Download - Accumulo Security and Encryption

Securely explore your data

ENCRYPTION AND SECURITY IN ACCUMULO

Michael Allen

Security Architect

Sqrrl Data, Inc.

[email protected]

© 2013 Sqrrl | All Rights Reserved | Proprietary and Confidential

ISN’T ACCUMULO ALREADY SECURE?


I MEAN, THESE SMART GALS AND GUYS MADE IT…

(Undisclosed location)

So

urc

e:

wik

ipe

dia

.org

. P

ub

lic d

om

ain


CELL-LEVEL SECURITY


WHAT’S THE THREAT?


A TYPICAL DEPLOYMENT


A TYPICAL DEPLOYMENT

(…ignoring master nodes, name nodes,garbage collectors, other ephemera…)


A TYPICAL CAST


THREATS INSIDE AND OUT


WHO CAN WE PUSH OUT?


HOW?


ENCRYPTION


IN MOTION AND AT REST


IT’S NOT…

So

urc

e:

htt

p:/

/bit.

ly/H

qS

cSr.

Cre

ativ

e C

om

mo

ns,

A

ttrib

utio

n.

http://bit.ly/HqScSr


FUNDAMENTAL QUESTIONS

What are you encrypting?

How are you encrypting it?

How are you protecting the key?


ACCUMULO 1.6

SSL for Accumulo Clients

Encrypting data within HDFS


SSL AND ACCUMULO

ACCUMULO-1009

Patch that adds configuring and using SSL certificates

https://issues.apache.org/jira/browse/ACCUMULO-1009


MAKE YOUR CERTS


CONFIGURE YOUR SERVERS


DISTRIBUTE YOUR CERTS


DISTRIBUTE YOUR ROOTS


ENJOY YOUR SSL


ENCRYPTION AT REST

ACCUMULO-998

Patch that adds encryption for Rfiles and WAL

https://issues.apache.org/jira/browse/ACCUMULO-998


ENCRYPTION AT REST

Uses Java Cryptography Extensions (JCE) for encryption

interface / engine

(Guess what? It’s pluggable.)


BEHIND THE SCENES


WHERE DOES THAT KEY GO?


WHERE DOES THAT KEY GO?

???


PLUGGABLE STRATEGY

• Java class that mediates access to KEK

• Encrypts and decrypts per-file keys

• Passes back to callers opaque ID to identifyKEK used to do encryption

• Callers should store opaque ID along withencrypted key


PLUGGABLE STRATEGY


CONFIGURATION OPTIONSProperty Name “Usual” Value Meaning

crypto.module.class org.apache.accumulo.core.security.crypto.DefaultCryptoModule

The class that creates encrypting and decrypting data streams

crypto.cipher.suite AES/CFB/PKCS5Padding Encryption algorithm spec

crypto.cipher.key.length

128 Key length

crypto.module.class org.apache.accumulo.core.security.crypto.DefaultSecret-KeyEncryptionStrategy

Class that mediates access to KEK


REDUCED THREAT


TOWARDS THE FUTURE


[email protected]

Download - Accumulo Security and Encryption

Top Related