Dynamically authorized role-based access control for grid applications

Grid computing is concerned with the sharing and coordinated use of diverse resources in distributed “virtual organizations”. The heterogeneous, dynamic and multi-domain nature of these environments makes challenging security issues that demand new technical approaches. Despite the recent advances in access control approaches applicable to Grid computing, there remain issues that impede the development of effective access control models for Grid applications. Among them there are the lack of context-based models for access control, and reliance on identity or capability-based access control schemes. An access control scheme that resolve these issues is presented, and a dynamically authorized role-based access control (D-RBAC) model extending the RBAC with context constraints is proposed. The D-RABC mechanisms dynamically grant permissions to users based on a set of contextual information collected from the system and user's environments, while retaining the advantages of RBAC model. The implementation architecture of D-RBAC for the Grid aplication is also described.     

Distributed role-based access control for coaliagion application

Access control in multi-domain environments is one of the important questions of building coalition between domains. On the basis of RBAC access control model, the concepts of role delegation and role mapping are proposed, which support the third-party authorization. Then, a distributed RBAC model is presented. Finally the implementation issues are discussed.     

Distributed role-based access control for coaliagion application

Access control in multi-domain environments is one of the important questions of building coalition between domains. On the basis of RBAC access control model, the concepts of role delegation and role mapping are proposed, which support the third-party authorization. Then, a distributed RBAC model is presented. Finally the implementation issues are discussed.     

Toward an integrated framework for geosensor grid

Abstract

Grid computing is deemed as a good solution to the digital earth infrastructure. Various geographically dispersed geospatial resources can be connected and merged into a ‘supercomputer’ by using the grid-computing technology. On the other side, geosensor networks offer a new perspective for collecting physical data dynamically and modeling a real-time virtual world. Integrating geosensor networks and grid computing in geosensor grid can be compared to equipping the geospatial information grid with ‘eyes’ and ‘ears.’ Thus, real-time information in the physical world can be processed, correlated, and modeled to enable complex and advanced geospatial analyses on geosensor grid with capability of high-performance computation. There are several issues and challenges that need to be overcome before geosensor grid comes true. In this paper, we propose an integrated framework, comprising the geosensor network layer, the grid layer and the application layer, to address these design issues. Key technologies of the geosensor grid framework are discussed. And, a geosensor grid testbed is set up to illustrate the proposed framework and improve our geosensor grid design.     

测绘应用系统中权限管理模型研究

测绘数据安全,尤其是权限控制在测绘应用中已成为不可或缺的部分。本文针对传统的RBAC模型所存在的问题,引入"用户组"进行了改进:除了RBAC模型的角色授权外,增加了用户组对数据资源进行授权,使用户所拥有的权限变成用户所属角色的功能权限和用户所属部门的资源权限之和。改进后的混合授权的扩展模型(E-RBAC)不仅有效解决了角色定义、用户职责、功能和资源等动态变化对权限管理所带来的问题,更增强了对用户授权的灵活性和可维护性,并且在实际项目中得到了应用。     

数字地球网格计算雏议

数字地球将为人类提供关于我们地球的海量自然和人文数据与信息 ,是我们生活的行星的一个多分辨率 ,四维虚拟表达。网格计算被认为是解决数字地球问题的最好方法。数字地球问题的解决必须通过异构的计算资源 ,信息系统 ,设备 ,人之间的相互协作 ,而这些都是地理位置或组织结构分散的。本文介绍我们在生成用于解决数字地球问题的核心中间件的研究工作以及结果。因为网格计算本身是一门比较新的领域 ,网格计算与数字地球的有机结合将为数字地球提供一个全新的计算工具     

一种基于信任和角色的混合权限控制方法

本文在分析分布式大众地理信息系统中访问控制的特点,以及RBAC模型不能满足分布式系统需求的基础上,提出了基于角色和信任的混合访问控制方法:在RBAC模型的角色授权基础上,加入了用户信任度,对RBAC模型进行了有效的扩展。该方法有效解决了系统对用户分配权限后无法控制用户非法操作的弊端,并且对模型进行了实验验证。     

