KR20070076342A - User Group Role / Permission Management System and Access Control Methods in a Grid Environment - Google Patents

Abstract

A system for managing a role/authority of a user group in a grid environment and an access controlling method thereof are provided to increase a security service level by setting access authority to whole components comprising grid computing when a user is logged in and efficiently managing the access right set to each user. The system comprises a certification server system, a linking system, an access control list database(321), and a data converting module. The certification system issues a certificate added with a user access authority level. The linking system links an access authority database and the grid computing environment through a user certificate field. The data converting module converts data between the linking system and the access control list database. A user interface is linked with the linking system.

Description

User Group Role / Permission Management System and Access Control Method in Grid Environment {.}

1 is a block diagram of a system applied in the present invention

2 is a process flow diagram in accordance with the present invention.

3 is a correlation between each module and the order of obtaining the level / access authority described in FIG.

** Description of symbols for the main parts of the drawing **

DETAILED DESCRIPTION OF THE INVENTION The present invention relates to setting a role / permission group for a user in a grid computing environment and a method for controlling access to grid resources through the grid computing environment. In detail, the present invention relates to a grid portal system and resources in a grid computing environment. It assigns property values for access rights to users and user groups attempting access, and based on them, hardware resources such as system, resources (process, memory, file system, etc.) accessible through interworking with group management and access control system. And the extent to which the software and data can be performed and the tasks that can be performed (type and number of processes, scope of data utilization, telecommunications, functional classification, menus, etc.).

A grid computing environment is a combination of unused parts of computing resources owned by different institutions or regions to form a virtual machine. If the access control for the user and the group is not implemented in the grid computing environment as described above, there is a disadvantage in that it is vulnerable to system protection due to unreasonable access to resources and functions. In other words, there is a need for explicit control of users' indiscriminate access to system resources, data, and functions.

In a conventional grid computing environment, an access control method for users and groups is as follows.

Currently, the middleware that is most used to build grid computing environment at home and abroad is Globus. The middleware is a middle layer that connects users and hardware resources, and software that provides tasks and security services such as management, search, and allocation of users and resources.

Since Globus has focused on providing services for user authentication and authorization delegation using certificates, it does not include detailed access control such as the present invention. We are conducting research to solve through the introduction.

However, such a mechanism requires the addition of separate modules for handling SAML and XACML in addition to the existing security modules of Globus. This makes the system complicated and it is difficult to control access in general network environment, not Internet based. The problem is that it becomes difficult.

In order to solve the above problems, in the present invention, before issuing a user certificate, a system, a resource, and a function that can be accessed by a user are combined through a combination of a user registration system and an access control system. This is defined as an extension field of the certificate so that it can be referred to when issuing a certificate for user authentication.

In addition, through the addition of an access list database, a user registration and management system, etc. to clarify the roles and access rights of each user and group and enable efficient management of them, user registration, access authority and registration, and authentication through this In addition, security services required to perform tasks in grid computing environments, such as setting access privileges and access, can be performed simultaneously with user login.

An object of the present invention is to set the access rights for all the components constituting the grid computing at the time of the user login, and to enable efficient management thereof, and to improve the security service level compared to the existing system. The purpose is to make it possible.

The present invention relates to a method for granting access to, controlling and managing users and groups in a grid computing environment.

Grid user group management and access control system in the present invention, a user registration and management system for assigning the DN value to the group to which the user belongs to users who want to use the grid computing environment, and manages it; Certificate issuing system by defining attributes, random values, and security levels according to security levels; A security policy database in which roles and access rights according to user groups are set; It consists of an access control system through a user group and a certificate, and is connected to a user interface for interworking with the system.

In the present invention, the access control system and the security policy database, which are the most important functions of the present invention, set an access right in an extended field of a certificate and use the detailed description of the entire access control list as a basic system for using the same.

In general, access control lists provide a one-to-one detailed description of the systems, resources (files, data, hardware resources, etc.) accessible to users, and the operations performed (type and number of processes, availability of application applications through hardware resources, etc.). It is to set the authority. Its authority shall be configured to facilitate addition and deletion by the administrator.

The system proposed in the present invention identifies the user's disposition at the same time as the user registration through the access control list for the user and the group, grants the access authority related to the system access and generates the certificate through this, and the attribute value of the certificate The present invention relates to a method for granting a corresponding access right while a user logs in, and describes the originality and excellence of the present invention through the accompanying drawings.

