GSI的信息栅格授权服务策略  

The Research of Authorization Service Strategy for Information Grid Based on GSI

作　　者：陈靖[1] 张水平[1] 石琢栋[1] 张凤琴[1] 

机构地区：[1]空军工程大学电讯工程学院,陕西西安710077

出　　处：《空军工程大学学报（自然科学版）》2009年第2期71-75,共5页Journal of Air Force Engineering University(Natural Science Edition)

基　　金：陕西省自然科学基金资助项目(2007F43;SJ08-ZT15);空军工程大学电讯工程学院博士启动基金资助项目(KDYBSJJ402)

摘　　要：GSI授权机制过于简单,作为对GSI授权机制补充的社区授权服务(CAS)又过于中心化,不适应情报网格信息流授权机制的要求。为此,提出了基于角色访问控制(RBAC)的虚拟组织授权服务(VOAS)策略,允许给用户分配VO角色来支持角色分层和限制。通过将VO角色映射为本地数据库角色,以及对本地角色委派细粒度权限等工作,既实现VO间用户与访问权限的逻辑分离,又杜绝了角色联合权限的方式,使VO间的授权管理比较简单灵活。解决了现有信息栅格中CAS授权粒度不够细化、可扩展性差等问题。仿真实验表明,该授权策略在不影响系统运行效率的前提下,简化了系统授权和管理的复杂度。The Information Grid （IG） presented in this article is aimed at providing different units in the multiple virtual organizations （VO） with uniform information safely and rapidly, accurately and reliably. Its security frame takes up the designing idea and implementation of GSI, especially in communication protection, authentication and agency certification mechanisms. Yet the GSI authorization is not suitable for information grid stream as it is too simple and its supplement of the authorization mechanism CAS is too centralized. According to the Role - based Access Control （RBAC） , the VO authorization service strategy （VOAS） is presented, by which the problems of the delicate authorization and extensibility of globus are solved. The result of simulations shows that the VOAS strategy will not affect the efficiency of the system, and instead, the complexity of the accessing control is reduced.

关 键 词：信息栅格 授权服务策略 角色访问控制 栅格安全基础设施 

分 类 号：TP338.8[自动化与计算机技术—计算机系统结构]