跨社区访问的两阶段授权与验证

文章从分析信息网格跨社区共享的环境和要求出发,提出了两阶段授权和验证的概念。在信息网格的各管理域中,访问控制机制和策略都可能是异构的,这给跨社区的共享授权带来了很大的困难。两阶段的授权是首先将共享权限作为一个整体授予使用资源的社区,然后再由它对社区内的用户进行权限分配。通过将跨社区的授权和验证分为功能和目的不同的两个阶段来实现,可以较好地满足信息网格中资源共享对访问控制的需要。

Two-phase Authorization and Validation of Access Across Communities

The concept of two-phase authorization and validation is proposed after analyzing the environment and re-quest of resource sharing across communities in information grid.In different management domains,both the mechanism and policy of access control are potentially heterogeneous,which introduces great difficulty into authorization across com-munities.In two-phase authorization method,permissions of sharing resources are granted to the community using them as a whole at first and in the second phase end users are authorized in the control of the community.Two-phase au-thorization and validation method dividing the task into two phases by different function and purpose can meet the need of access control mechanism for resource sharing in information grid.