question Re: Hierarchy of TDE encryption zones with Ranger-KMS in Archives of Support Questions (Read Only)

Hierarchy of TDE encryption zones with Ranger-KMS

alinazemian — Sun, 26 Feb 2017 10:35:16 GMT

I was wondering is there any way to have a hierarchy of encryption zones managing by Ranger-KMS? Suppose we have the following directory structure:

/userA/userB/

/userA/userC/

I want to configure HDFS in a way that userB and userA use two different encryption zones, but I would like to be able to access userB and userC folders with userA and be able to encrypt/decrypt data owned by userB or userC. Is there any way to handle this situation with Ranger-KMS?

Re: Hierarchy of TDE encryption zones with Ranger-KMS

sunile_manjee — Sun, 26 Feb 2017 10:44:51 GMT

With ranger you encrypt folders and those will access to those folder will be able to view data (decrypt). you can have userb and c folders encrypted and provide access to those folders to user A. then user will have access to those folders and view data (decrypt).

Re: Hierarchy of TDE encryption zones with Ranger-KMS

alinazemian — Sun, 26 Feb 2017 10:50:45 GMT

So can we virtually build a hierarchy of encryption zone in this way?

Re: Hierarchy of TDE encryption zones with Ranger-KMS

sunile_manjee — Sun, 26 Feb 2017 11:08:34 GMT

I don't consider this a hierarchy of encryption. more in tune of encryption and authorization on those zones.