
  4. 如权利要求3所述的方法，其中：
    收集节点的行为数据，根据信任值计算模型和收集到的行为数据计算节点的信任值，包括：
    收集当前统计周期内的节点之间评定的本地信任值信息；
    对每一个节点，将当前统计周期内所有对端节点为所述节点评定的本地信任值进行加权平均，获得的加权平均值作为所述节点在当前统计周期内的全局信任值；其中，每一个本地信任值所对应的加权系数为所述对端节点在上一个统计周期内的归一化全局信任值；
    在获得所有目标节点在当前统计周期内的全局信任值后，对每一个节点在当前统计周期内的全局信任值进行归一化处理，包括：对任意一个节点，将所述节点在当前统计周期内的全局信任值除以所有节点在当前统计周期内的全局信任值的和，得到的商作为所述节点在当前统计周期内的归一化全局信任值。
  5. 如权利要求3或4所述的方法，还包括：
    在确定节点的信任值后，还根据节点的信任值确定节点的安全等级；
    其中，所述安全等级为：危险级、一般安全级或高安全级。
  6. 如权利要求4所述的方法，其中：
    结合查询到的候选服务节点的信任度信息为所述用户选择提供服务的服务节点，包括：
    根据节点的信任值和资源占用情况对能够提供服务的候选服务节点进行排序，根据排序结果挑选为所述用户提供服务的服务节点。
  7. 如权利要求5所述的方法，还包括：
    在确定一个或多个服务节点的安全等级为危险级时，限制所述服务节点提供服务。
  8. 一种访问控制系统，包括：
    节点监测模块，设置为：监测节点之间的通信，将节点之间的信任关系数据上报给信任值计算模块；
    信任值计算模块，设置为：计算节点的信任值；
    调度及控制模块，设置为：在接收到用户申请服务的请求后，查询该用户的信任度信息，在根据查询到的用户的信任度信息判断该用户可信时，从信任值计算模块查询能够为所述用户提供服务的候选服务节点的信任度信息，结合查询到的候选服务节点的信任度信息为所述用户选择提供服务的服务节点。
  9. 如权利要求8所述的系统，其中：
    调度及控制模块，还设置为：在根据查询到的信任度信息判断该用户不可信时，拒绝为所述用户发放访问服务节点的令牌。
  10. 如权利要求8所述的系统，其中：
    信任值计算模块，是设置为：收集到节点的行为数据后，根据信任值计 算模型和收集到的行为数据计算节点的信任值。
  11. 如权利要求10所述的系统，其中：
    信任值计算模块，是设置为：收集到当前统计周期内的节点之间评定的本地信任值信息后，对每一个节点，将当前统计周期内所有对端节点为所述节点评定的本地信任值进行加权平均，获得的加权平均值作为所述节点在当前统计周期内的全局信任值；其中，每一个本地信任值所对应的加权系数为所述对端节点在上一个统计周期内的归一化全局信任值；
    在获得所有目标节点在当前统计周期内的全局信任值后，对每一个节点在当前统计周期内的全局信任值进行归一化处理，包括：对任意一个节点，将所述节点在当前统计周期内的全局信任值除以所有节点在当前统计周期内的全局信任值的和，得到的商作为所述节点在当前统计周期内的归一化全局信任值。
  12. 如权利要求8所述的系统，还包括：
    安全等级划分模块，设置为：根据节点的信任值确定节点的安全等级；
    其中，所述安全等级为：危险级、一般安全级或高安全级。
  13. 如权利要求11所述的系统，其中：
    调度及控制模块，是设置为：根据节点的信任值和资源占用情况对能够提供服务的候选服务节点进行排序，根据排序结果挑选为所述用户提供服务的服务节点。
  14. 如权利要求12所述的系统，其中：
    调度及控制模块，还设置为：在确定一个或多个服务节点的安全等级为危险级时，限制所述服务节点提供服务。
  15. 一种计算机可读存储介质，存储有计算机可执行指令，所述计算机可执行指令用于执行权利要求1-7任一项的方法。
PCT/CN2015/093208 2015-02-15 2015-10-29 一种访问控制方法和系统 WO2016127664A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510083833.3 2015-02-15
CN201510083833.3A CN105991596B (zh) 2015-02-15 2015-02-15 一种访问控制方法和系统

Publications (1)

Publication Number Publication Date
WO2016127664A1 true WO2016127664A1 (zh) 2016-08-18

Family

ID=56614117

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2015/093208 WO2016127664A1 (zh) 2015-02-15 2015-10-29 一种访问控制方法和系统

Country Status (2)

Country Link
CN (1) CN105991596B (zh)
WO (1) WO2016127664A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111767250A (zh) * 2020-06-10 2020-10-13 钛星投资(深圳)有限公司 去中心化存储方法、下载方法及存储系统

