属性驱动的多策略网格授权机制研究

网格系统存在大量动态的访问用户和每个自治域有自己的访问控制策略,因此具有动态性和自治性的访问控制需求。基于属性的访问控制和网格系统的授权需求提出了一个属性驱动的多策略访问控制模型（MP_ABAC,Multipolicy_supported Access Control based on Attribute）并基于继承和封装思想和可扩展访问控制标记语言（XACML）设计了MP_ABAC授权框架。框架在网格访问控制中存在很大的优势,为网格授权系统提供了开放的架构,且能够集成第三方基于属性的授权系统。

Study on Attribute-driven Multipolicy_supported Grid Authorization Mechanism

The grid,for its large number of dynamic users and its own policy in each autonomous domain,demands dynamic and autonomous access control.This paper,based on the concept of ABAC and the authorization requirements of grid system,proposes a multipolicy_supported grid access control Model-MP-ABAC model.And an authorization framework based on inheritance,encapsulation idea and XACML is designed,thus to support MP_ABAC model.The authorization framework displays great advantages in supporting Grid access control,provides an open architecture for grid authorization systems,shows the effectiveness of MP_ABAC model,and could integrate the attribute-based third_party authorization system.