Accumulo Summit 2014: Accumulo Visibility Labels and Pluggable Authorization Systems: A Love Story

Securely explore your data
Accumulo Visibility Labels
and
Pluggable Authorization Systems:
A Love Story
John Vines
Engineer
Sqrrl Data, Inc.
john@sqrrl.com

WHAT MAKES
ACCUMULO SPECIAL
WHEN IT COMES TO
SECURITY?
© 2014 Sqrrl | All Rights Reserved | Proprietary and Confidential

CELL-LEVEL SECURITY

tldr;
visibilities are like ACLs
CELL-LEVEL SECURITY

tldr;
visibilities are like ACLs
...sort of
CELL-LEVEL SECURITY

THAT’S GREAT!
What does it get me?

THAT’S GREAT!
What does it get me?
Amalgamating data sources that are
segregated

THE SCENARIO:
I am a first time Accumulo user
I want to use it’s nifty features
I have no idea what I’m doing

FIRST TRY
Scan without JohnsLabel

FIRST TRY
*sad trombone*
Scan with JohnsLabel

FIRST TRY
*sad trombone*
Scan with JohnsLabel
row1 colf1:colq1 JohnsLabel

SECOND TRY
row1 colf1:colq1 JohnsApplication

SECOND TRY
What does my label even mean?

THIRD TRY
row1 colf1:colq1 application1|application2
row1 colf2:colq1 application1

THIRD TRY
What about analytic4?
analytic5? 6?
row1 colf1:colq1 application1|application2

BACK TO THE DRAWING BOARD
What am I trying to accomplish?
Why am I segregating my data?

FOURTH TRY
row1 colf1:colq1 org1|org2
row1 colf2:colq1 org1
row4 colf4:colq2 org1&org2

FOURTH TRY
Organizations are big!
row1 colf1:colq1 org1|org2
row4 colf4:colq2 org1&org2

FIFTH TRY
row1 colf1:colq1 subOrg1|subOrg2
row1 colf2:colq1 subOrg1
row4 colf4:colq2 subOrg1&subOrg2
What about if subOrgs change?

FIFTH TRY
What about if subOrgs change?
Why do these orgs have permission?
row1 colf1:colq1 subOrg1|subOrg2
row4 colf4:colq2 subOrg1&subOrg2

SIXTH TRY
row1 colf1:colq1 accountsReceivable|payroll
row1 colf2:colq1 accountsReceivable
row2 colf1:colq3 payroll
row4 colf4:colq2 accountsReceivable&payroll
Looks good!

SIXTH TRY
Looks good!
But now I need to manage users!
row1 colf1:colq1 accountsReceivable|payroll
row1 colf2:colq1 accountsReceivable
row4 colf4:colq2 accountsReceivable&payroll

PLUGGABLE SECURITY TO THE RESCUE

okay… what is this?

tserver
scan
Pluggable
Authorizor
getAuths()
scan

tserver
scan
Pluggable
Authorizor
getAuths()
scan
Now we can use our existing system!

SEVENTH TRY
LDAP’s role-based access says:
User1->HR
User2->InternalConflicts
User3->Payroll
User4->Taxes

SEVENTH TRY
One less system to maintain!
User1->HR
User3->Payroll
User4->Taxes

SEVENTH TRY
One less system to maintain!
But our orgs are hierarchical!
User1->HR
User3->Payroll
User4->Taxes

EIGHTH TRY
Authorizor Says:
InternalConflicts->InternalConflicts,HR
Payroll->Payroll,Finance
Taxes->Finance,AccountsReceivable

EIGHTH TRY
But what if I don’t want a certain org to
get a piece of data?
Authorizor Says:
InternalConflicts->InternalConflicts,HR
Payroll->Payroll,Finance
Taxes->Finance,AccountsReceivable

What if I don’t want a certain org to get
a piece of data?

NINTH TRY
row5 colf1:colq3 designer&!manager

NINTH TRY
Accumulo does not support NOTs

NINTH TRY
Accumulo does not support NOTs
What are we trying to accomplish?

TENTH TRY
row5 colf1:colq3 designer&(worker&contractor)

TENTH TRY
But I want others to know some part of
row5 colf1:colq!

REMEMBER

ELEVENTH TRY
row5 colf1:colq3 engineer&(worker&contractor)

ELEVENTH TRY
But I still want the managers to know
that row5 colf1:colq3 exists!

TWELTH TRY
row5 colf1:colq3

TWELTH TRY
How can root look at everything?
row5 colf1:colq3

THIRTEENTH TRY
row5 colf1:colq3
row5 colf1:colq3
root|(designer&(worker&contractor))
row5 colf1:colq3
root|(engineer&(worker&contractor))

THIRTEENTH TRY
I don’t like that...
row5 colf1:colq3
row5 colf1:colq3
root|(designer&(worker&contractor))
row5 colf1:colq3
root|(engineer&(worker&contractor))

THIRTEENTH TRY 2
Remember the pluggable Authorizor!
LDAP knows all roles
root->all roles

THIRTEENTH TRY 2
All of my bases are covered!
Except...
LDAP knows all roles
root->all roles

GETTING CRAFTY
What if I want to:
● Allow authorizations based on time
● Allow authorizations based on location
● Make data more available
● Make data less available

BEING CRAFTY
If you have the data available, you can use
it!

BEING CRAFTY
If you have the data available, you can use
it!
Just remember- visibility labels are
filters. They’re not made for restricting
entire tables.

FOURTEENTH TRY
Accumulo Tables have Read permissions
for coarse access!

FOURTEENTH TRY
Accumulo Tables have Read permissions
for coarse access!
Can we do it to people who are missing
certain labels?

Looks familiar…
what is this?

tserver
scan
Pluggable PermissionHandler
hasTablePermission()
scan

tserver
scan
Pluggable PermissionHandler
hasTablePermission()
scan
Now we can use our existing system
for coarse access!

RECAP
● Label for the data, not the users
● Label with the highest granularity
possible
● Let the pluggable security do the rest of
the work
● Need to rely on external services or
special processes for tracking labels
● These can manage users authorizations
and general access

RECAP
Cell level security boils down to two
separate components
● Data labels
● User granted labels
They are the two halves that establish cell
level security.

RECAP
Cell level security boils down to two
separate components
● Data labels
● User granted labels
They are the two halves that establish cell
level security. Put the two together, and
magic happens.

QUESTIONS?
@ohshazbot
john@sqrrl.com
ACCUMULO VISIBILITY LABELS AND PLUGGABLE
AUTHORIZATION:
A LOVE STORY

Accumulo Summit 2014: Accumulo Visibility Labels and Pluggable Authorization Systems: A Love Story

More Related Content

Similar to Accumulo Summit 2014: Accumulo Visibility Labels and Pluggable Authorization Systems: A Love Story (20)

Recently uploaded (20)

Accumulo Summit 2014: Accumulo Visibility Labels and Pluggable Authorization Systems: A Love Story