分布式计算机系统安全信任关系建立的分级机制(IJCNIS-V6-N6-6)

I.J.ComputerNetworkandInformationSecurity,2014,6,41-47PublishedOnlineMay2014inMECS()DOI:10.5815/ijcnis.2014.06.06Copyright©2014MECSI.J.ComputerNetworkandInformationSecurity,2014,6,41-47TheRatingMechanismfortheTrustedRelationshipEstablishmentfortheSecurityoftheDistributedComputerSystemsVadymMukhinNationalTechnicalUniversityofUkraine―KievPolytechnicInstitute‖,ComputerSystemsDepartmentE-mail:[e-mail]—Thereissuggestedamethodforthetrustlevelestablishmenttothenodesofdistributedcomputersystems(DCS)takenintoaccountthedynamicsoftheinformationvaluechangingandwiththein-timerecordsofthesecurityincidentsfromthenodes.TheproposedmethodoftheDCSnodesratingestablishmentallowsadaptivelyandduringtheDCSfunctioningtodetermineasafetyconfigurationofresources(nodes)fortheinformationprocessingintheDCS.Also,thereisdescribedthespecificsoftheimplementationofthemechanismsforthenodestrustlevelestablishment.Indexterms—DistributedComputerSystems,Security,Nodes,TrustLevel.I.INTRODUCTIONTheinformationsecuritymechanismsforthedistributedcomputersystemsshouldsolvethefollowingthreemainproblems[1,2]:•theintegrationofthedevelopedsecuritymechanismsintotheexistingcomputersystems;•theinteroperabilityofthesecuritymechanismswiththedifferentsoftwareplatformsandenvironments(J2EE,.NET,Linux-server,etc.);•thetrustedrelationshipestablishmentbetweentheinteractingDCSnodes.Inviewofthefact,thattheDCSsecuritymechanismscovermanydomainsinthesystem,thetrustrelationshipsbetweenthemplaythespecialrole.ThetrustbetweentheDCSdomainsandnodesmaybeconjectural,bebasedonthetopologicalfeatures,eitherbeexplicit,specifiedwiththeformalpoliciesandsupportthemandatesexchange.Thetrustestablishmentisperformingseparatelyforeachsession,ordynamicallyondemand[3-8].DuetothefactthatintheDCSdomainsthereareusedthedifferenttechnologies(computernetworkauthenticationprotocolKerberos,public-keyinfrastructure-PKI,etc.)duringthetrustestablishmentmechanismsimplementationshouldbetakenintoconsiderationthespecificsofthesecuritymechanisms.Theproblemoftrustedrelationshipestablishmentisactualduetotheneedtosupportthedynamicandcontrolledlaunchingofservices,whichareinitiatestoperformthecertaintasks[3-8].Forexample,inadistributeddataprocessingsystemthetemporaryservicesarecreatingfordataretrievingfromaremoterepository,aswellasforthesynthesisofresults.Theprocessofthetrustedrelationshipsestablishmentisbasedonthefollowingaspects[9-11]:•authorization:itisrequiredtodetermineexactlywhichsubjectistheinitiatorofservicelaunching;•policiesestablishment:subjectsshouldbeabletocreatetheirownpolicies,inparticular,todeterminethesubjects,thatcangetaccesstotheservicesandthecorrespondingallowableactions,andthesubject’slocalpolicymustcomplywiththeDCSsecuritypolicy;•thelevelofnodereliability:beforethetasksinitiationthesubjectmayrequestevaluationofthenodesreliability,whichincludesthefollowingcriteria:theanti-virusprotection,thethefirewallsimplementation,theVirtualPrivatNetwork(VPN)modefordataexchangewithintheDCS,etc.Toperformthisevaluationtheaccreditationmechanismiscommonlyused,wherethelevelofnodereliabilityisdeterminedonthebasisoftheindependedexpertsreview;•complexformationofthepolicies:securitypoliciesforDCSservicesarecreateddynamicallytakenintoconsiderationtheseveralfactors:theowneroftheresource,theinitiatoroftheservicelaunch,thespecificsofthevirtualsystem,whichisrealizedtheservices,etc;•accessrightsdelegation:insomecases,thetemporaryservicesperformtheactionsonbehalfofthesubjectthathascreatedthem,forexample,somecomputationalprocessmayrequestsdatainthedifferentDCSdomains.Inthiscase,betweenthedomains,whichruntheservicesandtheonethattherequestperforms,cannotbeestablisheddirectlythetrustedrelationships,thentheservicemustbeabletoperformactionswiththerightsofitssubject-initiator.Thisrequirement,inturn,raisesanumberofissues,including:theprincipleofprovidingthepartialaccessrightsofthesubjecttotheservice,amechanismforresolvingsituationswhenthevalidityofdelegatedaccessrightswillbeoverbeforetheservicewillbecompleteitsactions[9].OneofthepossibleapproachtosolvethisproblemistoimplementthecontrolledaccesstoDCSresourcesandservices.TheGlobalGridForum(GGF),currentlynamedOpenGridForum(OGF),hasdevelopedOpenGridStandardsArchitecture(OGSA)fortheGridsystems,andthemostimportantelementofthestandard42TheRatingMechanismfortheTrustedRelationshipEstablishmentfortheSecurityoftheDistributedComputerSystemsCopyright©2014MECSI.J.ComputerNetworkandInformationSecurity,2014,6,41-47isGridSecurityInfrastructure(GSI),whichdescribesthemainchallengesandrequirementsforsafetyensuringfortheGridsystems.Inthispaperaredescribedthemechanismforthetrustlevelestablishmentbetweenthenodesofthedistributedcomputersystem.ThereissuggestedanapproachtoformthetrustleveloftheDCSnodesonthebasisoftheanalysisofthedynamicsoftheprocessedinformationvaluechanging.Alsotheseisproposedthemethodforthedcsnodesratingestablishmentconsideringthedynamicsoftheinformationvaluechangingandisdescribedthespecificsoftheimplementationofthesecuritymechanismsforthedistribut