面向多域环境的访问控制技术研究与实现

发布时间：2018-05-03 10:04

本文选题：SOA + 身份认证　；参考：《西安电子科技大学》2015年硕士论文

【摘要】：SOA是当前广泛被使用的网络资源发布和访问的重要支撑手段,而基于SOA的网络环境经常建立在开放性、异构性极大的公共网络中,容易遭到由内部或外部原因引起的安全威胁。在面向服务的环境中,访问控制是安全需求中极其重要的组成部分,它包括身份认证和授权处理。因此,研究面向服务体系框架下的身份认证和授权等访问控制相关技术,设计并实现跨域和认证授权系统变得极具意义。本文首先在充分研究相关技术的基础上,对跨域的身份认证和授权系统的需求进行分析,为跨域的身份认证授权系统做出一个整体框架。根据需求,本文设计并实现域内的身份认证系统。该系统基于公钥基础架构的证书权威,使用PKI认证技术,实现了域内的登录认证功能;在域内认证的基础上,使用证书链和签名令牌两种方法实现了跨域认证功能,证书链验证可以将各个信任域方便地连接起来,各个信任域通过证书链验证彼此建立信任关系,而无需建立中间的审判机构。令牌验证可以通过一次认证,得到令牌,为后续授权以及其他操作提供凭据。最后从各个方面对系统进行了安全性分析,本文实现的跨域认证系统在保证基本功能的同时,还具有一定的安全性。本文基于现有的ABAC模型,提出了一套基于属性的动态授权模型。并以此为基础,分析跨域授权需解决的基本问题,设计并实现了一个基于属性映射和信任关系管理的跨域授权模型。属性映射服务制定了一套属性映射规则,通过规则将外域用户在本域无法使用的属性映射成本域授权服务可用的属性,以此顺利完成跨域授权,同时还保护了外域用户的隐私属性。信关系管理将各个信任域的关系量化为一个值以管理授权服务,提高了系统的安全性,而且信任值还能根据授权服务的结果进行动态调整。本文对实现的功能进行了测试,验证论文设计的各个功能的正确性和安全性。
[Abstract]:SOA is an important supporting means for the widely used network resource release and access, and the network environment based on SOA is often established in the open and heterogeneous public network, which is vulnerable to the security threat caused by internal or external reasons. In a service-oriented environment, access control is an extremely important component of security requirements, including authentication and authorization processing. Therefore, it is of great significance to study access control technologies such as identity authentication and authorization under the framework of service-oriented architecture, and to design and implement cross-domain and authentication authorization systems. In this paper, based on the full study of related technologies, the requirements of cross-domain authentication and authorization system are analyzed, and an overall framework for cross-domain authentication and authorization system is made. According to the requirements, this paper designs and implements the identity authentication system in the domain. This system is based on the certificate authority of public key infrastructure, uses PKI authentication technology, realizes the login authentication function in the domain, and realizes the cross-domain authentication function by using the certificate chain and the signature token on the basis of the authentication in the domain. Certificate chain verification can easily connect each trust domain. Each trust domain can establish trust relationship with each other through certificate chain, without establishing intermediate trial organization. Token validation can be authenticated once, get tokens, and provide credentials for subsequent authorization and other operations. Finally, the security of the system is analyzed from various aspects. The cross-domain authentication system implemented in this paper not only guarantees the basic function, but also has certain security. Based on the existing ABAC model, this paper proposes a dynamic authorization model based on attributes. Based on this, the basic problems of cross-domain authorization are analyzed, and a cross-domain authorization model based on attribute mapping and trust relationship management is designed and implemented. Attribute mapping service formulates a set of attribute mapping rules through which the attributes that can not be used by users outside the domain can be mapped to the attributes available to the cost domain authorization service, so that the cross-domain authorization is successfully completed. At the same time, it also protects the privacy property of the users. Trust relationship management quantifies the relationship of each trust domain into a value to manage the authorization service, which improves the security of the system, and the trust value can be dynamically adjusted according to the result of the authorization service. In this paper, the functions are tested to verify the correctness and security of each function designed in this paper.
【学位授予单位】：西安电子科技大学
【学位级别】：硕士
【学位授予年份】：2015
【分类号】：TP393.08

【相似文献】