一种电力企业分布式文件系统身份认证解决方案  

An Authentication Solution of Distributed File System of Power Enterprises

作　　者：张春平[1,2] 马志程 张琦[1,2] 刘铭[1,2] 

机构地区：[1]南瑞集团公司(国网电力科学研究院),江苏南京210009 [2]南京南瑞信息通信科技有限公司,江苏南京210009 [3]甘肃同兴智能科技发展有限责任公司,甘肃兰州730000

出　　处：《自动化技术与应用》2017年第3期23-26,31,共5页Techniques of Automation and Applications

基　　金：国家电网公司科技项目(编号524606150122)"基于国产服务器的分布式文件系统关键技术研究"

摘　　要：随着分布式文件系统在国家电网公司等电力企业的广泛应用,分布式文件系统安全已经变得日益重要,而身份认证作为第一道防线,在分布式文件系统安全体系中具有重要地位。结合国家电网公司现有系统现状及基础设施条件,设计了国家电网公司分布式文件系统身份认证解决方案。方案以Kerberos改进公钥证书协议为基础,并引入国网公司数字证书库和CA系统作为可信任第三方,实现了国家电网公司分布式文件系统的加密身份认证,提升了安全性。此外,还将认证系统与国家电网公司现有统一权限系统进行集成,利用统一权限系统的LDAP来管理用户和权限信息,具有安全性高、扩展性强、管理方便等诸多优点,同时在LDAP协议的支持下加快了应用认证速度。With the development of application of distributed file system in state grid, its security has become more and more important. In the security mechanism, the authentication is one of cores. On the base of existing infrastructure, the authentication solution of distributed file system is provided. In the solution, by use of improved Kerberos protocol which is base of public key certificate, authentication of distributed file system and encryption management are achieved in which the digital certificate repository and CA system are as the trusted third party. In addition, the authentication system is integrated with existing unified authority system. With its LDAP protocol, the user and permission can be supervised. The solution can accelerate the application certification and has the advantage of convenient management, safe, scalable, etc.

关 键 词：KERBEROS协议 数字证书 统一权限管理系统 CA LDAP 

分 类 号：TP391.41[自动化与计算机技术—计算机应用技术]