Big Security for Big Data:
Addressing Security Challenges for
the Big Data Infrastructure
Yuri Demchenko
SNE Group, University of Amsterdam
On behalf ofYuri Demchenko, Canh Ngo, Cees de Laat, Peter Membrey, Daniil
Gordijenko
SDM’13 - Secure Data Management Workshop
Part of VLDB2013 Conference
30 August 2013

Outline• Big Data definition– 5 + 1 V’s of Big Data: Volume, Velocity, Variety + Veracity, Value, Variability– 5 parts Big Data Definition• Paradigm change and new challenges– Big Data Infrastructure and Big Data Security– CSA’s Top 10 Big Data Security Challenges• Defining Big Data Architecture Framework (BDAF)– From Architecture to Ecosystem to Architecture Framework• Big Data Infrastructure (BDI) and Security Infrastructurecomponents– Federated Access and Delivery Infrastructure– Trusted Infrastructure Bootstrapping Protocol• Big Data Security Research topics

30 August 2013, Trento, Italy

Big Data Security

Slide_2

Big Data and Security Research at System andNetwork Engineering, University of Amsterdam•Long time research and development on Infrastructure services and facilities– High speed optical networking and data intensive applications– Application and infrastructure security services– Collaborative systems, Grid, Clouds and currently Big Data•

Focus on Infrastructure definition and services– Software Defined Infrastructure based on Cloud/Intercloud technologies– Dynamically provisioned security infrastructure and services• NIST Big Data Working Group– Active contribution Reference Architecture, Big Data Definition and Taxonomy, Big DataSecurity• Research Data Alliance– Interest Group on Education and Skills Development on Data Intensive Science• Big Data Interest Group at UvA– Non-formal but active, meets two-weekly– Provides input to NIST BD-WG and RDA

30 August 2013, Trento, Italy

Big Data Security3

Big Data Definition Collection•

IDC definition (conservative and strict approach) of Big Data:"A new generation of technologies and architectures designed to economically extract value
from very large volumes of a wide variety of data by enabling high-velocity capture,
discovery, and/or analysis“•Gartner defintion
Big data is high-volume, high-velocity and high-variety information assets that demand costeffective, innovative forms of information processing for enhanced insight and decision
making. http://www.gartner.com/it-glossary/big-data/–•

Big Data: a massive volume of both structured and unstructured data that is so large thatit's difficult to process using traditional database and software techniques.
–•

From “The Big Data Long Tail” blog post by Jason Bloomberg (Jan 17, 2013). http://www.devx.com/blog/the-big-datalong-tail.html“Data that exceeds the processing capacity of conventional database systems. The data is
too big, moves too fast, or doesn’t fit the structures of your database architectures. To gain
value from this data, you must choose an alternative way to process it.”–•Termed as 3 parts definition, not 3V definition

Ed Dumbill, program chair for the O’Reilly Strata Conference

Termed as the Fourth Paradigm *)“The techniques and technologies for such data-intensive science are so different that it isworth distinguishing data-intensive science from computational science as a new, fourthparadigm for scientific exploration.” (Jim Gray, computer scientist)*) The Fourth Paradigm: Data-Intensive Scientific Discovery. Edited by Tony Hey, Stewart Tansley, and Kristin Tolle. Microsoft, 2009.

30 August 2013, Trento, Italy

Big Data Security

4

Big Data Security: Veracity and other factors
Velocity

Volume••••Terabytes
Records/Arch
Tables, Files
Distributed••••

Structured
Unstructured
Multi-factor
Probabilistic
LinkedDynamic

5 Vs ofBig Data•••••

Trustworthiness
Authenticity
Origin, Reputation
Availability
Accountability

Veracity•

Batch
Real/near-time
Processes
Streams

Variety
•
••
•
•
•

•

––––

Value••••

Trustworthiness and Reputation ->-> Integrity
Origin, Authenticity andIdentification

Statistical
EventsCorrelations
Hypothetical––Variability •Availability––• Changing data
• Changing model• Linkage•

