HBAC: Hierarchical-Based Access Control Model for Storage Management in Data Lake Environments

초록

Background Traditional storage systems typically use simple access control models that manage permissions at the user or group level. These models, however, are not well suited for data lake environments, where large-scale and diverse datasets must be accessed concurrently by users across multiple hierarchical levels, and they also have many limitations in terms of maintenance.Aims In this paper, we propose a novel access control model, HBAC (Hierarchical-Based Access Control), designed to provide hierarchical access control in Ceph-based distributed storage environments.Methods HBAC introduces a hierarchical structure into permission management, ensuring that higher-level users are granted broader permissions than lower-level users. Furthermore, by providing hierarchical group-based management capabilities, HBAC overcomes the limitations of conventional ACL (Access Control List) models, which only support simple mappings between users and objects. This design also enables fine-grained and flexible access control, particularly in collaborative, large-scale data environments. We present a formal permission granting algorithm with specific example scenarios to ensure the stable implementation of HBAC on top of Ceph. This model leverages Ceph's metadata storage to centrally manage permissions without requiring additional software, while ensuring efficient data handling through its distributed architecture.Results and Conclusions Experimental evaluation confirms that Ceph-based HBAC effectively reflects user hierarchies and reliably provides complex access control. Furthermore, an efficiency comparison on policy representation shows that HBAC achieves approximately a 15-fold reduction in policy complexity compared to AWS IAM for equivalent permission configurations, and up to 21 times faster permission processing speeds compared to Ceph's default access control mechanisms, demonstrating its superior performance.

키워드