空间目标信息系统的访问控制方案设计

空间目标信息系统(STIS)是基于空间信息实现重要目标信息采集、管理、显示、查询、分析等功能的一种面向多部门、多应用的分布式地理信息系统,不同用户具有不同的操作权限。引入基于角色的访问控制技术,从访问控制体系结构、RBAC数据库、用户访问控制流程3个不同的角度对STIS访问控制方案设计进行了详细阐述。该方案对于保证系统的安全性和明确用户职责具有非常重要的意义。     

异构环境下地理空间信息网格计算模式及体系结构研究

与机群系统相比,地理空间信息网格计算模式的优势在于可以更好地解决资源的异构性问题,支持资源的柔性伸缩及多种并行编程环境,支持科学计算库与工具软件,支持可视化动态人机交互。地理空间信息网格计算模式的体系结构是具有一定智能的分层结构。本文参考五层沙漏结构思想和前人的研究成果,研究设计了具有资源底层、安全调度层、抽象接口层、中间件层、应用接口层和应用层等六个层面的地理空间信息网格计算系统多层体系结构。     

角色访问控制的综合地质数据安全模型

为了有效地管理复杂多样的地质矿产数据,提高地质矿产数据的安全性,本文对地质矿产数据进行整理和分析,提出了综合地质数据模型.在此基础上,基于角色访问控制思想设计了综合地质数据的安全模型,并在ORACIE数据库和所开发的综合地质数据库管理系统中实现了该安全模型.     

The Experience of Realizing a Semantic Web Urban Computing Application

Urban Computing is a branch of Pervasive Computing that investigates urban settings and everyday lifestyles. A large quantity of information to develop pervasive applications for urban environments is often already available, even if scattered and not integrated: maps, points of interest, user locations, traffic, pollution, and events are just a few examples of the digitalized information which we can access on the Web. Applications for mobile users that leverage such information are rapidly growing. In this article, we report our experience in addressing practical computational issues influencing the use of Geographic Information Systems and geospatial data from the standpoint of semantics and pervasive computing. We refer to the early achievements of the LarKC project, in which we developed an Urban Computing demonstrator. We highlight the positive sides of our experience and we discuss open issues and possible advances.     

公共地图服务的群体用户访问行为时序特征模型及预测

群体用户对公共地图服务的访问行为具有社会性,存在着一定的群体访问行为模式。该模式具有高强度的访问聚集性与突发性,且决定着公共地图服务对云计算资源的需求。如何有效地表达和捕捉群体用户访问聚集性及其访问强度的时序变化特征,进行准确的公共地图服务负载预测,是实现按需选择和调度云计算资源,应对海量用户并发服务挑战的关键。本文基于海量的公共地图服务用户访问日志和时间序列聚类方法,建立了群体用户访问到达行为的时序分布模型;考虑降低负载预测复杂度的同时,利用访问强度具有多峰值、变强度以及周期性的特点,分割访问到达率在一个周期内时间序列上的模式区间,实现访问强度时序聚类划分的最优;基于各访问模式区间不同的访问到达概率密度的分布,提出了基于累积概率分布的时间序列平滑预测服务负载方法,该预测方法的算法复杂度低,且所需的先验数据量小。实验证明,本文提出的基于时序的群体用户访问到达率最优分割方法及其预测方法可以以较高的准确率预测服务负载。该方法在应对海量用户并发访问挑战的同时,可提高云计算资源的利用效率,解决公共地图服务质量与服务成本的平衡性问题。     

基于网格虚拟组织的空间数据基础设施探讨

网格(Grid)是新型高效的分布式计算和资源管理基础设施。分析了空间数据基础设施(Spatial Data In-frastructure,SDI)与网格技术的集成需求,扩展了传统SDI层次体系,提出一种新的SDI—基于网格虚拟组织的SDI(Virtual Organization SDI,VOSDI)。VOSDI突破原有SDI以明确的地区或地域分类分层组织的方式,通过VO对地理上分布的人员、资料及空间信息进行有效组织和整合,具有灵活高效的特性。对VOSDI的功能、特性进行探讨后,进一步提出VOSDI的概念模型,并指出VOSDI实施中可能存在的问题。     

Challenges in applying capacitated covering models

Service system planning has long been supported by location‐covering models designed to address access and accessibility issues. An important aspect of many systems is limits on service, often conceptualized as facility capacities. Much research can be found that proposes modeling approaches and solution techniques to account for capacitated covering problems, and commercial GIS software exists that is capable of structuring and applying facility service limits. This article reviews issues and challenges associated with the application of capacitated covering models, including critical evaluation of allocation approaches and GIS capabilities. Case studies involving service provision in two cities in California—San Jose and Santa Barbara—are provided to highlight associated issues faced in practice. While user‐friendly commercial software makes it easy to access capacitated cover models, there remain challenges for addressing underlying considerations and assumptions in practice.     

