WO2016177051A1 - 安全认证的方法及装置 - Google Patents

安全认证的方法及装置 Download PDF

Info

Publication number
WO2016177051A1
WO2016177051A1 PCT/CN2016/075242 CN2016075242W WO2016177051A1 WO 2016177051 A1 WO2016177051 A1 WO 2016177051A1 CN 2016075242 W CN2016075242 W CN 2016075242W WO 2016177051 A1 WO2016177051 A1 WO 2016177051A1
Authority
WO
WIPO (PCT)
Prior art keywords
access
accessed
big data
data platform
identifier
Prior art date
Application number
PCT/CN2016/075242
Other languages
English (en)
French (fr)
Inventor
黄增建
尤元建
吴孝鹏
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2016177051A1 publication Critical patent/WO2016177051A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials

Definitions

  • the present invention relates to the field of computers, and in particular to a method and apparatus for secure authentication.
  • Hadoop did not have a security certification. All nodes in the default cluster are reliable and trustworthy. Users do not need to authenticate when interacting with HDFS or M/R. The result is that a malicious user pretends to be a real user or the server invades the Hadoop cluster, maliciously submits the job, modifies the JobTracker state, tampers with the data on the HDFS, pretends to be a NameNode (manager) or TaskTracker accepts the task.
  • HDFS adds permissions for files and directories after version 0.16, there is no guarantee of strong authentication, which can only protect against accidental data loss. A malicious user can easily pretend to be a user to tamper with the permissions, resulting in a privilege setting. It is not possible to secure the Hadoop cluster.
  • the Kerberos authentication mechanism was added. Make the nodes in the cluster what they claim to be and trust. Kerberos can put the authenticated key on a reliable node before the cluster is deployed. When the cluster is running, the nodes in the cluster are authenticated using the key. Only authenticated nodes can be used normally. The node attempting to impersonate cannot communicate with the nodes inside the cluster because there is no key information obtained in advance. Prevents malicious use or tampering with Hadoop clusters, ensuring reliable and secure Hadoop clusters.
  • the cluster security authentication can be considered as two different scenarios. One is the authentication between the master and slave nodes inside the cluster, and the other is the authentication between the client and the server of the cluster.
  • the Kerberos authentication mechanism in the related art does not trust the client, the server, the IP address, etc., and believes that everything except the KDC server is dangerous, so the processes and algorithms are complicated and have a relatively large impact on system performance.
  • the embodiment of the invention provides a method and a device for secure authentication, so as to at least solve the problem that the flow and algorithm of the Kerberos authentication mechanism in the related art are complicated.
  • a method for secure authentication includes: receiving, by an access terminal in a big data platform, a first configuration instruction for locally configuring a whitelist, wherein the whitelist is Storing an identifier for identifying an access end that is allowed to establish a connection with the accessed end; before the access end accesses the accessed end in the big data platform, the accessed end determines the access Whether the identifier of the end matches the identifier of the whitelist; when the judgment result is yes, the accessed end allows the access end to establish a connection with the accessed end.
  • the method further includes: when the determination result is no, the accessed end prohibits the access terminal from establishing a connection, and reports a warning message.
  • the identifier used to identify the secondary node is The host name of the secondary node.
  • the access end is a server in a big data platform
  • the access end is a client in the big data platform
  • the identifier used to identify the client is the server. IP.
  • the method further includes: the server receiving the second configuration instruction, where the second configuration instruction is configured to be configured for the user to view And/or update the management interface of the server IP.
  • a device for secure authentication which is applied to an access side, and includes: a first receiving module, configured to receive a first configuration instruction for locally configuring a whitelist,
  • the whitelist stores an identifier for identifying an access end that is connected to the accessed end, and the determining module is configured to determine, before the access end accesses the accessed end, Whether the identifier of the access terminal matches the identifier of the whitelist; and the establishing module is configured to allow the access terminal to establish a connection with the accessed terminal when the determination result is yes.
  • the device further includes: a prohibiting module, configured to prohibit the access terminal from establishing a connection and report an alarm message when the determination result is no.
  • a prohibiting module configured to prohibit the access terminal from establishing a connection and report an alarm message when the determination result is no.
  • the identifier used to identify the secondary node is the The host name of the node.
  • the access end is a server in a big data platform
  • the access end is a client in the big data platform
  • the identifier used to identify the client is the server. IP.
  • the apparatus further includes: a second receiving module, configured to receive the second configuration instruction, where the second configuration instruction is used for configuration A management interface for the user to view and/or update the server IP.
  • the whitelist is configured on the accessed end of the big data platform, and the whitelist is configured to identify the identifier of the access end that is allowed to establish a connection with the accessed end, and thus is large.
  • the access end determines whether the identity of the access end matches the identifier of the whitelist. When the judgment result is yes, the access end allows the access terminal to allow the access.
  • the terminal accesses the access terminal and establishes a connection manner, thereby solving the complicated process of the Kerberos authentication mechanism in the related art, reducing the problem of code development workload and system performance, and improving the authentication of the big data platform. effectiveness.
  • FIG. 1 is a flow chart of a method for secure authentication according to an embodiment of the present invention
  • FIG. 2 is a structural block diagram of an apparatus for secure authentication according to an embodiment of the present invention.
  • FIG. 3 is a block diagram 1 of an optional structure of an apparatus for secure authentication according to an embodiment of the present invention
