网格中安全策略的描述和评估

网格中安全策略的描述和评估陈昕2002.3.17AdditionalProblemsposedbyMultipleAdministrationPolicyintegrationshouldincorporatethediverseauthorizationmodelsthatcancoexistinadistributedsystem.Integratedifferentsetsofpoliciesassociatedwiththedomainprovidingresources,thedomainrequestingresourcesandtheindividualuserswithineachdomain.NosinglesyntaxforspecificationofprincipalsAgeneralizedwaytodefineapplication’ssecurityrequirementsAuthorizationFrameworkPolicylanguageGenericAuthorizationandAccess-controlAPIPolicyLanguageElements:accessidentitygrantoridentityasetofaccessrightsasetofconditionsPolicylanguage(continued)Policylanguagerepresentsasequenceoftokens:–Tokentype–Definingauthority–ValueExtendedAccessControlLists(EACLs)e.gTokenType:access-id-ANYBODYTokenType:access-id-GROUPDefiningAuthority:noneDefiningAuthority:DCEValue:noneValue:15TokenType:pos-access-rightsTokenType:pos-access-rightsDefiningAuthority:local-managerDefiningAuthority:local-managerValue:FILE:readValue:FILE:readFILE:writeTokenType:authentication-mechanismTokenType:locationDefiningAuthority:system-managerDefiningAuthority:system-managerValue:kerberos:V5Value:*.USC.EDUExtendedAccessControlLists(continued)CredentialEvaluationExtendedAccessControlLists(continued)IdentityCredential:[e-mail]:time-windowpacific-tzon[e-mail]:privilege:restrictedDelegationcredentialgrantor:[e-mail]:[e-mail]:doc.txtrights:pos-access-rightslocal-managerFILE:writecondition:locationlocal-manager*.ustc.edu.cnGAA-APIGAA-APIfunctionsgaa-get-object-policy-infogaa-check-authorizationgaa-inquire-object-policy-infoGAA-APISecurityContextIdentityAuthorizationattributesEvaluationandRetrievalFunctionsforUpcalls