Improving Security of Parallel Algorithm Using Key Encryption Technique

INTRODUCTION

---

Cloud computing being the peak of Gartner technology hype curve (Lapkin, 2012), proves that it matures and moves to a new plane of running large scale scientific and small scale problems. The need for large scale data processing (Ekanayake et al., 2008) has been reiterated in recent years due to the rising number of web applications with cheap storage capacity and availability of resources to process petascale of data. Several parallel algorithms (Isard et al., 2007; Mackey et al., 2008; Dean and Ghemawat, 2008) like Message Passing Interface (MPI), MapReduce, Dryad have been created with a view to efficiently run large scientific problems on a cluster of machines.

Google’s MapReduce is a parallel programming model introduced to handle large scale data stored in datacenters and search applications (Dean and Ghemawat, 2008). It enables parallel processing of large data by partitioning data among a commodity of machines providing high performance (Mackey et al., 2008). It is capable of scaling and scheduling a cluster of machines, partitioning the data, determining which nodes will perform which tasks and handling messages between nodes. (Ekanayake et al., 2008) This frame work is versatile and allows new users to access the power of distributed computing by using distributed storage and avoiding the transmission step with an improved level of security.

One such implementation of MapReduce is Yahoo’s Hadoop. Hadoop is a top level Apache Software Foundation project (Becherer, 2010). Hadoop’s MapReduce is an open source software that fall under the infrastructure of distributed environment to perform large data analytics. Hadoop has been successfully used by many companies (Buyya et al., 2009; Fox, 2011) including America On Line (AOL), Amazon, Facebook, (Hadoop Applications, 2010) and New York Times for running their applications on clusters. For example, AOL uses MapReduce to study the behavioral pattern of their users and work accordingly.

In the early 2010 Yahoo! developers (O’Malley et al., 2010) attempted to improve the state of security. Many security loopholes like poor default SASL (Simple Authentication Security Layer) quality of protection, incomplete authentication and lack of data security that flows between the nodes were identified (Wei et al., 2009). Introduced a replication based verification scheme which is a decentralized scheme to run MapReduce securely. They also proposed a way to detect misbehavior of malicious users. Major concerns like SASL and securing the channel are achieved through Kerberos based Authentication and through Remote Procedure Call via Secure Shell mechanism. Pluggable WebUI (User Interface) is resolved by SPENEGO (a mechanism to authenticate a remote server) that is supported by all Web Browsers. New goals were introduced which includes strong mutual authentication (Wei et al., 2009) of users and services that are transparent to end users. The wide distribution of symmetric keys is resolved through the proposed methodology. In this study, the three technical challenges identified were resolved by transferring the tokens securely between mappers and reducers.

MAPREDUCE ARCHITECTURE

MapReduce is a computing framework where nodes are distributed geographically. The framework is developed with two primary components namely HDFS and MapReduce engine (Hadoop Applications, 2010). Initial versions of Hadoop has been designed for a secure environment assuming that MapReduce and Hadoop Distributed FileSystem (HDFS) would be used by users of a cooperating group. The MapReduce dataprocessing model comprises of NameNode and DataNodes. The NameNode is responsible for scheduling the tasks, job management, fault tolerance and load balancing mechanism among the DataNodes. DataNodes are the workers that store and retrieve blocks based on the request from clients or NameNode and report back to the NameNode periodically with lists of blocks stored on it. A Jobtracker daemon receives the splits of a Job and assigns the splits to different nodes running on NameNode and oversees the overall execution of the MapReduce process. It assists in co-ordinating the jobs by maintaining the events and configuration details of completed jobs. A TaskTracker assigned, assists in managing the execution of individual tasks on the nodes of the cluster that sends a periodic heartbeat to the JobTracker to reveal that the TaskTracker is still alive and is ready to accept new tasks of MapReduce Process.

Tokens for security: The new Hadoop version 0.21 provides improved security performance by creation of tokens at different layers of MapReduce process. Token is a SecretKey created by the NameNode and Jobtracker and is shared between the clients, TaskTracker and DataNodes. NameNode creates DelegationToken and BlockAccessToken and JobTracker creates JobTokens to perform MapReduce job. Tokens like BlockAccess and JobToken are designed with timestamp inorder to varify the tokens authenticity and its validity.