  • FIG. 4 is a schematic diagram of security authentication using whitelist-based authentication inside a cluster according to an alternative embodiment of the present invention.
  • FIG. 5 is a schematic diagram of security authentication of a client and a server of a cluster using whitelist-based authentication according to an optional embodiment of the present invention
  • FIG. 6 is a security deployment diagram of a big data management system obtained by combining the security authentication of the internal and secondary nodes of the integrated cluster with the security authentication of the client, and the Hadoop native security authority control policy.
  • FIG. 1 is a flowchart of a method for secure authentication according to an embodiment of the present invention. As shown in FIG. 1 , the process includes the following steps:
  • Step S102 The accessed end in the big data platform receives the first configuration command for configuring the whitelist locally, where the whitelist stores an identifier for identifying the access end that is allowed to establish a connection with the accessed end.
  • Step S104 Before the access end of the big data platform accesses the access end, the access end determines whether the identifier of the access end matches the identifier of the whitelist;
  • Step S106 When the judgment result is yes, the access end allows the access end to establish a connection with the accessed end.
  • the access terminal configured in the big data platform is configured with a white list, and the white list stores the identifier for allowing the access terminal to establish a connection with the access terminal.
  • the identification is performed. Therefore, before the access end of the big data platform accesses the access end, the access end determines whether the identifier of the access end matches the identifier of the whitelist. When the judgment result is yes, the accessed end is The access terminal is allowed to access the accessed end and establishes a connection manner, thereby solving the complicated process of the Kerberos authentication mechanism in the related art, reducing the problem of code development workload and system performance, and improving the impact. The authentication efficiency of the big data platform.
  • the method in this embodiment may further include: when the determination result is no, the access end prohibits the access terminal from establishing a connection, and reports an alarm message.
  • the access end prohibits the access terminal from establishing a connection, and reports an alarm message.
  • the The access end and the access end can be: the primary node and the node, or the client and the server.
  • the identifier used to identify the secondary node is the host name of the secondary node; or, on the access side,
  • the server in the big data platform when the access end is a client in the big data platform, the identifier used to identify the client is the IP of the server.
  • the method in this embodiment may further include: the server receiving the second configuration instruction, where The second configuration command is used to configure a management interface for the user to view and/or update the server IP.
  • the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course, by hardware, but in many cases, the former is A better implementation.
  • the technical solution of the present invention which is essential or contributes to the prior art, may be embodied in the form of a software product stored in a storage medium (such as ROM/RAM, disk,
  • the optical disc includes a number of instructions for causing a terminal device (which may be a cell phone, a computer, a server, or a network device, etc.) to perform the methods of various embodiments of the present invention.
  • a device for security authentication is provided, which is used to implement the foregoing embodiments and preferred embodiments, and details are not described herein.
  • the term "module” may implement a combination of software and/or hardware of a predetermined function.
  • the apparatus described in the following embodiments is preferably implemented in software, hardware, or a combination of software and hardware, is also possible and contemplated.
  • FIG. 2 is a structural block diagram of an apparatus for secure authentication according to an embodiment of the present invention, applied to an access side, as shown in FIG. 2, the apparatus includes: a first receiving module 22 configured to receive white for local configuration The first configuration command of the list, wherein the whitelist stores an identifier for identifying the access end that is allowed to establish a connection with the accessed terminal; the determining module 24 is coupled to the first receiving module 22 and configured to be at the access end. Before accessing the access terminal, determining whether the identifier of the access terminal matches the identifier of the whitelist; the establishing module 26 is coupled with the determining module 24, and is configured to allow the access terminal and the accessed terminal when the determination result is yes. establish connection.
  • FIG. 3 is a block diagram of an optional structure of an apparatus for secure authentication according to an embodiment of the present invention. As shown in FIG. 3, the apparatus further includes: a prohibition module 32 coupled to the determination module 24, and configured to be The access terminal is forbidden to establish a connection and report a warning message.
  • a prohibition module 32 coupled to the determination module 24, and configured to be The access terminal is forbidden to establish a connection and report a warning message.
  • the accessed end and the access end may be: the primary node and the node respectively, or Client and server.
  • the identifier used to identify the secondary node is the host name of the secondary node; or, on the access side,
  • the server in the big data platform when the access end is a client in the big data platform, the identifier used to identify the client is the IP of the server.
  • the embodiment is The device further includes: a second receiving module configured to receive the second configuration instruction, wherein the second configuration instruction is configured to configure a management interface for the user to view and/or update the server IP.
  • the access between the internal master-slave nodes of the big data platform and the access of the external access client are authenticated to prevent malicious users or servers from invading the Hadoop cluster, maliciously submitting jobs, modifying the JobTracker status, and tampering with the data on the HDFS. Pretending to be a NameNode or TaskTracker to accept tasks, etc. Thereby ensuring data security of the big data storage system. Therefore, the optional embodiment provides a security authentication method for a big data management system, and the solution of the method includes:
