# A Framework for Attribute-Based Access Control in Processing Big Data with Multiple Sensitivities  
[PERSON]  
1 Department of Electrical and Computer Engineering, University of Central Florida, Orlando, FL 32816, USA 12 The MITRE Corporation, Orlando, FL 32817, USA 21 Department of Electrical and Computer Engineering, University of Central Florida, Orlando, FL 32816, USA 12 The MITRE Corporation, Orlando, FL 32817, USA 21 Department of Computer Science, University of Central Florida, Orlando, FL 32816, USA 12 The MITRE Corporation, Orlando, FL 32817, USA 21 Department  
requirements. Our proposed framework for achieving BDP security consists of three key component actions:  
1. Analysis of standards as the fundamental basis for security architecture design. For example, specifically for ABAC, we analyzed Extensible Access Control Markup Language (XACML).
2. Experimentation with a realistic prototype, which we configured using Apache Hadoop ([[https://hadoop.apache.org/](https://hadoop.apache.org/)]([https://hadoop.apache.org/](https://hadoop.apache.org/)) accessed on 14 January 2023) on Amazon Web Services (AWS).
3. Design of capabilities to ensure operations at an objective secure state, which we identified as including the mandatory use of a secure data analysts' notebook, a data security service layer, and a central management console.
4. We believe our work presents the first framework for a more comprehensive analysis of security for BDP, focusing on the ABAC issues for large datasets with multiple sensitives. Other research on security in BDP has covered a wide variety of specific issues, including homomorphic encryption [1] and developing secure applications that can quickly become operational (DevSecOps) [2]. These advances depend on reliable access control (AC). A variety of alternative approaches to AC are being researched [3], and ABAC is the leading contender. It differs from other methods of access control, such as list-based, in which permission decisions depend upon assigning users to groups or operating system file permissions which designate a file owner, group, and others. Attributes are assigned to users (subject), objects (data files), and data analysis programs. These three types of entity help enable high-fidelity AC. Our analysis and experiments provide the following contributions:  
1. We present specific examples of cybersecurity attacks focusing on access control, which underlies most security services in BDP environments such as Hadoop.
2. We detail the installation and configuration of Hadoop on AWS Elastic Cloud Compute (EC2) instances for security-related analysis and experiments.
3. We provide the results of using a generated representative multiple-sensitivity healthcare and social media dataset in an Apache Spark parallel-processing privacy-preserving data lifecycle.
4. We detail specific BDP configuration recommendations to achieve attribute-based access control (ABAC) in Hadoop using Apache Ranger ([[https://ranger.apache.org/](https://ranger.apache.org/)]([https://ranger.apache.org/](https://ranger.apache.org/)) accessed on 14 January 2023) and Atlas ([[https://atlas.apache.org/](https://atlas.apache.org/)]([https://atlas.apache.org/](https://atlas.apache.org/)) accessed on 14 January 2023).  
To protect data in BDP environments, system security managers and administrators need to consider and test each component of the ecosystem and the collective environment. Many security features have been added to BDP systems, such as identification using Kerberos and encryption of the data at rest, but the comprehensive perspective of system security needs to be considered along with these individual capabilities. Our framework provides a more wholistic approach. Attackers take advantage of any open port, protocol, and service in the computation, storage, and communication environment to gain a foothold to introduce malware or exfiltrate data. Confidentiality, integrity, and availability need to be applied in a consistent, well-integrated, and layered manner across the environment.