【作者】 马珂绛；

【导师】 蔡家楣；

【作者基本信息】 浙江工业大学 ， 计算机应用技术， 2005， 硕士

【摘要】 网格是人们为了满足不断攀升的计算能力需求而提出的一个全球性解决方案,与传统网络环境不同,网格中计算资源,用户都是动态的分布,网格环境中虚拟信任关系需要动态的创建和消亡,它需要突破地理位置的限制,突破传统共享及协作能力的限制,突破各独立域上安全机制对计算资源的限制,形成一个全新的,更自由的,更方便的资源共享,解决传统网络技术无法解决的问题。 怎样在一个动态的、跨域的分布式计算环境中安全的共享资源,融合原有各自独立域的安全环境,又不对它们内部运作产生较大的影响,这对网格计算提出了一个更高更广泛的安全需求,是网格安全环境解决方案的核心问题,也是必须解决的问题。 本文详细研究了国际上现有的网格安全解决方案,Globus项目中的(GSI:Grid Security Infrastructure),结合当前先进的信息安全技术,在“核心协议—信任模型—基础设施”由下至上三个层次上对网格安全的性能、授权机制、代理证书管理方面提出了改进和加强的意见,以增强环境的安全性,灵活性和实用性: 1.引入证书缓冲对Web Services Security协议进行扩充,以提高网格中实体交互认证的性能。 2.引入基于角色的多身份部分权限委托信任模型,其中包括对跨组织的角色转换进行支持,以面向安全操作为单位的粗粒度替换原有GSI中的身份映射机制,并提出相关的算法(基于角色的信任凭证映射和访问控制等)。 3.提出一个功能类似于MyProxy的证书钱包(CredentialWallet)服务,用于允许用户使用密码认证的方式通过网络得到代理证书,并且为那些需要长时间运行的任务提供自动证书刷新,以增强网格使用的便捷性。 最后本文还设计了一个物流项目中的网格安全应用实例,对整个改进后的网格安全基础设施进行了成功的应用测试和分析。更多还原

【Abstract】 Grid is a global solution to address the requirements of more and more computing ability. Grid is different from traditional network. Computing resources and users are distributed in a grid is dynamic. A virtual trust relationship must be established and destroyed dynamically. The virtual trust relationship need to break through the location of geography, the means of share or cooperation, and constrains of using computational resources in each independent security mechanism. Grid computing system will help people to solve many problems that could not be solved previously. It is a new way, looser and more convenient.In contrast to traditional network environment, grid environments have a broader rang of security requirements. How to share resources safely in a dynamic, interdomain and distributed computing environment, and how to interoperate with, rather than replace and modify, those security mechanisms is a greater challenge for grid computing system, and is also the principal problem of the security environment platform for grid.Grid Security Infrastructure (GSI) is the implementation of existing grid security solution of OGSA in Globus Toolkit. Based on GSI and advanced information security technologies, this paper presents several opinions to improve and strengthen the safety, flexibility and practicability of grid security. In the aspects of protocols, trust model and security infrastructure, performance of grid security, the mechanism of authorization and the management of proxy certification are improved.1. In order to enhance performance of Mutual Authentication between two entities, certificates Caching is imported to expand Web Services Security protocol.2. Role-based multi-identities partial privilege delegation trusted model is introduced. Role-based authorization mapping can be solved in an interdoman computing environment. Identity-mapping in GSI is replaced by security operation-oriented delegation. Corresponding arithmetic of security operation-oriented delegation is put forward. (Role-based credential mapping and access control).3. A CredentialWallet service that allows users to obtain proxy credentials over更多还原