  • the IP whitelist is also used.
  • a client file is created on all the clients connected to the client, such as NameNode, ResourceManager, HMaster, and RegionServer, in which all white files are stored.
  • the IP or IP segment of the list user is judged. If the IP is in the whitelist, the connection is allowed, otherwise the connection is disconnected.
  • HIVE authenticates the client connected to it through JDBC.
  • FIG. 4 is a schematic diagram of security authentication using whitelist-based authentication inside a cluster according to an alternative embodiment of the present invention. As shown in FIG. 4, the YRAN is used as an example.
  • the authentication process includes:
  • HDFS configuration In hdfs-site.xml, the configuration item dfs.hosts is configured as a slaves file.
  • the configuration content in this file is the domain name of the slave node.
  • the primary node is the NameNode
  • the secondary node is the DataNode.
  • the NameNode finds that the domain name of the connected DataNode is not in this file, and considers that the DataNode is invalid and refuses to connect.
  • yarn.resourcemanager.nodes.include-path is configured as a slaves file
  • the configuration content of the file is the domain name of the slave node.
  • the primary node is the ResourceManager and the secondary node is the NodeManager.
  • the HOST of the NodeManager is verified. Only the configuration that exists in the slaves configuration file can pass the verification.
  • HBase configuration The hbase.regionservers configuration item in hbase-site.xml is configured as a regionservers file.
  • the configuration content in this file is the domain name of the slave node.
  • the primary node is HMaster and the secondary node is HRegionserver.
  • HMaster finds that the domain name of the connected HRegionserver is not in this file.
  • the HRegionserver is considered invalid and refuses to connect.
  • FIG. 5 is a schematic diagram of the security authentication of the client and the server of the cluster using whitelist-based authentication according to an alternative embodiment of the present invention. As shown in FIG. 5, the HDFS is used as an example.
  • the authentication process includes:
  • the Clients file which stores the IP or IP segments of all whitelisted users (IP segment/after matching digits), in the following format;
  • the whitelist name of each service is determined as:
  • Each service component also needs to add a configuration switch. If the switch is turned on, the whitelist function check is performed, and when the switch is turned off, it is not checked.
  • Hive's internal data is mainly table information, which can be considered to be of low importance, so you can use its native security mechanism and use JDBC username and password check.
  • MANAGER provides an interface for viewing and modifying the IPs allowed to be accessed by each service node. At the same time, when the node is installed, this file is not generated by default. That is, this function is not enabled. Only when the user manually adds a whitelist, the whitelist file is generated and enabled.
  • a JMX process is added, that is, a command request from the MANAGER is received, which is used to refresh the client IP white in the memory. List and configuration switches.
  • the server When the server starts, it reads the Clients and loads it into the memory. When a client connects to the RPC, it first checks whether the IP of the connection is in the whitelist. If not, the connection is rejected. And perform alarms to prevent malicious users from malicious attacks.
  • FIG. 6 is a diagram showing the security deployment of the big data management system obtained by the security authentication of the internal and secondary nodes of the integrated cluster and the security authentication of the client, and the security security control policy of Hadoop.
  • the authentication process is as follows: the security authentication of the master-slave node in the integrated cluster and the security authentication of the client, combined with Hadoop's native security permission control strategy, to obtain a complete set of big data management system security deployment plan.
  • each of the above modules may be implemented by software or hardware.
  • the foregoing may be implemented by, but not limited to, the foregoing modules are all located in the same processor; or, the modules are located in multiple In the processor.
  • Embodiments of the present invention also provide a storage medium.
  • the foregoing storage medium may be configured to store program code for performing the following steps:
  • Step S1 The accessed end in the big data platform receives the first configuration command for configuring the whitelist locally, where the whitelist stores an identifier for identifying the access end that is allowed to establish a connection with the accessed end.
  • Step S2 Before the access end of the big data platform accesses the access end, the access end determines whether the identifier of the access end matches the identifier of the whitelist;
  • Step S3 When the judgment result is yes, the access end allows the access end to establish a connection with the accessed end.
  • modules or steps of the present invention described above can be implemented by a general-purpose computing device that can be centralized on a single computing device or distributed across a network of multiple computing devices. Alternatively, they may be implemented by program code executable by the computing device such that they may be stored in the storage device by the computing device and, in some cases, may be different from the order herein.
  • the steps shown or described are performed, or they are separately fabricated into individual integrated circuit modules, or a plurality of modules or steps thereof are fabricated as a single integrated circuit module.
  • the invention is not limited to any specific combination of hardware and software.
  • the whitelist is configured on the accessed end of the big data platform, and the whitelist is configured to identify the identifier of the access end that is allowed to establish a connection with the accessed end, and thus is large.
  • the access end determines whether the identity of the access end matches the identifier of the whitelist. When the judgment result is yes, the access end allows the access terminal to allow the access.
  • the terminal accesses the access terminal and establishes a connection manner, thereby solving the complicated process of the Kerberos authentication mechanism in the related art, reducing the problem of code development workload and system performance, and improving the authentication of the big data platform. effectiveness.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer And Data Communications (AREA)
  • Small-Scale Networks (AREA)

