[jira] [Commented] (HDFS-6134) Transparent data at rest encryption

[Yi Liu (JIRA)]

    [ 
https://issues.apache.org/jira/browse/HDFS-6134?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14029148#comment-14029148
 ] 

Yi Liu commented on HDFS-6134:
------------------------------

Hi [~tucu00] and [~owen.omalley], I agree with getting key material on the 
client side instead of via the NN. 
If in this way, we need to do authorization in KMS to check correct user 
accessing key, right? The authorization in KMS could be simple, we can specify 
users/groups accessing right for the key of  encryption zone through 
configuration or command line.

Furthermore, agree with the proposal of adding {{getDelegationToken(String 
renewer)}} method in {{KeyProvider}} interface.

> Transparent data at rest encryption
> -----------------------------------
>
>                 Key: HDFS-6134
>                 URL: https://issues.apache.org/jira/browse/HDFS-6134
>             Project: Hadoop HDFS
>          Issue Type: New Feature
>          Components: security
>    Affects Versions: 2.3.0
>            Reporter: Alejandro Abdelnur
>            Assignee: Alejandro Abdelnur
>         Attachments: HDFSDataAtRestEncryption.pdf
>
>
> Because of privacy and security regulations, for many industries, sensitive 
> data at rest must be in encrypted form. For example: the health­care industry 
> (HIPAA regulations), the card payment industry (PCI DSS regulations) or the 
> US government (FISMA regulations).
> This JIRA aims to provide a mechanism to encrypt HDFS data at rest that can 
> be used transparently by any application accessing HDFS via Hadoop Filesystem 
> Java API, Hadoop libhdfs C library, or WebHDFS REST API.
> The resulting implementation should be able to be used in compliance with 
> different regulation requirements.



--
This message was sent by Atlassian JIRA
(v6.2#6252)