Big Data Security

Timeliness
Mobility (mobile/remote access; fromother domain – roaming; federation)

Accountability–30 August 2013, Trento, Italy

Data authenticity and trusted origin
Identification both Data and Source
Source: system/domain and author
Data linkage (for complex hierarchicaldata, data provenance)
Computer and storage platform
trustworthinessAccountability and reputation

As pro-active measure to ensure dataveracity5Big Data Definition: From 5V to 5 Parts (2)Refining Gartner definition:“Big data is high-volume, high-velocity and high-variety information assets thatdemand cost-effective, innovative forms of information processing for enhanced
insight and decision making”•Big Data (Data Intensive) Technologies are targeting to process (1) high-volume,
high-velocity, high-variety data (sets/assets) to extract intended data value andensure high-veracity of original data and obtained information that demand (3)cost-effective, innovative forms of data and information processing (analytics) for
enhanced insight, decision making, and processes control; all of those demand(should be supported by) (2) new data models (supporting all data states andstages during the whole data lifecycle) and {4) new infrastructure services andtools that allows also obtaining (and processing data) from {5} a variety ofsources (including sensor networks) and delivering data in a variety of forms todifferent data and information consumers and devices.
(1) Big Data Properties: 5V or (3+3) V(2) New Data Models(3) New Analytics(4) New Infrastructure and Tools(5) Source and Target

30 August 2013, Trento, Italy

Big Data Security

6

From Big Data to All-Data – Paradigm Change
Move or notto move?

• Breaking paradigm changing factor– Data storage and processing– Security– Identification and provenance• Traditional model– BIG Storage and BIG computer withFAT pipe
– Move compute to data vs Move datato computeBig DataNetwork?
Distributed Big DataStorage
Data Abstraction

Data Bus• New Paradigm– Continuous data production– Continuous data processing– DataBus as Data container andProtocol
30 August 2013, Trento, Italy

Big Data Security

Big
ComputerVisualisation

Infrastructure Abstraction

Distributed Computeand Analytics

7Data Centric Security and Challenges (1)• Paradigm shift to data centric security model– Current and previous security models are host or domain based– Any communication or processing is bound to host/computer that runs
software, especially in security (PKI as an example)• Paradigm changing factors– Big Data properties: 5+1 V’s– Data aggregation: multi-domain, multi-format, variability, linkage,referral integrity– Policy granularity: variety and complex structure, for their access
control processing– Virtualization: Can improve security of data processing environment
but cannot solve data security “in rest”– Mobility of the different components of the typical data infrastructure:
data, sensors or data source, data consumer
30 August 2013, Trento, Italy

Big Data Security

8

Data Centric Security and Challenges (2)• New security models and new challenges– Data confidentiality, integrity and identification– Data linkage and referral integrity• Data variability and transformation/evolution– Data ownership (as related to distributed and evolving data)– Data centric access control• Encryption enforced access control– Personally identified data, privacy, opacity• Data location, search, access– Trusted virtualisation platform• Dynamic trust bootstrapping

30 August 2013, Trento, Italy

Big Data Security9CSA Top Ten Big Data Security and Privacy
Challenges
A. Infrastructure security
1) Secure computations in distributed programming frameworks
2) Security best practices for non-relational data stores3) Secure data storage and transactions logs
4) End-point input validation/filtering

B. Access control and policy5) Granular access control and data centric access policies
6) Cryptographically enforced access control and secure communication

C. Data Management
7) Real-time security/compliance monitoring
8) Granular audits9) Data provenance

D. Privacy and Confidentiality
10) Scalable and composable privacy-preserving data mining and analytics
https://downloads.cloudsecurityalliance.org/initiatives/bdwg/Expanded_Top_Ten_Big_Data_Security_and_Privacy_Challenges.pdf
30 August 2013, Trento, Italy