Abstract

本发明提供了一种安全认证的方法及装置，其中，该方法包括：大数据平台中的被接入端接收用于在本地配置白名单的第一配置指令，其中，白名单中存储有允许与被接入端建立连接的用于标识接入端的标识；在大数据平台中接入端接入被接入端之前，被接入端判断接入端的标识是否与白名单的标识匹配；在判断结果为是时，被接入端允许接入端与被接入端建立连接。通过本发明，解决了相关技术中Kerberos认证机制的流程和算法复杂的问题，减少了代码开发工作量和对系统性能的影响，提高了大数据平台的认证效率。

Description

安全认证的方法及装置 技术领域
本发明涉及计算机领域，具体而言，涉及一种安全认证的方法及装置。
背景技术
在Hadoop1.0.0或者CDH3版本之前，Hadoop并不存在安全认证一说。默认集群内所有的节点都是可靠的，值得信赖的。用户与HDFS或者M/R进行交互时并不需要进行验证。导致存在恶意用户伪装成真正的用户或者服务器入侵到Hadoop集群上，恶意的提交作业，修改JobTracker状态，篡改HDFS上的数据，伪装成NameNode(管理者)或者TaskTracker接受任务等。尽管在版本0.16以后，HDFS增加了文件和目录的权限，但是并没有强认证的保障，这些权限只能对偶然的数据丢失起保护作用。恶意的用户可以轻易的伪装成其他用户来篡改权限，致使权限设置形同虚设。不能够对Hadoop集群起到安全保障。
在Hadoop1.0.0或者CDH3版本后，加入了Kerberos认证机制。使得集群中的节点就是它们所宣称的，是信赖的。Kerberos可以将认证的密钥在集群部署时事先放到可靠的节点上。集群运行时，集群内的节点使用密钥得到认证。只有被认证过节点才能正常使用。企图冒充的节点由于没有事先得到的密钥信息，无法与集群内部的节点通信。防止了恶意的使用或篡改Hadoop集群的问题，确保了Hadoop集群的可靠安全。
目前集群的安全认证，可以认为分为两个不同的场景，一个是集群内部的主从节点之间的认证，一个是集群的客户端和服务端之间的认证。相关技术中的Kerberos认证机制对客户端和服务端、IP地址等都不信任，认为除了KDC服务器以外一切都存在着危险，所以流程和算法都很复杂，对系统性能会造成比较大的影响。
针对相关技术中Kerberos认证机制的流程和算法复杂的问题，目前尚未存在有效解决方案。
发明内容
本发明实施例提供了一种安全认证的方法及装置，以至少解决相关技术中Kerberos认证机制的流程和算法复杂的问题。
根据本发明实施例的一个方面，提供了一种安全认证的方法，包括：大数据平台中的被接入端接收用于在本地配置白名单的第一配置指令，其中，所述白名单中存储有允许与所述被接入端建立连接的用于标识接入端的标识；在大数据平台中接入端接入所述被接入端之前，所述被接入端判断所述接入端的标识是否与所述白名单的标识匹配；在判断结果为是时，所述被接入端允许所述接入端与所述被接入端建立连接。
可选地，所述方法还包括：在判断结果为否时，所述被接入端禁止所述接入端建立连接，并上报告警消息。
可选地，在所述被接入端为所述大数据平台内部的主节点，所述接入端为所述大数据平台内部的次节点时，所述用于标识次节点的标识为所述次节点的主机名。
可选地，在所述被接入端为大数据平台中的服务端，所述接入端为所述大数据平台中的客户端时，所述用于标识客户端的标识为所述服务端的IP。
可选地，在被接入端接收在本地配置白名单的配置指令之后，所述方法还包括：所述服务端接收第二配置指令，其中，所述第二配置指令用于配置供用户查看和/或更新所述服务端IP的管理界面。
根据本发明实施例的另一个方面，提供了一种安全认证的装置，应用于被接入端侧，包括：第一接收模块，设置为接收用于在本地配置白名单的第一配置指令，其中，所述白名单中存储有允许与所述被接入端建立连接的用于标识接入端的标识；判断模块，设置为在接入端接入所述被接入端之前，判断所述接入端的标识是否与所述白名单的标识匹配；建立模块，设置为在判断结果为是时，允许所述接入端与所述被接入端建立连接。
可选地，所述装置还包括：禁止模块，设置为在判断结果为否时，禁止所述接入端建立连接，并上报告警消息。
可选地，在所述被接入端为大数据平台内部的主节点，所述接入端为所述大数据平台内部的次节点时，所述用于标识次节点的标识为所述次节点的主机名。
可选地，在所述被接入端为大数据平台中的服务端，所述接入端为所述大数据平台中的客户端时，所述用于标识客户端的标识为所述服务端的IP。
可选地，在被接入端接收在本地配置白名单的配置指令之后，所述装置还包括：第二接收模块，设置为接收第二配置指令，其中，所述第二配置指令用于配置供用户查看和/或更新所述服务端IP的管理界面。
在本发明实施例中，采用了在大数据平台中的被接入端配置了白名单，该白名单中存储有允许与被接入端建立连接的用于标识接入端的标识，因此在大数据平台中的接入端接入被接入端之前，被接入端判断接入端的标识是否与白名单的标识匹配，在判断结果为是时，该被接入端才会允许该接入端接入被接入端并建立连接的方式，从而解决了相关技术中Kerberos认证机制的流程和算法复杂的问题，减少了代码开发工作量和对系统性能的影响，提高了大数据平台的认证效率。
附图说明
此处所说明的附图用来提供对本发明的进一步理解，构成本申请的一部分，本发明的示意性实施例及其说明用于解释本发明，并不构成对本发明的不当限定。在附图中：
图1是根据本发明实施例的安全认证的方法流程图；
图2是根据本发明实施例的安全认证的装置的结构框图；
图3是根据本发明实施例的安全认证的装置的可选结构框图一；
图4是根据本发明可选实施例的集群内部使用基于白名单的认证的安全认证示意图；
图5是本发明可选实施例的集群的客户端和服务端使用基于白名单的认证的安全认证示意图；
图6是本发明可选实施例的综合集群内部主从节点的安全认证和客户端的安全认证，再结合Hadoop原生的安全权限控制策略，得到的大数据管理系统安全部署图。
具体实施方式
下文中将参考附图并结合实施例来详细说明本发明。需要说明的是，在不冲突的情况下，本申请中的实施例及实施例中的特征可以相互组合。