Families Citing this family (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108737138B (zh) * 2017-04-18 2022-06-07 腾讯科技（深圳）有限公司 服务提供方法及服务平台
CN107665315B (zh) * 2017-10-31 2020-12-15 上海应用技术大学 一种适用于Hadoop的基于角色与信任的访问控制方法
CN110290520B (zh) * 2019-06-28 2021-10-08 苏州市职业大学 一种wsn节点的访问控制方法、相关装置及计算机可读存储介质
CN111124532A (zh) * 2019-11-29 2020-05-08 北京浪潮数据技术有限公司 一种服务加载方法、装置及电子设备和存储介质
CN111181979B (zh) * 2019-12-31 2022-06-07 奇安信科技集团股份有限公司 访问控制方法、装置、计算机设备和计算机可读存储介质
CN114650184B (zh) * 2022-04-15 2023-05-26 四川中电启明星信息技术有限公司 一种基于信任度的Docker进程安全访问控制方法

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101241528A (zh) * 2008-01-31 2008-08-13 武汉大学 终端接入可信pda的方法和接入系统
CN101626305A (zh) * 2008-07-09 2010-01-13 同济大学 一种提高网络环境安全性的可信动态级调度方法
CN103561047A (zh) * 2013-07-31 2014-02-05 南京理工大学 基于兴趣群组的p2p网络信任云模型计算方法

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101404572A (zh) * 2008-11-14 2009-04-08 西安交通大学 一种基于反馈信任聚合的网络节点总体信任度评估方法
CN101772012B (zh) * 2009-01-04 2012-06-06 中国移动通信集团公司 网络节点信任度确定方法、系统及装置
CN101895577B (zh) * 2010-07-06 2013-02-13 中国科学院计算技术研究所 网络共享资源的分配方法
TW201222231A (en) * 2010-11-18 2012-06-01 Promise Tecnnology Inc Network-attached storage system
CN102638795B (zh) * 2012-04-23 2014-11-19 浙江大学 可抵御攻击的分布式传感网络的信任评估方法
CN103294558B (zh) * 2013-05-29 2016-09-21 北京大学 一种支持动态信任评估的MapReduce调度方法

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101241528A (zh) * 2008-01-31 2008-08-13 武汉大学 终端接入可信pda的方法和接入系统
CN101626305A (zh) * 2008-07-09 2010-01-13 同济大学 一种提高网络环境安全性的可信动态级调度方法
CN103561047A (zh) * 2013-07-31 2014-02-05 南京理工大学 基于兴趣群组的p2p网络信任云模型计算方法

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111767250A (zh) * 2020-06-10 2020-10-13 钛星投资(深圳)有限公司 去中心化存储方法、下载方法及存储系统

Also Published As

Publication number Publication date
CN105991596A (zh) 2016-10-05
CN105991596B (zh) 2020-11-20

Similar Documents

Publication Publication Date Title
WO2016127664A1 (zh) 一种访问控制方法和系统
Kim et al. Secure authentication-management human-centric scheme for trusting personal resource information on mobile cloud computing with blockchain
Awaysheh et al. Next-generation big data federation access control: A reference model
Li et al. Engineering searchable encryption of mobile cloud networks: When QoE meets QoP
DE112020000054T5 (de) Ressourcen-, sicherheits- und dienstmanagement für mehrere entitäten in edge-computing-anwendungen
Kim et al. CometCloud: An autonomic cloud engine
US11611636B2 (en) Quality of service in a distributed system
CN102651775B (zh) 基于云计算的多租户共享对象管理的方法、设备及系统
JP2021526751A (ja) 自己監視ブロックチェーンのための安全な合意に基づくエンドースメント
Lazouski et al. Usage control in cloud systems
US20210352077A1 (en) Low trust privileged access management
CN102457555A (zh) 一种分布式存储的安全系统及方法
US20220043902A1 (en) Verifiable labels for mandatory access control
JP5848339B2 (ja) プロビジョニングサービスのためのリーダーアービトレーション
CN111353172B (zh) 基于区块链的Hadoop集群大数据访问方法及系统
US11917088B2 (en) Integrating device identity into a permissioning framework of a blockchain
US20160014155A1 (en) Abstract evaluation of access control policies for efficient evaluation of constraints
US9514290B2 (en) Authorization cache
Jayapandian Cloud Dynamic Scheduling for Multimedia Data Encryption Using Tabu Search Algorithm
Liao et al. Last-hdfs: Location-aware storage technique for hadoop distributed file system
CN108076092A (zh) Web服务器资源均衡方法及装置
Balaraju et al. Innovative secure authentication interface for Hadoop cluster using DNA cryptography: A practical study
Srinivasa Rao et al. A secure and efficient temporal features based framework for cloud using MapReduce
CN116760639B (zh) 一种用于多租户的数据安全隔离与共享框架实现方法
US10708253B2 (en) Identity information including a schemaless portion

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 15881814

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 15881814

Country of ref document: EP

Kind code of ref document: A1