Security design and architecture for a multi-tenant Hadoop cluster

A method of providing security to a HDFS application in a multi- tenant Hadoop cluster comprising:

• in a single multi-tenant multi-node Hadoop cluster comprising a plurality of nodes, a plurality of tenants, and a plurality of applications:
• one of the tenants or applications authenticating a client process for a client;
• one of the tenants or applications receiving from the client a request comprising at least one of a session ticket and a temporary session key from a key distribution center;
• one of the tenants or applications authenticating the client based on at least one client authorization and the at least one of the session ticket and the temporary session key;
• and
• one of the tenants or applications assigning owners, group owners, default permissions, and extended access control lists (EACL) to the tenant directories and the home directories, wherein the EACLs prevent unauthorized tenants from accessing resources in the tenant directories and the home directories;
• wherein shared resources for a first tenant in the multi-node Hadoop cluster are isolated from a second tenant in the multi-node Hadoop cluster when the shared resources are in use by the first tenant, and
• wherein shared resources for the first tenant in the multi-node Hadoop cluster are shared with the second tenant in the multi-node Hadoop cluster when the shared resources are not in use by the first tenant.

A method for providing security for an application in a multi-tenant Hadoop cluster, comprising:

• in a single multi-tenant multi-node Hadoop cluster comprising a plurality of nodes, a plurality of tenants, and a plurality of applications:
• one of the tenants or applications identifying a plurality of groups and roles for a plurality of tenants, and identifying cross references between the roles and at least one active directory group;
• one of the tenants or applications creating an active directory for each of the groups;
• one of the tenants or applications adding each of a plurality of users to a tenant group and an application group;
• one of the tenants or applications creating base directories for the application schemas;
• one of the tenants or applications assigning roles and privileges to the tenants using extended access control lists (EACL);
• and
• one of the tenants or applications creates a tenant shared space for sharing data between applications within the tenant, wherein the EACLs prevent an unauthorized tenant from accessing the tenant shared space;
• wherein shared resources for a first tenant in the multi-node Hadoop cluster are isolated from a second tenant in the multi-node Hadoop cluster when the shared resources are in use by the first tenant, and
• wherein shared resources for the first tenant in the multi-node Hadoop cluster are shared with the second tenant in the multi-node Hadoop cluster when the shared resources are not in use by the first tenant.

A method for providing security for Hbase in a multi-tenant Hadoop cluster, comprising:

• in a single multi-tenant multi-node Hadoop cluster comprising a plurality of nodes, a plurality of tenants, and a plurality of applications:
• one of the tenants or applications identifying a plurality of Hbase namespaces and groups with permissions to the Hbase namespaces;
• one of the tenants or applications creating an active directory for each of the groups;
• one of the tenants or applications creating the Hbase namespaces to meet at least one tenant requirement;
• one of the tenants or applications creating a default role for each application with at least one privilege;
• and
• one of the tenants or applications creates a tenant shared space for sharing data between applications within the tenant, wherein an Extended Access Control List prevents an unauthorized tenant from accessing the tenant shared space;
• wherein shared resources for a first tenant in the multi-node Hadoop cluster are isolated from a second tenant in the multi-node Hadoop cluster when the shared resources are in use by the first tenant, and
• wherein shared resources for the first tenant in the multi-node Hadoop cluster are shared with the second tenant in the multi-node Hadoop cluster when the shared resources are not in use by the first tenant.