需要说明的是，本发明的说明书和权利要求书及上述附图中的术语“第一”、“第二”等是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。
在本实施例中提供了一种安全认证的方法，图1是根据本发明实施例的安全认证的方法流程图，如图1所示，该流程包括如下步骤：
步骤S102：大数据平台中的被接入端接收用于在本地配置白名单的第一配置指令，其中，白名单中存储有允许与被接入端建立连接的用于标识接入端的标识；
步骤S104：在大数据平台中的接入端接入被接入端之前，被接入端判断接入端的标识是否与白名单的标识匹配；
步骤S106：在判断结果为是时，被接入端允许接入端与被接入端建立连接。
通过本实施例中的步骤S102至步骤S106，采用了在大数据平台中的被接入端配置了白名单，该白名单中存储有允许与被接入端建立连接的用于标识接入端的标识，因此在大数据平台中的接入端接入被接入端之前，被接入端判断接入端的标识是否与白名单的标识匹配，在判断结果为是时，该被接入端才会允许该接入端接入被接入端并建立连接的方式，从而解决了相关技术中Kerberos认证机制的流程和算法复杂的问题，减少了代码开发工作量和对系统性能的影响，提高了大数据平台的认证效率。
此外，在本实施例中上述步骤S104之后，本实施例的方法还可以包括：在判断结果为否时，被接入端禁止接入端建立连接，并上报告警消息。通过该步骤判断出非法的接入端时，通过告警消息能够及时有效的告知系统或用户。
需要说明的是，由于本实施例中涉及到的是大数据平台的被接入端和接入端，因此，该 被接入端和接入端可以分别为：主节点和此节点，或是客户端和服务端。而在被接入端为大数据平台内部的主节点，接入端为大数据平台内部的次节点时，用于标识次节点的标识为次节点的主机名；或者，在被接入端为大数据平台中的服务端，接入端为大数据平台中的客户端时，用于标识客户端的标识为服务端的IP。
在本实施例中的另一个可选实施例中，在被接入端接收在本地配置白名单的配置指令之后，本实施例的方法还可以包括：服务端接收第二配置指令，其中，第二配置指令用于配置供用户查看和/或更新服务端IP的管理界面。
通过以上的实施方式的描述，本领域的技术人员可以清楚地了解到根据上述实施例的方法可借助软件加必需的通用硬件平台的方式来实现，当然也可以通过硬件，但很多情况下前者是更佳的实施方式。基于这样的理解，本发明的技术方案本质上或者说对现有技术做出贡献的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质(如ROM/RAM、磁碟、光盘)中，包括若干指令用以使得一台终端设备(可以是手机，计算机，服务器，或者网络设备等)执行本发明各个实施例的方法。
在本实施例中还提供了一种安全认证的装置，该装置用于实现上述实施例及优选实施方式，已经进行过说明的不再赘述。如以下所使用的，术语“模块”可以实现预定功能的软件和/或硬件的组合。尽管以下实施例所描述的装置较佳地以软件来实现，但是硬件，或者软件和硬件的组合的实现也是可能并被构想的。
图2是根据本发明实施例的安全认证的装置的结构框图，应用于被接入端侧，如图2所示，该装置包括：第一接收模块22，设置为接收用于在本地配置白名单的第一配置指令，其中，白名单中存储有允许与被接入端建立连接的用于标识接入端的标识；判断模块24，与第一接收模块22耦合连接，设置为在接入端接入被接入端之前，判断接入端的标识是否与白名单的标识匹配；建立模块26，与判断模块24耦合连接，设置为在判断结果为是时，允许接入端与被接入端建立连接。
图3是根据本发明实施例的安全认证的装置的可选结构框图一，如图3所示，该装置还包括：禁止模块32，与判断模块24耦合连接，设置为在判断结果为否时，禁止接入端建立连接，并上报告警消息。
需要说明的是，由于本实施例中涉及到的是大数据平台的被接入端和接入端，因此，该被接入端和接入端可以分别为：主节点和此节点，或是客户端和服务端。而在被接入端为大数据平台内部的主节点，接入端为大数据平台内部的次节点时，用于标识次节点的标识为次节点的主机名；或者，在被接入端为大数据平台中的服务端，接入端为大数据平台中的客户端时，用于标识客户端的标识为服务端的IP。
可选地，在被接入端为大数据平台中的服务端，接入端为大数据平台中的客户端时，在被接入端接收在本地配置白名单的配置指令之后，本实施例的装置还包括：第二接收模块，设置为接收第二配置指令，其中，第二配置指令用于配置供用户查看和/或更新服务端IP的管理界面。
下面结合本发明的可选实施例对本发明进行举例说明；
对大数据平台的内部主从节点之间的访问以及外部接入客户端的访问进行鉴权，防止恶意用户或者服务器入侵到Hadoop集群上，恶意的提交作业，修改JobTracker状态，篡改HDFS上的数据，伪装成NameNode或者TaskTracker接受任务等。从而保证大数据存储系统的数据安全。因此，本可选实施例提供了一种大数据管理系统的安全认证方法，该方法的方案包括：
对于服务端集群内部各主从节点之间的认证，比如NameNode(主节点)和DataNode(从节点)之间，ResourceManager(资源管理器)和NodeManager(节点管理器)之间，HMaster和HRegionserver之间，这种认证通过白名单方式来完成，白名单配置使用Hadoop原生的HOST白名单配置文件。对于集群内部连接上来的DataNode、NodeManager或者HRegionserver的主机名进行判断，如果该主机名在白名单中才允许其连接，否则拒绝其连接。
对于集群的客户端和服务端之间的认证，也采用IP白名单方式，在所有客户端会连接的服务端，如：NameNode、ResourceManager、HMaster和RegionServer上面建立一个Clients文件，其中存放所有的白名单用户的IP或者IP段。对于RPC连接上来的客户端的IP进行判断，如果该IP在白名单中才允许其连接，否则断开其连接。同时，HIVE则通过JDBC，对连接其的客户端进行认证。