Delegation tokens: DelegationToken generated by NameNode is created to enhance the security of Hadoop by allowing user authentication and pass credentials to all tasks of a job. It is generated to prevent flooding of authentication requests at the start of a job and is shared as a secret key between the client and the NameNode/JobTracker. For subsequent calls, DelegationToken alone can be verified by NameNode for each user instead of using kerberos tickets.

BlockAccessToken: Inorder to securely access the contents of HDFS BlockAccessToken is created. Actually NameNode creates such tokens and is accessed by DataNode. To access a file, clients communicate with the NameNode to find out which DataNodes the user intends to access inorder to fetch the file. DataNodes need to know from the NameNode whether the client is authorized to fetch that blocks. Inorder to authorize the client, information about the client block_id is passed using BlockAccessToken from NameNode to the owner of the file. Using the token, the owner/client can access the data block.

JobToken: The token is created to securely run MapReduce jobs. It is generated by JobTracker and distributed to all MapReduce Tasks (TaskTracker Nodes) in order to run jobs by providing a check as whoever comes with the token is authentic to run. When task communicates with TaskTracker for results or computational purposes, JobToken is used. JobTracker automatically renews tokens while job is running and cancels tokens when job is finished and hence it is not persistent.

Flow of tokens: All communication between the nodes of distributed environment takes place via SecureShell (SSH). Despite transferring tokens via SecureShell, Hadoop users who access (Malley, 2010) Hadoop services are authenticated through a Kerberos authentication protocol. Hadoop Clients access its services via Hadoops Remote Procedure Call (RPC) library. Each users login name sent across the connection setup is authenticated through Kerberos based authentication to NameNode in the existing Hadoop 0.21 version as shown on the Fig. 1. Kerberos has a key distribution center (KDC) which maintains AuthenticationServer and Ticket Granting Server. Authenticated client receives a timestamped (TicketGrantingTicket) TGT from authentication server. Ticket Granting Ticket is used to request a service ticket from ticket granting server. Client uses the service ticket to accept the delegation token from NameNode through RPC call.

Fig. 1:	MapReduce Architecture describing flow of tokens

The three step Kerberos authentication for each call overloads the KDC on a cluster for which a DelegationToken is introduced.

Figure 1 describes how the Kerberos service ticket and tokens flow during a MapReduce process. After initial user authentication through Kerberos the whole process involves running MapReduce jobs on a Hadoop cluster and accessing HDFS blocks. To access HDFS using BlockAccessToken, the access information of a user is passed from NameNode to datanode. So BlockAccessToken issued by NameNode is used on datanode to verify its authenticity. The token enables its owner to access certain DataBlocks. Here DataNodes do not enforce access control on data blocks. This allows an unauthorized client to read a datablock when it knows the block_id. So insecure channels in between the nodes allow malicious users/attackers to fetch others blocks. MapReduce jobs running on a cluster accepts the jobtokens created, while running the task. The authenticity is checked with the users Delegation and JobToken.

Risks associated with handling tokens: Client Server interactions in a distributed environment like HDFS or MapReduce is prone to numerous attacks. So such an environment needs to be authenticated. Tokens are created and assumed to follow a secure channel. Besides communication security threats such as Denial of Service attacks, eavesdropping attacks, replay attacks, MapReduce faces issues while maintaining the integrity and confidentiality of data (Malley, 2010). Authenticated users obtaining a delegation token shares the token between the user and the NameNode. The delegation token need to be protected when passed over insecure channels.

An Attacker can affect the integrity of the MapReduce process in two ways. Firstly when a client asks NameNode for block_ids (locations) of a file on HDFS, NameNode checks that the client is authorized to access the file and sends back blockids along with a BlockAccessToken for each block. In the current version of Hadoop 0.21, BlockAccessTokens are generated using a symmetric HMAC-SHA1. It is distributed to NameNode and all DataNodes in the cluster. So, an attacker who fetches a shared key is vulnerable to attack all DataNodes as shown in the Fig. 2. Also the confidentiality of data is affected because of the attack. Secondly, while running jobs on a HDFS Cluster an intruder who is capable of acquiring JobTokens can modify the results of a Map or Reduce task.

