CN104092733B - A kind of credible distributed file system based on HDFS - Google Patents

Abstract

The credible distributed file system based on HDFS that the invention discloses a kind of, including remote proving module and data seal modules, the remote proving module include：Based on the remote proving module of integrity measurement framework IMA, remote procedure call remote proving module connects remote proving module with socket；The seal data module includes progress data seal modules after remote proving failure.The beneficial effects of the invention are as follows credible and secure mechanism is added in HDFS distributed file systems, so that carrying out the credibility for being able to confirm that interactive object when data interaction between entity node, system connection untrusted address can be prevented after system integrity is destroyed, being sealed to data after remote proving failure ensures that data are not leaked.

Description

A Trusted Distributed File System Based on HDFS

technical field

The invention relates to the field of trusted computing, in particular to a trusted distributed file system based on HDFS.

Background technique

Due to the rapid development and widespread popularization of information technology in recent years, a large amount of data has grown exponentially, and large companies such as Google, Yahoo, and Amazon are facing the challenge of massive data. Google took the lead in launching the Google file system GFS and MapReduce to deal with the storage and processing of massive data, which attracted widespread attention and quickly gave birth to an open source version called Hadoop. After rapid development in recent years, Hadoop has become an important part of the basic computing platform of Internet companies. It has its own customized versions in domestic large enterprises such as Tencent, Baidu, and Alibaba, as well as large foreign enterprises such as Twitter and Facebook. . Hadoop is specially designed for offline processing and large-scale data analysis. In the transaction of writing once and reading multiple times, Hadoop is widely supported and applied in Internet enterprises because of its efficient implementation and stable performance.

With the vigorous development of cloud computing, many key issues have also been encountered, especially security issues. Hadoop's distributed storage system is called Hadoop Distributed File System, or HDFS for short, which consists of name nodes, second name nodes, data nodes, and DFS clients and other entity nodes. The name node stores the namespace image fsimage and edit log edits of the distributed file system, and maintains the file system tree and all files and directories in the entire tree in memory. The data node is the place where the data block is actually stored. The default number of copies of the data block is 3. When reading and writing the data block, it will be synchronized between the copies. The second name node is responsible for merging the namespace image fsimage and the edit log edits, and passing the merged data back to the name node. The DFS client is an object of the DistributedFilesystem. HDFS applications generally obtain a DistributedFilesystem to interact with HDFS, and the DFS client is the object that actually interacts with the name node and the data node. These multiple physical nodes frequently perform interactive operations such as remote procedure calls, TCP streaming data transmission, and HTTP streaming data transmission. How to ensure that these data interactions are safe and reliable has gradually attracted attention. Since Hadoop is deployed on a LAN within the firewall, the security mechanism added after version 1.0 is mainly used to better assist the collaboration of multiple users in the LAN. However, after the Advanced Persistent Attack became popular, the security barrier provided by the firewall gradually became inadequate.

At present, many methods and ideas have emerged to solve cloud computing security issues. Applying trusted computing technology to the cloud computing environment to solve the security problems encountered in cloud computing applications is a hot spot in the field of cloud computing security research. The purpose of trusted computing is to protect the most sensitive information, such as private and symmetric keys, from being stolen or used by malicious code. Contrary to Hadoop's assumption that the environment is inside a secure firewall, trusted computing assumes that the software can be compromised during use and that sensitive keys will be protected when an attack occurs. The Trusted Platform Module (TPM) defined by the Trusted Computing Group (Trusted Computing Group, TCG) is a new embedded security subsystem placed in a computer. The TCG chip mainly uses the public key authentication function, the integrity measurement function and the remote attestation function to achieve the purpose of protecting the terminal security. By checking the change of PCR measurement value, the platform with TPM can detect the existence of malicious programs such as spyware and Trojan horse, and after finding malicious code, the platform will order the TPM to refuse the decryption operation of sensitive data or use the private key to sign or decrypt operation. Since the private key of the TPM owner will not be leaked, any malicious attempt to obtain the private key is infeasible.

Contents of the invention

Based on the background of the rapid popularization of distributed systems and trusted computing technology, the present invention studies the integration of trusted computing technology into distributed systems to solve the security problems of distributed systems, and proposes the use of trusted computing technology, especially remote certification technology and data sealing technology to solve the security problem of the distributed file system, the specific technical solution is as follows.

Technical scheme of the present invention is:

A trusted distributed file system based on HDFS, including a remote attestation module and a data sealing module, the remote attestation module includes: a remote attestation module based on integrity measurement architecture IMA, used for remote attestation of platform status between entity nodes , to verify the integrity of the platform; the remote procedure call remote certification module is used to perform remote certification when establishing a remote procedure call connection between HDFS entity nodes to ensure the integrity of the platform state of the remote procedure call initiator; the socket connection remote The certification module is used for remote certification of entity nodes when connecting to untrusted addresses to avoid platform data leakage. The data sealing module is used to seal the data after the remote certification fails, seal the symmetric key through the PCR value, and encrypt the data with the symmetric key, so that the data can only be decrypted in a trusted platform state , so as to ensure that the data is not leaked.