下面结合附图对本可选实施例进行详细的说明；
图4是根据本发明可选实施例的集群内部使用基于白名单的认证的安全认证示意图，如图4所示，以YRAN为例，该认证的过程包括：
1.HDFS的配置在hdfs-site.xml中配置项dfs.hosts配置为一个slaves文件，该文件中配置内容是从节点的域名。对于hdfs，主节点就是NameNode，从节点就是DataNode，NameNode发现连接上来的DataNode的域名不在此文件内，则认为该DataNode不合法，拒绝连接。
2.Yarn的配置在yarn-site.xml中配置项yarn.resourcemanager.nodes.include-path配置为一个slaves文件，该文件中配置内容是从节点的域名。对于yarn，主节点就是ResourceManager，从节点就是NodeManager。某NodeManager连接到ResourceManager上面的时候，校验该NodeManager的HOST，只有在slaves配置文件中配置存在的才能通过校验。
3.HBase的配置在hbase-site.xml中配置项hbase.regionservers配置为一个regionservers文件，该文件中配置内容是从节点的域名。对于HBase，主节点就是HMaster，从节点就是HRegionserver。HMaster发现连接上来的HRegionserver的域名不在此文件内，则认为该HRegionserver不合法，拒绝连接。
图5是本发明可选实施例的集群的客户端和服务端使用基于白名单的认证的安全认证示意图，如图5所示，以HDFS为例，该认证的过程包括：
1.在服务端(NameNode、ResourceManager、HMaster和RegionServer)上面建立一个IP或者IP段的白名单，对于RPC连接上来的客户端的IP进行判断，如果该IP在白名单中才允 许其连接，否则断开其连接；
2.Clients文件，其中存放所有的白名单用户的IP或者IP段(IP段/后面是匹配的位数)，格式如下；
192.168.129.23
192.168.129.24
……
192.168.129.1/28
192.168.130.2/24
3.各个服务的白名单名称定为：
HDFS_Clients
HBASE_Clients
YARN_Clients
4.各个服务组件也需要增加配置开关，如果开关打开才进行白名单功能检查，开关关闭则不检查。
Figure PCTCN2016075242-appb-000001
Figure PCTCN2016075242-appb-000002
5.Hive的内部数据主要是表信息，可以认为重要性不高，所以可以沿用其原生的安全机制，采用JDBC用户名密码检查的方式即可。
6.Clients文件都可以通过MANAGER进行界面化配置和管理。MANAGER提供界面，对每个服务节点允许接入的IP可以进行查看和修改。同时，安装节点的时候，此文件默认不生成，即不启用此功能，只有在用户手动添加白名单的时候，才会生成该白名单文件并启用此功能。
同时，为了能让Clients文件在修改了之后不需要服务端重启就能使用，对应每个服务组件，都增加一个JMX处理，即接收MANAGER过来的命令请求，用来刷新内存中的客户端IP白名单和配置开关。
7.服务端在启动的时候，读取Clients，加载到内存中，之后当有客户端通过RPC连接上来的时候，首先检查该连接的IP是否在白名单中，如果不在，则拒绝其连接，并进行告警，以防止非法用户恶意攻击。
图6是本发明可选实施例的综合集群内部主从节点的安全认证和客户端的安全认证，再结合Hadoop原生的安全权限控制策略，得到的大数据管理系统安全部署图，如图6所示，该认证的过程为：综合集群内部主从节点的安全认证和客户端的安全认证，再结合Hadoop原生的安全权限控制策略，得到的整套大数据管理系统安全部署方案。
需要说明的是，上述各个模块是可以通过软件或硬件来实现的，对于后者，可以通过以下方式实现，但不限于此：上述模块均位于同一处理器中；或者，上述模块分别位于多个处理器中。
本发明的实施例还提供了一种存储介质。可选地，在本实施例中，上述存储介质可以被设置为存储用于执行以下步骤的程序代码：
步骤S1：大数据平台中的被接入端接收用于在本地配置白名单的第一配置指令，其中，白名单中存储有允许与被接入端建立连接的用于标识接入端的标识；
步骤S2：在大数据平台中的接入端接入被接入端之前，被接入端判断接入端的标识是否与白名单的标识匹配；
步骤S3：在判断结果为是时，被接入端允许接入端与被接入端建立连接。
可选地，本实施例中的具体示例可以参考上述实施例及可选实施方式中所描述的示例，本实施例在此不再赘述。
显然，本领域的技术人员应该明白，上述的本发明的各模块或各步骤可以用通用的计算装置来实现，它们可以集中在单个的计算装置上，或者分布在多个计算装置所组成的网络上，可选地，它们可以用计算装置可执行的程序代码来实现，从而，可以将它们存储在存储装置中由计算装置来执行，并且在某些情况下，可以以不同于此处的顺序执行所示出或描述的步骤，或者将它们分别制作成各个集成电路模块，或者将它们中的多个模块或步骤制作成单个集成电路模块来实现。这样，本发明不限制于任何特定的硬件和软件结合。
以上所述仅为本发明的优选实施例而已，并不用于限制本发明，对于本领域的技术人员来说，本发明可以有各种更改和变化。凡在本发明的精神和原则之内，所作的任何修改、等同替换、改进等，均应包含在本发明的保护范围之内。
工业实用性
在本发明实施例中，采用了在大数据平台中的被接入端配置了白名单，该白名单中存储有允许与被接入端建立连接的用于标识接入端的标识，因此在大数据平台中的接入端接入被接入端之前，被接入端判断接入端的标识是否与白名单的标识匹配，在判断结果为是时，该被接入端才会允许该接入端接入被接入端并建立连接的方式，从而解决了相关技术中Kerberos认证机制的流程和算法复杂的问题，减少了代码开发工作量和对系统性能的影响，提高了大数据平台的认证效率。