GEOID: GRID Services for Earth Observation Image Data Processing

Abstract

Recent developments in space technology and exponential increase in demand of earth observation data from space have generated a requirement of a data processing environment, where users can discover the data and process, based on their requirements. Grid Services for Earth Observation Image Data Processing (GEOID) is proposed with a motivation to cater to future earth observation applications requirements of digital earth. This paper discusses the overview of the GEOID architecture, its deployment scenario, use-cases and simulation results. Core technologies used for implementation include Grid computing and Service Oriented Architecture. GEOID provides capability to address requirements of applications such as real-time monitoring, time series data processing and processing with user required quality to meet the requirements of end user applications. GEOID allows users to access the archive products or the raw satellite data stream and process their area of interest. Simulations show that applications such as time series analysis show considerable improvement in processing time by using GEOID.     

混合访问控制模型在测绘应用系统中的应用

本文在分析测绘系统开发与应用中测绘数据的复杂性,以及大部分测绘系统都包含业务流程等特点的基础上,除了RBAC模型的角色授权外,加入了任务对操作进行授权,对RBAC模型进行了有效的扩展,使其更具通用性。该方法有效解决了传统的RBAC模型在测绘系统应用中存在的弊端,对其他应用系统建设同样具有理论指导。     

Service-oriented infrastructure for flood mapping using optical and SAR satellite data

In this paper, we present the service-oriented infrastructure within the Wide Area Grid project that was carried out within the Working Group on Information Systems and Services of the Committee on Earth Observation Satellites. The developed infrastructure integrates services and computational resources of several regional and national Grid systems: Ukrainian Academician Grid (with satellite data processing Grid segment, UASpaceGrid) and Grid system at the Center on Earth Observation and Digital Earth of Chinese Academy of Sciences. The study focuses on integrating geo-information services on flood mapping provided by Ukrainian and Chinese entities to benefit from information acquired from multiple sources. We also describe services for workflow automation and management in Grid environment and provide an example of workflow automation for generating flood maps from optical and synthetic-aperture radar satellite imagery. We also discuss issues of enabling trust for the infrastructure using certificates and reputation-based model. Applications of utilizing the developed infrastructure for operational flood mapping in Ukraine and China are given as well.     

网格环境下缓冲区分析的并行计算

提出了基于网格环境下缓冲区分析的并行计算方法,用以提高缓冲区分析的效率。考虑到大多数地理信息系统中缓冲区分析数据的特点,提出了基于图层和地理空间区域的任务分解方法。利用已经构建的网格计算环境,实现了武汉城市地图中一条道路缓冲区分析的图层式并行计算,从实验结果的分析,可以看出网格环境下缓冲区分析的并行计算在效率方面具有明显的优势。     

Data Integration Issues for a Farm Decision Support System

This paper explores data integration and compatibility issues raised during the development of a prototype spatial decision support system (SDSS) as a support tool for the farm manager of the University of Central Lancashire's farm at Newton Rigg and as a teaching resource for staff and students on campus. Metadata concerns and interoperability problems are addressed in detail. The paper outlines the proposed model for the SDSS and issues identified during the investigation of the users’ requirements and the analysis of the underlying spatial data sets. The initial data issues relate to the identification of existing and missing data sets ( Parker et al. 1996 ) and the creation of metadata describing the data sets. The second area to be explored concerns interoperability issues. This is relevant when users must access more than one dataset using distributed computing resources ( Sondheim et al. 1999 ).     

网格计算在校园网中的应用研究

网格计算可以合理而有效地将资源高效地组织起来，相对于机群计算环境，它具有范围更广、功能更强大、组织和管理更复杂的特点。目前高校中各种计算资源丰富，但是由于地域的分散，很难做到存储、计算资源的共享。本文对校园网现状和网格技术进行研究，提出校园网格的概念及实现的功能。