基于角色映射的服务组合访问控制架构

Access Control Architecture of Service Composition Based on Role Mapping

提出了一种基于角色映射的服务组合访问控制体系架构,用来解决服务组合过程中的访问控制问题。架构主要由服务组合访问控制中心和若干服务组合访问控制节点组成,服务组合访问控制中心的核心功能是建立和维护各服务所在安全域之间的角色映射信息,并从全局角度协调服务组合中的访问控制,服务组合访问控制节点是对各安全域访问控制系统的抽象,是访问控制的实施点,具有独立性。在此基础上,架构采用广泛应用于分布式环境的"推模式"授权机制,在实现服务组合中各服务之间的安全调用与协同的同时,又能在很大程度上保持各服务所在安全域的相对独立性和安全性,因而提出的架构具有较好的适应能力和可扩展性。

An access control architecture based on role mapping for service composition is proposed to solve the access control problem in service composition process. The architecture is composed of an access control center and some access control nodes. The core functions of the access control center are to set up and maintain the role mapping information among the security domains, and harmonize the access control for the service composition from the global perspective. The access control node is an abstraction for the access control system of each security domain, and it is the execution point for access control with independence. Furthermore, the architecture adopts an authoriza- tion mechanism called ＂push mode＂ that is widely applied in distributed environment. Consequently, not only the access control of service composition can be well implemented in the architecture, but also the independence and security of the participant domains can be pre- served. Thus the applicability and extensibility of the proposed architecture is finer relatively.