In order to maintain a strong isolation level among components
of Hadoop in a public cloud, Hadoop components
should avoid sharing secret keys or tokens. Therefore when one
Hadoop component is compromised, its leaked keys and tokens
will not expose keys and tokens of other Hadoop components.
In SEHadoop, SEHadoop Block Token fixes the overloaded
authentication key issue and resists attackers targeting storage
processes (e.g. Data Nodes). Each Data Node is forced to share
a unique symmetric key with the Name Node for generating
SEHadoop Block Token, therefore a compromised Data Node
cannot leak keys owned by other Data Nodes, and attackers
cannot access resources beyond the compromised Data Node.
Each Container has a unique SEHadoop Child Delegation
Token, and every SEHadoop Child Delegation Token can
have different access privileges. A compromised Container
does not have or has limited impact on data accessed by
other Containers. By using unique keys and tokens, SEHadoop
improves the isolation level among components of Hadoop.