Claims (10)

  1. 一种安全认证的方法，包括：
    大数据平台中的被接入端接收用于在本地配置白名单的第一配置指令，其中，所述白名单中存储有允许与所述被接入端建立连接的用于标识接入端的标识；
    在大数据平台中接入端接入所述被接入端之前，所述被接入端判断所述接入端的标识是否与所述白名单的标识匹配；
    在判断结果为是时，所述被接入端允许所述接入端与所述被接入端建立连接。
  2. 根据权利要求1所述的方法，其中，所述方法还包括：
    在判断结果为否时，所述被接入端禁止所述接入端建立连接，并上报告警消息。
  3. 根据权利要求1或2所述的方法，其中，在所述被接入端为所述大数据平台内部的主节点，所述接入端为所述大数据平台内部的次节点时，所述用于标识次节点的标识为所述次节点的主机名。
  4. 根据权利要求1或2所述的方法，其中，在所述被接入端为大数据平台中的服务端，所述接入端为所述大数据平台中的客户端时，所述用于标识客户端的标识为所述服务端的IP。
  5. 根据权利要求4所述的方法，其中，在被接入端接收在本地配置白名单的配置指令之后，所述方法还包括：
    所述服务端接收第二配置指令，其中，所述第二配置指令用于配置供用户查看和/或更新所述服务端的IP的管理界面。
  6. 一种安全认证的装置，应用于被接入端侧，包括：
    第一接收模块，设置为接收用于在本地配置白名单的第一配置指令，其中，所述白名单中存储有允许与所述被接入端建立连接的用于标识接入端的标识；
    判断模块，设置为在接入端接入所述被接入端之前，判断所述接入端的标识是否与所述白名单的标识匹配；
    建立模块，设置为在判断结果为是时，允许所述接入端与所述被接入端建立连接。
  7. 根据权利要求6所述的装置，其中，所述装置还包括：
    禁止模块，设置为在判断结果为否时，禁止所述接入端建立连接，并上报告警消息。
  8. 根据权利要求6或7所述的装置，其中，在所述被接入端为大数据平台内部的主节点，所述接入端为所述大数据平台内部的次节点时，所述用于标识次节点的标识为所述次节点的主机名。
  9. 根据权利要求6或7所述的装置，其中，在所述被接入端为大数据平台中的服务端，所 述接入端为所述大数据平台中的客户端时，所述用于标识客户端的标识为所述服务端的IP。
  10. 根据权利要求9所述的装置，其中，所述装置还包括：
    第二接收模块，设置为在被接入端接收在本地配置白名单的配置指令之后，接收第二配置指令，其中，所述第二配置指令用于配置供用户查看和/或更新所述服务端的IP的管理界面。
PCT/CN2016/075242 2015-09-15 2016-03-01 安全认证的方法及装置 WO2016177051A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510586540.7 2015-09-15
CN201510586540.7A CN106533688A (zh) 2015-09-15 2015-09-15 安全认证的方法及装置

