sqrrl november webinar: encryption and security in accumulo

Securely explore your data

ENCRYPTION AND SECURITY IN ACCUMULO AND SQRRL

Michael Allen Security Architect Sqrrl Data, Inc. [email protected]

ISN’T ACCUMULO ALREADY SECURE?

© 2013 Sqrrl | All Rights Reserved | Proprietary and Confidential

I MEAN, THESE SMART GALS AND GUYS MADE IT…


(Undisclosed location)

Sou

rce:

wik

iped

ia.o

rg.

Pub

lic d

omai

n

CELL-LEVEL SECURITY


WHAT’S THE THREAT?


A TYPICAL DEPLOYMENT


A TYPICAL DEPLOYMENT


(…ignoring master nodes, name nodes, garbage collectors, other ephemera…)

A TYPICAL CAST


THREATS INSIDE AND OUT


WHO CAN WE PUSH OUT?


HOW?


ENCRYPTION


IN MOTION AND AT REST


IT’S NOT…


Sou

rce:

http

://bi

t.ly/

HqS

cSr.

Cre

ativ

e C

omm

ons,

A

ttrib

utio

n.

FUNDAMENTAL QUESTIONS

What are you encrypting?

How are you encrypting it?

How are you protecting the key?


ACCUMULO 1.6

SSL for Accumulo Clients

Encrypting data within HDFS


SSL AND ACCUMULO


ACCUMULO-1009

Patch that adds configuring and using SSL certificates

MAKE YOUR CERTS


CONFIGURE YOUR SERVERS


DISTRIBUTE YOUR CERTS


DISTRIBUTE YOUR ROOTS


ENJOY YOUR SSL


ENCRYPTION AT REST


ACCUMULO-998

Patch that adds encryption for Rfiles and WAL

ENCRYPTION AT REST


Uses Java Cryptography Extensions (JCE) for encryption

interface / engine

(Guess what? It’s pluggable.)

BEHIND THE SCENES


WHERE DOES THAT KEY GO?


PLUGGABLE STRATEGY


•  Java class that mediates access to KEK

•  Encrypts and decrypts per-file keys

•  Passes back to callers opaque ID to identify KEK used to do encryption

•  Callers should store opaque ID along with encrypted key

PLUGGABLE STRATEGY


CONFIGURATION OPTIONS


Property Name “Usual” Value Meaning

!"#$%&'(&)*+,'!+-../ &"0'-$-!1,'-!!*(*+&'/!&",'.,!*"2%#'!"#$%&'/3,4-*+%5"#$%&6&)*+,/

The class that creates encrypting and decrypting data streams

!"#$%&'!2$1,"'.*2%, 789:5;<:=>59?=-))2@0/ Encryption algorithm spec

!"#$%&'!2$1,"'A,#'+,@0%1 BCD/ Key length

!"#$%&'(&)*+,'!+-../ &"0'-$-!1,'-!!*(*+&'/!&",'.,!*"2%#'!"#$%&'/3,4-*+%9,!",%E>,#8@!"#$%2&@9%"-%,0#/

Class that mediates access to KEK

REDUCED THREAT


TOWARDS THE FUTURE



THANKS! [email protected]

sqrrl november webinar: encryption and security in accumulo

Data & Analytics