基于XACML的网格授权服务的设计与实现

Design and implementation of grid authorization service based on XACML

为更好地解决网格环境下分布式跨域授权问题、增强授权功能的可扩展性和可复用性,构建了基于可扩展访问控制标记语言(extensible access control markup language,XACML)规范的网格授权框架。在该框架的基础上,依照Web服务资源框架和Web服务通知规范,设计实现了基于XACML策略引擎的网格授权服务。将复杂的模块交互调用封装在授权框架内,通过简单易用的服务接口实现域间互操作时的权限分配。实现结果表明,该框架更加灵活,适用于动态、异构的网格环境。

To resolve better the distributed cross-domain authorization problem in grid environment and enhance the expansibility and reusability of the authorization function, an XACML based grid authorization framework is constructed. Based on the framework and according to WSRF and WSN specifications, an XACML policy engine based grid authorization service is designed. The complex in- teractive behaviors are encapsulated in the authorization framework. The simple and user-friendly service interfaces can help to realize the privilege assignment during the interoperations between domains. The service based authorization framework is more flexible and suits better to the dynamic and heterogeneous grid environment.