网格中安全策略的描述和评估ppt课件

1、网格中平安战略的描画和评价陈 昕2002.3.17 Additional Problems posed by Multiple AdministrationPolicy integration should incorporate the diverse authorization models that can coexist in a distributed system.Integrate different sets of policies associated with the domain providing resources,the domain requesting reso

2、urces and the individual users within each domain.No single syntax for specification of principalsA generalized way to define applications security requirements Authorization FrameworkPolicy languageGeneric Authorization and Access-control APIPolicy LanguageElements: access identity grantor identity

3、 a set of access rights a set of conditionsPolicy language (continued)Policy language represents a sequence of tokens:Token typeDefining authorityValueExtended Access Control Lists(EACLs)e.gToken Type:access-id-ANYBODY Token Type:access-id-GROUP Defining Authority:none Defining Authority:DCEValue:no

4、ne Value:15Token Type:pos-access-rights Token Type:pos-access-rightsDefining Authority:local-manager Defining Authority:local-managerValue:FILE:read Value:FILE:read FILE:writeToken Type:authentication-mechanism Token Type:locationDefining Authority:system-manager Defining Authority:system-managerVal

5、ue:kerberos:V5 Value:*.USC.EDUExtended Access Control Lists(continued)Credential EvaluationExtended Access Control Lists(continued)Identity Credential: access-id-USER kerberos.v5 tomORG.EDU condition:time-window pacific-tzone 6am-7pmGroup membership credentialaccess-id-GROUP kerberos.V5 adminORG.EDU

6、condition:privilege:restrictedDelegation credential grantor:grantor-id-USER kerberosV5 joeUSTC.EDUgrantee:acess-id-USER kerberosV5 tomUSTC.EDUobjects:doc.txtrights:pos-access-rights local-manager FILE:writecondition:location local-manager *.GAA-APIGAA-API functionsgaa-get-object-policy-infogaa-check-authorizationgaa-inquire-object-policy-infoGAA-AP