分布式授权服务的设计与实现-计算机软件与理论专业论文.docxVIP

摘要 面向服务架构因其很好的适应分布式环境和跨平台等特点，已经被广泛应用 于基础软件和大型信息系统的研发。但是由于 SOA 应用下资源共享程度的不断提 升，保障资源安全变的越来越重要。如何解决满足 SOA 应用的安全需求，是 SOA 研究中亟待解决的问题。 论文工作来源于实际项目。在面向服务的计算环境中，授权操作是安全需求 中非常重要的组成部分。本文深入研究了 SOA 系统中的授权操作，针对集中式授 权模型在面向服务的计算环境中存在的性能和可靠性等问题，提出了在已有的基 本授权模型中引入策略划分器和策略分发点来构造分布式授权模型，以应对面向 服务计算环境下的高并发量的授权访问请求。并采用贪心算法来有效的解决策略 划分时存在的集合划分问题。在分布式授权模型中策略决策服务设计方面，采用 了 SAML-XACML 发布安全和标准的授权服务接口。为了进一步提高策略决策服 务的效率，引入了自适应和索引等方法来提高授权评估速度，并采用属性缓存和 push 方式用以提高属性查找效率。 文中测试了引入索引与自适应的授权服务与基本授权服务之间的性能差别， 采用自适应和索引的授权服务在评估效率上有了很大的提升。在应对高并发量的 访问请求测试中，分布式授权模型在效率方面与集中式授权模型相比有很大的提 升。 关键词：面向服务的体系结构 授权模型 策略评估 SAML-XACML ABSTRACT Service Oriented Architecture has been widely used in foundational software and large scale information system because it can be well adapted to the requirements of distributed and cross-platform. However, due to the rise of resources sharing in SOA applications, ensuring the safety of resources is of increasing important. How to fulfill security requirement for SOA-based applications is a problem needing to be solved. This thesis comes from the actual project. Authorization plays a very important role for meeting the security needs in the service oriented computing environment. Therefore, firstly, this thesis has deeply researched authorization in SOA environment. Then, due to the problems of performance and reliability in centralized authorization model in SOA environment, the distributed authorization model has been proposed, which has been constructed by adding the policy divided point and the policy distribution point to the existing centralized authorization model. And the greedy algorithm is adopted to solve the problem of policy split efficiently. Secondly, SAML-XACML is used to release security and standard authorization service interface for designing policy decision services in the distributed authorization model. Additionally, in order to improve the performance of the policy decision service, adaptive and cluster techniques has been used to increase the performance of