网格计算中虚拟组织的授权机制

Authorization mechanisms for virtual organization in grid computing systems

分析了网格计算系统中虚拟组织管理的授权需求,提出使用门限闭包作为网格计算系统中面向虚拟组织的授权服务机制。既分析了门限闭包的适用性,也指出了它在具体实施时所存在的局限性,在此基础上提出一种新的授权服务体系,设计了基于公钥基础设施PKI的访问控制工作协议,并结合现有网格计算系统的安全基础设施设计了相应的授权服务系统架构。该体系通过分离门限闭包策略和实现机制,既保证了对复杂授权策略的处理效率和处理能力,也充分利用了现有网格安全基础设施。

This article analyzes authorized demand for management of virtual organization in the grid com puting system and consequently proposes using threshold closure as authorized service mechanism for virtual organizations in the grid computing system. The study not only analyzes the applicability of the threshold closure but presents the limitations of the specific implementation and based on which, a new authorization service sys tem is put forward and the access control protocol based on the public key infrastructure as well as the corresponding authorization service architecture combined with the existing security infrastructure in grid computing system are designed. The architecture guarantees the processing efficiency and capacity of the complex authorized strategy, and meanwhile it makes full use of the existing grid security infrastructure through the separation strategy of the threshold closure and implementation mechanism.