網(wǎng)格環(huán)境中的域間安全認證和授權機制研究.pdf

1、中國科學技術大學碩士學位論文網(wǎng)格環(huán)境中的域間安全認證和授權機制研究姓名：裴艷琴申請學位級別：碩士專業(yè)：計算機系統(tǒng)結構指導教師：楊壽保20060428中國科學技術大學碩士學位論文AbstractAbstractTheGridtechnologyisanupto—datetechnologyintheareaofwide—areanetworkcomputing，especiallyintheareaofwideareahighperfom

2、lancecomputingItenablescoordinateduseofgeographicallydistributedresourcesTheGridtechnologyisthoughttobethenextwaveofimprovementofinformationtechnologyit’salsoconsideredtobethenextgenerationIntemetThe鰣dhasthefollowingchar

3、acters：resourcesinthegridarcgeographicallydistributed；resourcesandclientsareconnectedthrorl曲wide—areanetworksuchashatemet；thecategoriesandquantitiesofresourcesaretremendous；resourcesneedtocooperatewitheachothertosomeexte

4、nt；resourcesaredynamicincludingtheattributeschanges，themigrationandreplicationinthegrid；resourcesworkinheterogeneousplatformsadministratedbydifferentpoliciesHowevegthecharactersof卵denvironmentbringmanysecurityproblemsThe

5、securityproblemsingldenvironmentarebeingpaidmoreandmoreattentiontoNotaffectinglocalmanagementandautonomynotchangingoperatingsystem，networkprotocolsandservice，GridComputingSystemshouldguaranteetheseeudtyofuserhostsandremo

6、tenodes，andthejoinorleaveofremotenodes，whichhasrelatedtothesecureauthenticationandauthorizationbetweendomainsin鰣denvironmentandithasbecometheresearchfocusofgridsecufityWiththedevelopmentofthetechnologytheresourcessharing

7、isbecomingmoreandmoreimportant，sowehavetodevidethe鰣denvironmenttoseveraldomainsaccordingtothephysicalorlogicalrelationsSometimesadomainhastocollabratewithotherstocompleteanapplicationSoastandardormethodisneededtosuppogco

8、operationindifferentkindsofsystemsThemainworksofthisthesisareinthefollowing：(1)AnalyzingthearchitecturemodelofGridComputingSystembasedonGlobusThenputtingtheemphesisonGridSecurityInfrastructureadoptedbyGlobus(2)Westudytwo

9、existingkindofaccesscontrolpolicies：Role—basedAccessControlandAttributebasedAccessContr01andsunmlarizedthedifferencesofthemBasedonthem，anewaccesscontrolmodelhasbeenaddressedadaptivetotheHanHai曲d(3)Anewaccesscontrolmodelb

10、asedonSAMLisaddedtoHanHaiGridsystemsupervisedbytheUniversityofScienceandTechnologyofChinaTheaccesscontrolmodeliswellintegratedwiththePortal，whichisinchargeoftheinterfacebetweenresourcecoilsumersandresourceproviders(4)Weh

11、avesetupatestbedonwhichanemulationsystemisbuilttotestifyfeasibilityofournewaccesscontrolmodelThecreativeworksofthisthesiscanbesummarizedasanewaccesscontrolmodelbasedonSAMLisaddedtoCampusGridsystemTheSecurityAssertionMark

12、upLanguage(SAML)providesastandardizedwayofpassingauthenticationandauthorizationinformationamongfederateddomainsTheAttribute—basedAccessControlpolicyandthesecurityassertionmappingsolutionarealsoadoptedinthissystemTheacces

13、scontrolmodeliswellintegratedwiththePortalwhichisinchargeoftheinterfacebetweenres011reeconsumersandresourceprovidersDependingontheattributesusershave，Attribute—basedAccessControlintegratedwithRole—basedAccessControlpolic

14、yhasbeenintroducedintooursystem，whichshowsmorepowerfulandagilityAndithasshownmoreflexibilityandreliabilityWorkflowofaccesscontroltogetherwiththeauthorizationserviceisdiscussedindetails，tooKeywords：Grid，GridComputing，Grid