Proposed technique to secure MapReduce environment: Several risks related to HDFS data integrity, privacy and confidentiality of Hadoop users needs to be reduced by performing cryptographic encryption technique on tokens when traversed from one node to another in a Hadoop environment. The three methodologies identified in cryptography prove to be secure in the proposed implementation.

Using asymmetric encryption mechanism: The proposed technique is to replace the symmetric HMAC-SHA1 system supported in the version Hadoop 0.21 by a public- key system.

Fig. 2:	Depicting an attacker stealing BlockAccessToken, SymmetricKey and JobToken when traversed between NameNode and DataNodes

In the case of BlockAccessToken, instead of storing the same symmetric key over several DataNodes, a public-private key pair is generated between the NameNode and every datanode. Similarly, job tokens are encrypted using a public key shared by the JobTracker and the task. When a job is submitted by a Hadoop client, the JobTracker first generates key pairs with each of the TaskTracker. When a job is split to the various TaskTrackers, the job token ensures a secure communication. In this case, the token is encrypted by the key which is available only at the encrypting end i.e JobTracker and sent to the corresponding TaskTracker node. At this end, the TaskTracker decrypts the token using its private key and checks the authenticity. Inorder to ensure that token is arrived from the appropriate JobTracker, its digital signature is appended with the token. Similarly, during data access from HDFS, public keys for encryption are stored in the NameNode and each of the DataNodes have the corresponding private keys. The blocks at the respective DataNodes can be retrieved by verifying the corresponding encrypted tokens.

Figure 3 gives the algorithm which was implemented with methods like keyinit in line number (3) written for setting the default parameters like length of the key and type of algorithm which is RSA. The generateKeys function of crypto library in line 8 is for generating public and private keys. The private keys generated were based on different values of commonly used public key values such as 17, 257 and 65537.The public and private key pair created in the NameNode of cluster is shown in Table 1.

Fig. 3:	Proposed asymmetric algorithm using RSA for securing tokens in Hadoop Version 0 .21

Table 1:	Asymmetric Keys created in NameNode and distributed to nodes of cluster

Using symmetric encryption mechanism: The second technique to replace the HMAC-SHA1 system is providing a symmetric-key encryption mechanism. The symmetric hashing is replaced by a symmetric encryption mechanism. In the case of BlockAccessToken, instead of storing the same symmetric key over several DataNodes a private key is generated between the NameNode and every DataNode. Similarly job tokens are encrypted using a private key and is shared by the Jobtracker and each of the tasks. When a job is submitted by the user, the Jobtracker generates private keys and shares it with each of the TaskTrackers. When a job is split to the various TaskTrackers, the job token ensures the secure communication. The Jobtracker encrypts the Jobtoken by the private key. It is decrypted using the same private key and checked accordingly at the TaskTracker node. Inorder to access data from HDFS, BlockAccessTokens are encrypted using private keys that are maintained by NameNode and each of the DataNodes which receives the encrypted form of blockid from the user, checks the token by decrypting it with the same privatekey sent by the NameNode. The implementation of the symmetric algorithm is similar to that of the previous method except that now a single secret key is generated in place of the public and private key pair.

Refinement in the existing HMAC-SHA1 mechanism of Hadoop’s MapReduceVersion 0.21: The third technique is based on the existing Hadoop Security Design (O’Malley et al., 2010). The model shares the same secret key across nodes to compute the hash value of tokens like BlockAccess and JobToken. The algorithm designed generates a unique secret key for each and every node instead of using the same key. Such concept introduced, reduces the risk of stealing or destroying the contents of all blocks of HDFS. Even a malicious user who steals a secret key is unable to access the contents from other blocks and is exposed only to the block for which the secret key is assigned. The implementation of such mechanism involves keyinit method in line4 to set the default parameters for the key. But generateKeys method in this case uses the actual crypto method to generate as many secret keys as the mapper nodes. Such technique shows relatively better results which is discussed in our experimental studies.