[
https://issues.apache.org/jira/browse/HDFS-6134?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14096027#comment-14096027
]
Sanjay Radia edited comment on HDFS-6134 at 8/13/14 8:19 PM:
-------------------------------------------------------------
Alejandro, a potential solution: treat user "hdfs" as a special user such that
the HDFS system will NOT accept any client connections from "hdfs". An Admin
will not be able to connect as user "hdfs" but can connect as user, say,
"ClarkKent" where "ClarkKent" is in the superuser group of hdfs so that the
admin can do his job as superuser. It does means that we are trusting the HDFS
code to be correct in not abusing its access to keys since it has proxy
authority with KMS (this was not required so far.)
was (Author: sanjay.radia):
Alejandro, if we treat user "hdfs" as a special user such that the HDFS system
will not accept any client connections from "hdfs" then does this solve this
problem?. An Admin will not be able to connect as user "hdfs" but can connect
as user "ClarkKent" where "ClarkKent" is in the superuser group of hdfs so
that the admin can do his job as superuser. It does means that we are trusting
the HDFS code to be correct in not abusing its access to keys since it has
proxy authority with KMS (this was not required so far.)
> Transparent data at rest encryption
> -----------------------------------
>
> Key: HDFS-6134
> URL: https://issues.apache.org/jira/browse/HDFS-6134
> Project: Hadoop HDFS
> Issue Type: New Feature
> Components: security
> Affects Versions: 3.0.0, 2.3.0
> Reporter: Alejandro Abdelnur
> Assignee: Charles Lamb
> Attachments: HDFS-6134.001.patch, HDFS-6134.002.patch,
> HDFS-6134_test_plan.pdf, HDFSDataatRestEncryption.pdf,
> HDFSDataatRestEncryptionProposal_obsolete.pdf,
> HDFSEncryptionConceptualDesignProposal-2014-06-20.pdf
>
>
> Because of privacy and security regulations, for many industries, sensitive
> data at rest must be in encrypted form. For example: the healthÂcare industry
> (HIPAA regulations), the card payment industry (PCI DSS regulations) or the
> US government (FISMA regulations).
> This JIRA aims to provide a mechanism to encrypt HDFS data at rest that can
> be used transparently by any application accessing HDFS via Hadoop Filesystem
> Java API, Hadoop libhdfs C library, or WebHDFS REST API.
> The resulting implementation should be able to be used in compliance with
> different regulation requirements.
--
This message was sent by Atlassian JIRA
(v6.2#6252)