Publications (1)

Publication Number Publication Date
WO2016177051A1 true WO2016177051A1 (zh) 2016-11-10

Family

ID=57217481

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/075242 WO2016177051A1 (zh) 2015-09-15 2016-03-01 安全认证的方法及装置

Country Status (2)

Country Link
CN (1) CN106533688A (zh)
WO (1) WO2016177051A1 (zh)

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109032520A (zh) * 2018-07-24 2018-12-18 郑州云海信息技术有限公司 一种控制方法及装置
CN113158169A (zh) * 2021-03-30 2021-07-23 北京大米科技有限公司 一种基于Hadoop集群的验证方法、装置、存储介质及电子设备

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102833815A (zh) * 2012-08-21 2012-12-19 南京智达康无线通信科技股份有限公司 一种ac对ap连接的控制方法
JP5497942B1 (ja) * 2013-05-29 2014-05-21 春佳 西守 コンピュータプログラム
CN104811441A (zh) * 2015-03-31 2015-07-29 郭威 一种大数据采集与处理的方法和系统

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102833815A (zh) * 2012-08-21 2012-12-19 南京智达康无线通信科技股份有限公司 一种ac对ap连接的控制方法
JP5497942B1 (ja) * 2013-05-29 2014-05-21 春佳 西守 コンピュータプログラム
CN104811441A (zh) * 2015-03-31 2015-07-29 郭威 一种大数据采集与处理的方法和系统

Also Published As

Publication number Publication date
CN106533688A (zh) 2017-03-22

Similar Documents

Publication Publication Date Title
US9692743B2 (en) Securing organizational computing assets over a network using virtual domains
US9838398B2 (en) Validating the identity of an application for application management
CN112422532B (zh) 业务通信方法、系统、装置及电子设备
US10341325B2 (en) System and method for transferring device identifying information
US8893300B2 (en) Security systems and methods to reduce data leaks in enterprise networks
US20160261607A1 (en) Techniques for identity-enabled interface deployment
US10148637B2 (en) Secure authentication to provide mobile access to shared network resources
DE112007000618T5 (de) Hierarchischer, auf Vertrauen basierender Stellungsbericht und Strategiedurchsetzung
US20140122716A1 (en) Virtual private network access control
US10270759B1 (en) Fine grained container security
CA3100647A1 (en) Identity management for software components through dynamic certificate requested based on a one-time certificate
US20210144138A1 (en) Authority transfer system, server and method of controlling the server, and storage medium
EP2795522B1 (en) Techniques to store secret information for global data centers
WO2016177051A1 (zh) 安全认证的方法及装置
WO2006069901A1 (en) Method and system for providing and utilizing a network trusted context
US20220311777A1 (en) Hardening remote administrator access
Gkotsis Creating a Windows Active Directory Lab and Performing Simulated Attacks
KR101415403B1 (ko) 공유 가능한 보안공간 제공시스템 및 그 방법
CN118018248A (zh) 访问控制方法、系统、电子设备及存储介质
CN116112214A (zh) 跨网路边界的资源访问方法、装置和电子设备
CN117353947A (zh) 一种应用于网关服务的鉴权方法和系统
JP2010122798A (ja) エージェントアクセス管理システム
GB2588552A (en) File execution

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16789045

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 16789045

Country of ref document: EP

Kind code of ref document: A1