Further, in the above solution, the remote procedure call remote certification module performs the following steps: first, the remote procedure call applicant initiates a socket connection request to the remote procedure call port of the remote procedure call server, and after the remote procedure call server accepts the connection, The remote procedure call requester sends the remote procedure call header and the random number n encrypted with the server public key, and the remote procedure call server uses the private key to decrypt the random number n, and then sends the value of the platform status register PCR10, the random number n and the metric list back to applicants. After verifying the received data, the applicant determines whether the other party is in a trusted platform state, that is, confirms the integrity of the other party's platform state.

The socket connection remote procedure call module carries out the following steps: first, the user process initiates a socket connection system call connect and imports the connection address as a parameter, and then judges whether the connection address is in the trusted address list in the system call, if If not, it is judged whether the trusted agent process is started, and if it is started, the connection address is sent to the trusted agent process, otherwise an error is returned directly.

The described data sealing module carries out the following steps: first process remote certification, if the remote certification is successful, then generate a pair of AES keys and use the designated platform status register PCR to seal the key process data, and export the sealed data to the disk. If the remote attestation fails, the data is encrypted using a key and the key is discarded after the encryption is complete.

Remote attestation is based on the static metric list of the Integrity Metric Architecture IMA.

Data sealing can seal the AES key and use the AES key to encrypt the data, avoiding the efficiency reduction caused by directly using the RSA key to encrypt the data.

In the present invention, the process of remote certification is added before the normal communication and interaction between entity nodes and entity nodes, and only when the entity node to be communicated is trusted through remote certification and dynamic measurement, data interaction is allowed. In the present invention, when the entity node performs a socket connection system call, if the connection address is not a trusted address, remote certification will be performed, and the socket connection will be allowed only if the remote certification passes, so as to avoid the integrity of the entity node being damaged and then transmitting data to Intruder machine. After the remote certification fails, the invention seals the data on the entity node to avoid data leakage. On the one hand, the present invention can carry out remote certification for each entity, and on the other hand, it can also prevent the socket from connecting to an untrusted address after the system integrity is destroyed, so as to avoid data leakage, and at the same time, it can seal the data after the remote certification fails. Finally, a practical and feasible trusted distributed file system will be realized.

Compared with the prior art, the beneficial effects of the present invention are: 1. After the failure of traditional binary remote proof, a data sealing mechanism is added to protect the security of data; 2. Remote proof and data sealing mechanism are added in the remote procedure call, so The physical nodes interacting in the distributed file system all obtain the integrity measurement framework IMA and the trusted guarantee provided by TPM; 3. In the process of socket connection, remote proof is added when connecting to an untrusted address operation, so as to ensure that intruders cannot connect to the attacker server through the network and directly transmit local data to the attacker server. 4. On the basis of the trusted distributed file system, a network disk application is designed and implemented. This application can customize further security for the characteristics of the trusted distributed file system.

Description of drawings

Fig. 1 is a schematic diagram of the composition of the present invention;

Figure 2 is a design diagram of the IMA-based platform state remote proof module;

Fig. 3 is the design diagram of the remote procedure call remote certification module;

Fig. 4 is the design diagram of the socket connection remote certification module;

Figure 5 is a design diagram of the data sealing module.

Detailed ways

The present invention will be further described below in conjunction with the accompanying drawings, but the implementation and protection of the present invention are not limited thereto. If there are any unspecified symbols or processes below, those skilled in the art can refer to the prior art.

Embodiment one

As shown in Figure 1, a design of a trusted distributed file system based on HDFS includes a remote certification module and a data sealing module. The activation certificate for establishing a connection with the applicant provides the applicant with a valid TPM certificate; the remote procedure call remote certification module is used to perform remote certification when establishing a remote procedure call connection between HDFS entity nodes to ensure that the remote procedure call initiator The integrity of the platform state; the socket connection remote certification module is used for remote certification when the entity node connects to an untrusted address to avoid platform data leakage. The data sealing module is used to seal the data after the remote certification fails, seal the symmetric key through the PCR value, and encrypt the data with the symmetric key, so that the data can only be decrypted in a trusted platform state , so as to ensure that the data is not leaked.

