# A Framework for Attribute-Based Access Control in Processing Big Data with Multiple Sensitivities
## 2 Materials and Methods
### Cybersecurity Vulnerability Evaluation
#### 2.2.4 Service-Level Authorizations  
Client services need to incorporate identification, authentication, access control, and data confidentiality (i.e., encryption) into BDP environments. This applies to all actions, including submitting jobs (Apache Spark and MapReduce), reading and writing files, and interacting with the web-based graphical user interfaces (Web GUIs). TCP/IP protocols encase the remote procedure calls (RPCs) that contain the client-to-server (Name Node, Resource Manager, and Data Node) and server-to-server communications. For example, Data Nodes send heartbeats to report their health status to the Name Node and use an additional TCP/IP data transfer protocol to exchange data blocks [52].  
Client applications for the Hadoop ecosystem include Apache HUE ([[https://gethue.com/](https://gethue.com/)]([https://gethue.com/](https://gethue.com/)) accessed 14 January 2023), Zeppelin ([[https://zeppelin.apache.org/](https://zeppelin.apache.org/)]([https://zeppelin.apache.org/](https://zeppelin.apache.org/)) accessed 14 January 2023), and HDFS CLI, which can incorporate security services. If configured, Kerberos enforces client authentications (identification). Data Nodes use the Simple Authentication and Security Layer (SASL) ([[https://www.rfc-editor.org/rfc/rfc4422](https://www.rfc-editor.org/rfc/rfc4422)]([https://www.rfc-editor.org/rfc/rfc4422](https://www.rfc-editor.org/rfc/rfc4422)) accessed 14 January 2023) to negotiate authentication (e.g., Kerberos) when using the data transfer protocol to exchange data blocks.  
Authorizations are defined based on access control lists (ACLs) contained in the hadoop-policy.xml configuration file or as defined in a component of the ecosystem external to the core Hadoop components, e.g., Apache Ranger, as described below.  
If configured, the SSL/TLS secure information exchanges. For Hadoop clients and servers, this protects the RPCs. SSL/TLS also protects the web interface used by servers to expose their status in that it can be configured with HTTPS. This includes, for example, the Web GUI for the Name Node and the Resource Manager.  
In addition to ACLs, Hadoop components that provide a JDBC-SQL interface, e.g., Apache Hive, have authorization services that must be configured. For example, executions of the GRANT and REVOKE commands and SQL standard authorizations were added to later versions of Hive.  
The ACs for these various protocols that are used by different components are managed through several configuration files. They can be very complex and difficult to translate to modern AC models, such as ABAC. The use of a management console such as Apache Ranger helps centralize this configuration and ensure consistency. This is instrumental for achieving security-related objectives.  
Eternally exposed protocols such as HTTP, RPC, and JDBC-SQL can be subject to a wide variety of attacks if not secured, even when running on a high port range. For example, web application attacks include SQL command injections, cross-site scripting (XSS), web shell implants, and injections of brute force commands.