1 is a block diagram of a system applied in the present invention.

As shown in FIG. 1, the system of the present invention is a system for assigning a grade through role and propensity analysis for users and groups, and granting access rights through the same. In the above, the attribute value of the certificate extension field is configured to map 1: 1 with the access control list according to the classified group, and is configured to perform the access right operation at the user login step through this value.

An overview of the system configuration and service flow in FIG. 1 can be summarized as follows. The system of the present invention largely includes users and groups, a user registration and management system, a user certificate, a user rating module, a rating database, a rating / search / conversion module, and a rating access control list.

In the present invention, the user certificate is configured by adding a field specifying the user's access authority level in the extended field. In order to issue such a certificate, a new field of a certificate issued by an existing certification authority should be reconfigured and the access policy accordingly must be reconfigured.

User registration and management system is a system that registers and manages users who want to use grid computing environment. It grasps user's inclination and decides by appropriate level and plays the role of management task.

The user class module retrieves the class attribute value of the extension field included in the certificate at the login stage, and retrieves it from the class definition database to map information corresponding to each class.

The rating definition database defines values that are subdivided according to user preferences (subject to organization, role, type and size of work to be performed, required functions and hardware equipment, etc.).

The class search / transform module and the class access control list perform key functions in the system of the present invention. The class search / conversion module is a module for searching an access control list for each class according to the acquired user class and granting actual access authority according to the corresponding information. Class access control list is composed of setting information about accessibility according to all elements of grid computing.

2 shows a flow chart for granting access according to the present invention.

Typically, step S_1 for user login is omitted.

The user group information is extracted (S_2) from the extended field of the certificate used when the user performs the login process. The extracted group information is transmitted (S_3) to the access control module.

The user rating module, which has received the information, searches for the corresponding rating in the rating definition database, and determines the rating and access authority accordingly (S_4).

The module, which has received the user class and access authority, searches the access control list database to define the access authority of the corresponding user in detail, and delivers it to the access control system (S_5, S_6).

The access control system receiving the user's access authority grants the user's access (S_7) and at the same time grants the related authority and completes the login procedure (S_8).

3 illustrates a correlation between the sequence described in FIG. 1 and each module.

That is, FIG. 5 is a process for acquiring the level and access authority for the users and groups described with reference to FIG. 1.

The information logged in by the user is transmitted to the system 200 for user grade management and access authority, and the user grade management and access authority system receiving the information acquires information related to the user grade in the certificate (S3_2). This is transmitted to the authority conversion module S3_3. The authority conversion module extracts the group information mapped to the grade from the grade definition database 311, and obtains the authority through this (S3_4).

The acquired permission level is searched through the access authority conversion (S3_5) to search the database 321, which stores each level and permission, and an access control list thereof, to obtain access rights according to each level, and to manage the user level. The login process is completed by sending to the authorization system.

The user and group classes defined in the user certificate are the access rights. Parsing  Through this, the defined group information retrieved from the database is obtained. The obtained group information is passed through the authority acquisition and access authority conversion module, and the detailed access authority retrieved from the database is obtained. The access rights obtained through this process can grant access rights for each user to the entire system, resources, and tasks constituting the grid computing resources, and can solve security vulnerabilities in the existing grid computing environment.

The present invention made as described above helps to implement an efficient access control policy for users using a grid computing environment by building a user and group grade based access control system.

In addition, the present invention provides information related to access authority setting when registering users and groups, thereby solving the complexity and management problem of authority setting that varies according to each task in the future use of the grid computing environment.

In addition, the user certificate-based access control system according to the present invention complies with existing international standards and proposes an improvement thereof, so that the present invention can be applied to a distributed system environment similar to the grid computing environment.

Claims (2)

A user registration and access control system for performing a task requested by a user in a grid computing environment, An authentication server system for issuing a certificate to which the user access authority level is added; A system for associating an access authority database with a grid computing environment through a user certificate field; Class access control list database; A user group role / permission management system and an access control system in a grid environment, comprising a module for converting data between the linkage system and the access control list database for each level, and a user interface for interworking the system. . In a method for granting users and groups access in a grid computing environment, Converting the grade information obtained through the user certificate and obtaining access authority through a database search; User access control method in a grid environment, characterized in that consisting of.

Images