As shown in Figure 2, the remote attestation module based on the integrity measurement architecture IMA includes two parts: the challenger and the authenticatee. and the value of the platform status register PCR10 are digitally signed and returned to the challenger. The challenger encrypts the data with the public key of the identity key of the authenticatee and verifies whether the random number is correct. Then the authenticated person sends the metric list maintained by the integrity metric framework. The challenger verifies whether the value of PCR10 is consistent by simulating the operation of the PCR extended metric list. If it is consistent, it means that the metric list has not been tampered with. Check whether the metric value is legal by traversing the metric list. If Both legal rules indicate that the platform integrity of the authenticated party has not been destroyed, and return the measurement result.

As shown in Figure 3, the remote procedure call remote certification module includes a remote procedure call client and a remote procedure call server, and the remote procedure call applicant initiates a socket connection request to the remote procedure call port of the remote procedure call server, and the remote procedure call After the procedure call server accepts the connection, the remote procedure call applicant sends the remote procedure call header and the random number n encrypted with the server public key, and the remote procedure call server uses the private key to decrypt the random number n, and then sends the value of the platform status register PCR10, The random number n and the list of metrics are returned to the applicant. After verifying the received data, the applicant determines whether the other party is in a trusted platform state, that is, confirms the integrity of the other party's platform state.

As shown in Figure 4, the socket connection remote procedure call includes the following steps: first, the user process initiates the socket connection system call connect and passes in the connection address as a parameter, and then judges whether the connection address is in the credible In the address list, if not, it is judged whether the trusted agent process is started, and if it is started, the connection address is sent to the trusted agent process, otherwise an error is returned directly. The trusted address list includes eleven local addresses including INADDR_ANY and INADDR_LOCALHOST, as well as IP addresses of other interactive machines in the cluster. The sending of the connection address to the trusted agent uses Netlink as a data interaction method between the kernel and the user. The tPid represents the process ID of the trusted proxy process, which is initialized to -1 when the system is started, and initialized to the process ID of the trusted proxy process after the trusted proxy process is started. The ERR means that the system call returned an error value.

As shown in Figure 5, the described data sealing module comprises the following steps: first process remote certification, if the remote certification is successful, then generate a pair of AES keys and use the specified platform status register PCR to seal the key process data, and export the sealing data to disk. If the remote attestation fails, the data is encrypted using a key and the key is discarded after the encryption is complete.

Claims (3)

1. a kind of credible distributed file system based on HDFS, including remote proving module and data seal modules, feature It is

The remote proving module includes：

Remote procedure call remote proving module carries out verifying completeness of platform when carrying out communication interaction for entity node；

Based on the remote authentication module of integrity measurement framework IMA, for carrying out platform status remote proving between entity node, Verification platform integrality；The remote procedure call remote proving module is specifically used for realizing following process：Remote process first Applicant is called to initiate socket connection request, remote process tune to the remote procedure call port of remote procedure call server After receiving connection with server, remote procedure call applicant is sent remote procedure call header and is added using server public key Close random number n sends platform status register after remote procedure call server obtains random number n using private key decryption Applicant is returned in the value of PCR10, random number n and measurement list；After applicant verifies reception data, other side is determined It whether is in believable platform status, that is, confirms the platform status integrality of other side；

Socket connect remote proving module, for entity node to untrusted address carry out socket connection system call when into Row verifying completeness of platform；

After the seal data module carries out remote proving failure for entity node, seal data is carried out to platform data；

The remote authentication module based on integrity measurement framework IMA is specifically used for realizing following process：Challenger sends out first Send random number to the person of being certified, the person of being certified carries out the value of random number and platform status register PCR10 by identity key Challenger is returned to after digital signature；Challenger is decrypted data using the identity key public key for the person of being certified, and verifies Whether random number is correct；It is not then certified person and sends the measurement list that integrity measurement framework is safeguarded, challenger is by simulating PCR Whether the value of extension measurement list operation verification PCR10 is consistent, if consistent illustrate that measuring list is not tampered with, and passes through traversal Measurement list checks whether metric is legal, illustrates that the completeness of platform for the person of being certified is not destroyed if all legal, and Return to measurement results；The socket connection remote proving module is specifically used for realizing following process：Consumer process is sent out first It plays socket connection system to call connect and be passed to link address as parameter, then judges link address in system calling Whether in credible address list, if not then judging whether trusted agent process starts, connection ground is sent if starting Trusted agent process is given in location, otherwise directly returns to mistake；

The seal data module is specifically used for realizing following process：Remote proving is carried out first, if remote proving success It then generates a pair of of AES key and using specifying platform status register PCR to seal key process data, sealing data is exported Onto disk；If remote proving fails, it is encrypted using data key, and the key is abandoned after the completion of encryption.

2. the credible distributed file system according to claim 1 based on HDFS, it is characterised in that：The platform status Remote proving is the staticametric result based on IMA integrity measurement frameworks.

3. the credible distributed file system according to claim 1 based on HDFS, it is characterised in that：The long-range card Bright module and data seal modules can effectively defend high-order duration to threaten APT.