針對網格基礎架構下的分散式認證與授權框架的研究

Distributed Authentication and Authorization Framework for Grid Infrastructures

孫開平(Saffiong Kebbeh)

指導教授 ： 孫宏民

國立清華大學/電機資訊學院/資訊系統與應用研究所/碩士(2007年)

摘要

As computer and network systems are vulnerable to attacks, abandoning the existing
huge infrastructure of possibly-insecure computer and network systems is impossible, as
well as replacing them with totally secure systems may not be feasible or cost effective. A
common element in many attacks is that a single user will often attempt to intrude upon
multiple resources throughout the network. Detecting the attack can become significantly
easier by compiling and integrating evidence of such intrusion attempts across the
network rather than attempting to assess the situation from the vantage point of only a
single host. This thesis proposes a system to provide security for the grid infrastructure
where authorization and authentication will be made scalable by setting up an
authorization framework at the resource provider’s end. This intends to relieve the grid
infrastructure from having to take responsibility of authorization, and also improves the
resource provider’s trust in the request from the data portal as the authorization
information will be from its own organizational authorization server. We will
demonstrate that this architecture is secure, scalable, and robust, by improving the
existing authorization mechanism.

關鍵字

Credential ； Distributed ； Domains ； Grid ； Policies ； Resources ； Security ； Virtual

並列摘要

無資料

並列關鍵字

Credential ； Distributed ； Domains ； Grid ； Policies ； Resources ； Security ； Virtual

參考文獻

[31] T. W. Lam, T. W. Ngan, K. K. To, " On the speed requirement for optimal deadline scheduling in overloaded systems," Proceedings of the 15th International Parallel & Distributed Processing Symposium (IPDPS-01), San Francisco, California, April 2001.

[2] A. Schulter, J. Albuquerque Reis, F. Koch, C. Becker Westphall, “A Grid-based Intrusion Detection System,” IEEE International Conference on Networking, International Conference on Systems and International Conference on Mobile Communications and Learning Technologies (ICNICONSMCL'06) Brazil, pp 1-6, 2006.

[4] B. C. Neuman and T. Ts’o, “Kerberos: An authentication service for computer networks,”. IEEE Communications Magazine, 32(9), pp 33-38, September 1994.

[5] C. Bettini, S. Jajodia, X.S. Wang, and Wijesekera, “Obligation Monitoring in Policy Management,” Proceedings of the 3rd International Workshop on Policies for Distributed Systems and Networks, Washington, pp 1-2, 2002.

[7] D. Chadwick and O.Otenko. “The PERMIS X.509 role based privilege management infrastructure,” in 7th ACM Symposium on Access Control Models and Technologies, Salford, pp 1-18, December 2002.