Security Hardening

Updated on 2022-08-12 GMT+08:00

View PDF

MRS is a platform for massive data management and analysis and has high security. MRS protects user data and service running from the following aspects:

Network isolation
The entire system is deployed in a VPC on the public cloud to provide an isolated network environment and ensure service and management security of the cluster. By combining the subnet division, route control, and security group functions of VPC, MRS provides a secure and reliable isolated network environment.
Resource isolation
MRS supports resource deployment and isolation of physical resources in dedicated zones. You can flexibly combine computing and storage resources, such as dedicated computing resources + shared storage resources, shared computing resources + dedicated storage resources, and dedicated computing resources + dedicated storage resources.
Host security
MRS can be integrated with public cloud security services, including Vulnerability Scan Service (VSS), Host Security Service (HSS), Web Application Firewall (WAF), Cloud Bastion Host (CBH), and Web Tamper Protection (WTP). The following measures are provided to improve security of the OS and ports:
- Security hardening of OS kernels
- OS patch update
- OS permission control
- OS port management
- OS protocol and port attack defense
Application security
The following measures are used to ensure normal running of big data services:
- Identification and authentication
- Web application security
- Access control
- Audit security
- Password security
Data security
The following measures are provided to ensure the confidentiality, integrity, and availability of massive amounts of user data:
- Disaster recovery: MRS supports data backup to OBS and cross-region high reliability.
- Backup: MRS supports backup of DBService, NameNode, and LDAP metadata and backup of HDFS and HBase service data.
Data integrity
Data is verified to ensure its integrity during storage and transmission.
- CRC32C is used by default to verify the correctness of user data stored in HDFS.
- DataNodes of HDFS store the verified data. If the data transmitted from a client is abnormal (incomplete), DataNodes report the abnormality to the client, and the client rewrites the data.
- The client checks data integrity when reading data from a DataNode. If the data is incomplete, the client will read data from another DataNode.
Data confidentiality
Based on Apache Hadoop, the distributed file system of MRS supports encrypted storage of files to prevent sensitive data from being stored in plaintext, improving data security. Applications need only to encrypt specified sensitive data. Services are not affected during the encryption process. Based on file system data encryption, Hive provides table-level encryption and HBase provides column family-level encryption. Sensitive data can be encrypted and stored after you specify an encryption algorithm during table creation.

Encrypted storage and access control of data are used to ensure user data security.
- HBase stores service data to the HDFS after compression. Users can configure the AES and SMS4 encryption algorithm to encrypt data.
- All the components allow access permissions to be set for local data directories. Unauthorized users are not allowed to access data.
- All cluster user information is stored in ciphertext.
Security authentication
- Uses a unified user- and role-based authentication system as well as an account- and role-based access control (RBAC) model to centrally control user permissions and batch manage user authorization.
- Employs Lightweight Directory Access Protocol (LDAP) as an account management system and performs the Kerberos authentication on accounts.
- Provides the single sign-on (SSO) function that centrally manages and authenticates MRS system and component users.
- Audits users who have logged in to Manager.

Parent topic: Functions

Previous topic: Multi-tenant

Next topic: Easy Access to Web UIs of Components

Feedback

Was this page helpful?

Helpful Not helpful

Provide feedback

Thank you very much for your feedback. We will continue working to improve the documentation.See the reply and handling status in My Cloud VOC.

The system is busy. Please try again later.

Which of the following issues have you encountered?

Content is inconsistent with the product UI

Unclear descriptions

Lack of examples or code

Incorrect steps

Can't find what I need

Lack of best practices

Feedback (optional)

0/500

Select at least one type of issue, and enter your comments or suggestions.

Enter a maximum of 500 characters.

Submit Cancel

For any further questions, feel free to contact us through the chatbot.

Chatbot