網格安全互操作及其应用研究.docVIP

网格安全互操作及其应用研究* 邹德清1, 邹永强2, 羌卫中1**, 金海1, 覃安2, 王凯1 服务计算技术与系统教育部重点实验室暨集群与网格计算湖北省重点实验室，计算机科学与技术学院，华中科技大学，430074，武汉1 中国科学院计算技术研究所，100080，北京2 摘 要 网格计算为地理分布资源的聚合以及大规模计算问题的解决提供了技术途径，国内外大型网格项目都是基于某种网格平台构建，通过这些平台管理着本领域的资源/服务，为了聚合不同网格平台管理的资源/服务，需要实现异构网格平台的互操作。由于不同网格平台的安全机制不同，安全互操作是网格互操作中需要解决的一个关键问题。通过分析，当前网格平台通常具有网格全局用户身份以及虚拟组织层次结构的公共特征，基于网格平台的主体类型研究网格平台互操作映射策略，并提出一种通用的安全互操作流程。CGSP和GOS是国内两大知名的网格中间件，分别管理了大量的教育和科技资源，以CGSP和GOS的安全互操作为例，阐述了安全互操作策略映射机制及安全互操作流程的具体实现，并分析了网格平台间的授权及其一致性、映射策略的灵活性以及互操作流程的安全性。最后，对CGSP和GOS的安全互操作的性能进行了测试分析。 关键字 网格；安全互操作；映射策略；网格证书 中图法分类号 TP393 Grid Security Interoperation and its Application Abstract Grid computing emerges as an effective technology to couple geographically distributed resources and solve large-scale computational problems in wide area networks. Each famous international grid project is constructed with a specific grid platform, and different grid projects manage different distributed resources/services. In order to aggregate resources managed by different grid platforms, it’s necessary to implement the interoperation among these grid platforms. Security is one of key issues for the interoperation. Current popular grid platforms have such common properties as global user identity and virtual organization. In this paper, interoperation mapping policy and security interoperation process are proposed based on grid common properties. CGSP (ChinaGrid Support Platform) and GOS (Grid Operating System) are two popular grid platforms in China. Taking security interoperation between CGSP and GOS as an example, the implementation of interoperation mapping policy and security interoperation process are introduced. Authorization consistency, flexibility of mapping policies and the security of the interoperation process are analyzed. Finally, we analyze grid interoperation process between grid platforms. Key words grid; security interoperation; mapping policy; certificate 1. 引言 网格计算为地理分布资源的聚合以及大规模计算问题的解决提供了技术途径，当前国际上知名的网格中间件有Globus[1, 2], gLi