OpenStack认证后端的安全性研究与改进  

Security Research and Improvement of OpenStack Authentication Backend

作　　者：田晓丽[1] 袁征[2] 张宁[1] 

机构地区：[1]北京电子科技学院研究生处,北京100070 [2]北京电子科技学院信息安全系,北京100070

出　　处：《北京电子科技学院学报》2016年第4期26-31,共6页Journal of Beijing Electronic Science And Technology Institute

摘　　要：Open Stack作为当今最流行的开源云平台,在当前的使用过程中其安全性也越来越受到人们的重视和研究。本文在分析Openstack平台架构的基础上,重点分析了openstack认证组件keystone的工作原理,以及用户在登陆云平台时keystone的交互过程。以keystone作为openstack身份认证安全性问题的切入对,提出了其认证后端数据库利用率和安全性不足的问题,并以LDAP轻量级目录服务协议为基础提出了openstack认证后端的安全性改进方案。As one of the most popular open-source cloud platform, the security of OpenStack is paid more and more attention recently. Based on the analysis of the Openstack platform, this paper analyzes the working principle of authentication module keystone and the interaction process of the user in the keystone. Taking keystone as the starting point of the security problem of Openstack identity authentication, we put forward the authentication backend database utilization and the problem of insufficient security, and propose the security improvement scheme based on LDAP lightweight directory service protocol.

关 键 词：OPENSTACK KEYSTONE 身份认证 轻量级目录访问协议 

分 类 号：TN918.912[电子电信—通信与信息系统]