[
https://issues.apache.org/jira/browse/HDFS-6134?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14097687#comment-14097687
]
Sanjay Radia commented on HDFS-6134:
------------------------------------
Soem thoughts on the Har use cases and possible outcomes:
1) Har a subtree and the subtree contains an EZ.
2) Har a subtree rooted at the EZ
3) Har a subtree within an EZ
Typically the subtree is replaced by the har itself, though not required. The
Har is read only.
The operation can be performed by an admin or by a user.
Use case 1 - copy the raw files and the keys into the HAR (ie the files inside
the HAR remain encrypted). When files are accessed from the Har filesystem the
same machinery as for HDFS EZ should come to play to allow transparent
decryption of the files. A user with no KMS permission will not be able to
decrypt. Someone with read access to the HAR will be able to get to the raw
files and their keys (how does this compare to the normal HDFS EZ?)
Use case 2 - same as 1.
Use case 3. If the har is copied elsewhere (ie it does not replace the
subtree) then same as 1. If it does replace subtree the HAR will be encrypted
once again (ie double encryption).
> Transparent data at rest encryption
> -----------------------------------
>
> Key: HDFS-6134
> URL: https://issues.apache.org/jira/browse/HDFS-6134
> Project: Hadoop HDFS
> Issue Type: New Feature
> Components: security
> Affects Versions: 3.0.0, 2.3.0
> Reporter: Alejandro Abdelnur
> Assignee: Charles Lamb
> Attachments: HDFS-6134.001.patch, HDFS-6134.002.patch,
> HDFS-6134_test_plan.pdf, HDFSDataatRestEncryption.pdf,
> HDFSDataatRestEncryptionProposal_obsolete.pdf,
> HDFSEncryptionConceptualDesignProposal-2014-06-20.pdf
>
>
> Because of privacy and security regulations, for many industries, sensitive
> data at rest must be in encrypted form. For example: the healthÂcare industry
> (HIPAA regulations), the card payment industry (PCI DSS regulations) or the
> US government (FISMA regulations).
> This JIRA aims to provide a mechanism to encrypt HDFS data at rest that can
> be used transparently by any application accessing HDFS via Hadoop Filesystem
> Java API, Hadoop libhdfs C library, or WebHDFS REST API.
> The resulting implementation should be able to be used in compliance with
> different regulation requirements.
--
This message was sent by Atlassian JIRA
(v6.2#6252)