Big Data Security

10

Top Ten Big Data Security and Privacy Challenges

Expanded Top Ten Big Data Security and Privacy Challenges. CSA Report, 16 June 2013.
https://downloads.cloudsecurityalliance.org/initiatives/bdwg/Expanded_Top_Ten_Big_Data_Security_and_Privacy_Challenges.pdf
30 August 2013, Trento, Italy

Big Data Security

11Defining Big Data Architecture Framework• Existing attempts don’t converge to somethingconsistent: ODCA, TMF, NIST
– See http://bigdatawg.nist.gov/_uploadfiles/M0055_v1_7606723276.pdf• Architecture vs Ecosystem– Big Data undergo a number of transformations during theirlifecycle– Big Data fuel the whole transformation chain• Data sources and data consumers, target data usage– Multi-dimensional relations between• Data models and data driven processes• Infrastructure components and data centric services• Architecture vs Architecture Framework (Stack)– Separates concerns and factors• Control and Management functions, orthogonal factors– Architecture Framework components are inter-related
30 August 2013, Trento, Italy

Big Data Security

12

Big Data Architecture Framework (BDAF) –Aggregated (1)(1) Data Models, Structures, Types– Data formats, non/relational, file systems, etc.

(2) Big Data Management– Big Data Lifecycle (Management) Model• Big Data transformation/staging– Provenance, Curation, Archiving(3) Big Data Analytics and Tools– Big Data Applications• Target use, presentation, visualisation(4) Big Data Infrastructure (BDI)– Storage, Compute, (High Performance Computing,) Network– Sensor network, target/actionable devices– Big Data Operational support(5) Big Data Security– Data security in-rest, in-move, trusted processing environments
30 August 2013, Trento, Italy

Big Data Security

13

Big Data Architecture Framework (BDAF) –Aggregated – Relations between components (2)Col: Used By
Row: Requires
This

Data
Models
Structrs

Data Models& Structures

DataManagmnt& Lifecycle

BigData
Infrastr &Operations

BigData
BigData
Analytics & Security
Applicatn+

++

+++

++

++

++

++

+++

Data
Managmnt &Lifecycle++

BigData
Infrastruct &Operations

+++

+++

BigData
Analytics &Applications

++

+++

BigDataSecurity

+++

+++

+++

30 August 2013, Trento, Italy

Big Data Security

+++14

Data
SourceData
Collection&Registration

Data
Filter/Enrich,Classification

Data
Analytics,
Modeling,Prediction

DataDelivery,
Visualisation

Consumer

Big Data Ecosystem: Data, Lifecycle,
Infrastructure

Big Data Target/Customer: Actionable/Usable Data
Target users, processes, objects, behavior, etc.
Federated
AccessandDelivery
Infrastructure(FADI)

Big Data Source/Origin (sensor, experiment, logdata, behavioral data)

Big Data Analytic/Tools

Storage
GeneralPurposeData Management

ComputeGeneral
PurposeHigh
Performance
Computer
Clusters

StorageSpecialised
Databases
Archives(analytics DB,
In memory,operstional)

Data
categories: metadata,(un)structured, (non)identifiable
Data
Datacategories:
categories:metadata,metadata,(un)structured,(un)structured,(non)identifiable(non)identifiable

Intercloud multi-provider heterogeneous Infrastructure
Security Infrastructure

30 August 2013, Trento, Italy

Network InfrastructureInternal

InfrastructureManagement/Monitoring

Big Data Security

15

Data Transformation/Lifecycle Model
Raw Data (1)Common Data Model?
Data Structure (1)Data Models (3)Data Visual&Action(4)Data (inter)linking?

DataSource

DataCollection&Registration

DataFilter/Enrich,Classification

DataAnalytics,Modeling,Prediction

DataDelivery,
Visualisation

Consumer
Data Analitics
Application

Data Storage

Data repurposing,Analitics re-factoring,
Secondary processing••

Data Model and Data structures change
along lifecycle
Data identification and linking–––

Persistent identifier
Referral integrity
Traceability vs Opacity

30 August 2013, Trento, Italy

Big Data Security

16

Big Data Infrastructure Security• Federated Access and Delivery Infrastructure (FADI)– Access Control Infrastructure for cloud based Big Data
Infrastructure– Trusted Virtual Infrastructure Bootstrapping Protocol• Data centric Access control models– Current models with centralised key management• Enterprise or Trusted Third Party (TTP)– Future/prospective models• Looking for solutions from VLDB/SDM community• Fine grained access control– Cell based access control– Content based access control
30 August 2013, Trento, Italy

Big Data Security

17Federated Access and Delivery Infrastructure(FADI)
Federated Cloud
Instance Customer A(VO A)

TrustBroker

TrustBroker

BrokerBrokerFederated Cloud
Instance Customer B(VO B)
Common FADI
Services

TrustedIntroducer

Discovery

FADI Network Infrastructure

FedIDP

30 August 2013, Trento, Italy

Directory

Directory(RepoSLA)(RepoSLA)

Gateway

Gateway

Gateway

Gateway

AAAAAAAAAAAA(I/P/S)aaS
Provider(I/P/S)aaS
Provider(I/P/S)aaS
Provider

IDP

IDP

IDP

Big Data Security…

(I/P/S)aaS
ProviderIDP

18

Virtualised Infrastructure Security:
Trusted Infrastructure Bootstrapping Protocol• Domain Authentication Server (DAS) provides a trusted root for thethird party’s domain.
• Bootstrap Initiator (BI) is the application that is transferred to the remotemachine in order to confirm the machine’s status before any
infrastructure or software is deployed.
• Bootstrap Requester (BREQ) is a client application that runs on themachine responsible for provisioning remote infrastructure. It
communicates with its counterpart on the remote machine and handles
the first/initial stage of the bootstrapping process.
• Bootstrap Responder (BRES) is the counterpart server application. It is
responsible for authenticating the machine to a remote client andverifying that the client is authorized to bootstrap the machine. Onceeach end point has been authenticated, the BRES will receive, decryptand decompress the payload sent by the client.

30 August 2013, Trento, Italy

Big Data Security

19

Big Data Security: Research directions• Fined-grained data encryption– Key-Policy Attribute-Based Encryption (KP-ABE)[1]: policy  keys;
attributes  ciphertext– Ciphertext-Policy Attribute-Based Encryption (CP-ABE) [2]: policy ciphertext, attributes  keys
– Issues: performance, key management model• Fine-grained access control
––––

1.
2.

ABAC access control for structured big-data
Fine-grained levels: cell level (like Accumulo), content-based level
Configurable authorization policies
Challenges: performance; distributed enforcements

V. Goyal et. al. “Attribute-based encryption for fine-grained access control of encrypted data”, CCS '06.
Bethencourt et. al., "Ciphertext-Policy Attribute-Based Encryption," IEEE S&P 2007.

30 August 2013, Trento, Italy

Big Data Security

20

Accumulo cell-level security

Current Accumulo policy expression (cell based)
username@instance> createtable vistest
username@instance vistest> insert row f1 q1 v1 -l A
username@instance vistest> insert row f2 q2 v2 -l A&B
username@instance vistest> insert row f3 q3 v3 -l (apple&carrot)|broccoli|spinachroot@instance vistest> setauths -s A,B,broccoli -u username
root@instance vistest> user usernameEnter password for user username: ********
username@instance vistest> scanrow f1:q1 [A]v1
row f2:q2 [A&B]v2
row f3:q3 [(apple&carrot)|broccoli|spinach]v3

30 August 2013, Trento, Italy

Big Data Security

21Fined-grained data/content cetric access control• Using ABAC policies (e.g. XACML)– Define authz policies for data granularity: table, columns, rows,
cells– Compile policies & disperse compiled pieces of policies at eachdata granularities– XACML allows addressing particular policy target with theResource locator element in a form of URI/URL

CompilingPolicies

PDP
Cell [i,j,k]
30 August 2013, Trento, Italy

Big Data Security

PDP

PDP

Row

Column

PDP
Table
22

Summary and Discussion• Initial take on the security issues in Big Data (Infrastructure)• Required work on Big Data definition and Big Data
Architecture Framework– Good news: industry via NIST is very active to define Big Data as anew technology and produce Technology Roadmap• First deliverable is planned for Sept-Oct 2013• 30 Sept 2013 – NIST Big Data Workshop• Future work: Wide range of topics on defining new security
challenges and related solutions

30 August 2013, Trento, Italy

Big Data Security

23

Additional Information• Existing proposed Big Data architectures• e-Science and Scientific Data Infrastructure (SDI)

30 August 2013, Trento, Italy

Big Data Security

24

NIST Big Data Working Group (NBD-WG)• Deliverables target – September 2013
• Activities: Conference calls every day 17-19:00 (CET) bysubgroup - http://bigdatawg.nist.gov/home.php– Big Data Definition and Taxonomies– Requirements (chair: Jeffrey Fox)
– Big Data Security– Reference Architecture– Technology Roadmap• BigdataWG mailing list and useful documents– Input documents http://bigdatawg.nist.gov/show_InputDoc2.php– Brainstorming summary and Lessons learnt (from brainstorming)
http://bigdatawg.nist.gov/_uploadfiles/M0010_v1_6762570643.pdf– Big Data Ecosystem Reference Architecture (Microsoft)
http://bigdatawg.nist.gov/_uploadfiles/M0015_v1_1596737703.docx
30 August 2013, Trento, Italy

Big Data Security

25

Big Data Definition: From 5V to 5 Parts (1)(1) Big Data Properties: 5V– Volume, Variety, Velocity, Value, Veracity– Additionally: Data Dynamicity (Variability)(2) New Data Models– Data linking, provenance and referral integrity– Data Lifecycle and Variability/Evolution(3) New Analytics–

Real-time/streaming analytics, interactive and machine learning analytics(4) New Infrastructure and Tools––––

High performance Computing, Storage, Network
Heterogeneous multi-provider services integration
New Data Centric (multi-stakeholder) service models
New Data Centric security models for trusted infrastructure and data processing
and storage(5) Source and Target– High velocity/speed data capture from variety of sensors and data sources– Data delivery to different visualisation and actionable systems and consumers– Full digitised input and output, (ubiquitous) sensor networks, full digital control
30 August 2013, Trento, Italy

Big Data Security

26

Data Transformation Model
Data model types?

Data/Process model(s)DatasetID={PID+Pfj}
Metadata

Data
SourceModel data,
statistical data

Metadata

PID

Metadata

Data (raw)
PIDDataSource

30 August 2013, Trento, Italy

PID

Datasets

PID

Metadata

Data (archival,actionable)

Data (structured,datasets)
DataCollection
andRegistratn

ModelID?=?

Data
Analytics,Modeling,Prediction

Data
Filter/Enrich,Classification

Security issues•• CIA and Access control ••Big Data Security

Data
Delivery,
Visualisation

Referral integrity
Traceability
Opacity

Visualisedmodels;Biz reports,Trends;
ControlledProcesses;
SocialActions

Consumer

PID=UID+time+Prj

27

Scientific Data Lifecycle Management (SDLM)
Model
Data Lifecycle Model in e-Science

User
Researcher

Data discovery

Data Curation(including retirement and clean up)
Datarecycling

Raw Data
Experimental
DataProject/
Experiment
Planning

Data collectionandfiltering

Structured
Scientific
Data

Data analysis

DB

Data archiving

DataRe-purpose

Data linkage
to papers

Data sharing/
Data publishing

Data Re-purpose
Data Linkage Issues•
Persistent Identifiers (PID)•
ORCID (Open Researcher andContributor ID)•
Lined Data

Data Clean up and Retirement•
Ownership and authority•
Data Detainment

Big Data Security

End of project

Open
PublicUse

Data Links

30 August 2013, Trento, Italy

Dataarchiving

Metadata &Mngnt

28