CN104394141A - Unified authentication method based on distributed file system - Google Patents

Abstract

The invention discloses a unified authentication method based on a distributed file system to solve the problem of unified authority management of multiple business domains under the distributed file system. The method of the invention is divided into three levels: unified authentication module, file resources, and access files users of the system. When a user accesses the distributed file system, the user enters the user name and password on the client, and maps to the unified authentication module of the name node through a unified interface to realize authority authentication. The authentication module first checks whether the user exists, and if the user does not exist, it will return a login failure; if the user search and comparison is successful, it will return a credential, as long as the user access process is not over, the user can carry the credential to access between different business systems file resource. The invention can realize the unified authority management of multiple business domains under the distributed file system, which greatly facilitates the use and management of users.

Description

A Unified Authentication Method Based on Distributed File System

technical field

The invention relates to a unified authentication method when a user logs into a distributed file system, belonging to the field of user information security.

Background technique

With the innovation of information technology and the improvement of informatization level, people pursue more efficient computing and storage capabilities. The distributed file system can just meet people's storage and computing needs for massive data. The distributed file system composed of large-scale server clusters has gradually become the mainstream computing and storage platform. In the environment of the distributed file system, the file resources are distributedly stored in each server, and the addressing and reading of each file is controlled by the central server node. From the perspective of physical storage of files, the read and write permissions of file resources are controlled by the central node, but from the perspective of business logic, each file resource belongs to different business systems, and each business system has its own independent login and permission management . Therefore, in a distributed file system, there is a problem of rights management between multiple business domains.

Related existing technologies mainly include Acegi framework and access control based on RBAC (role based access control); among them, Acegi is a framework that can provide flexible security access control solutions for Spring-based enterprise applications. Acegi protects URL resources through multiple filters for different purposes. Before requesting a protected URL resource, Acegi's Servlet filter determines whether the user has the right to access the target resource. And the controlled method of the Bean in the container is intercepted through Spring AOP. Only when the domain object is authorized, the user can use the Bean method to process the domain object. It can be seen that the authorization in Acegi is role-based authorization, which facilitates role-based access control. The disadvantage of the Acegi framework is that the access control based on Acegi is more suitable for Web resources, and the scalability of the framework is poor, so it is not suitable for large-scale distributed file systems.

RBAC-based access control divides different roles according to specific security policies, assigns different operation permissions to each role, and users obtain access control rights owned by roles by being assigned different roles, realizing indirect access to information resources. access. RBAC-based access control introduces the concept of roles for the purpose of isolating users and permissions. As a proxy layer, roles couple the relationship between users and permissions. All authorizations should be given to roles rather than to users. In order to facilitate the management of resources and reflect the hierarchical relationship of resources, RBAC-based access control adds the concept of resource groups, which can map the business scope corresponding to the organizational structure. The disadvantage of RBAC-based access control is that when the number of users increases, the management workload will increase sharply, and users may have different roles at different times, so there is a problem of dynamic control in terms of user role assignment.

Contents of the invention

In order to solve the above problems, the present invention provides a unified authentication method based on a distributed file system, so as to realize unified authority management of multiple business domains under the distributed file system. When a user logs in to a certain business system and then uses file resources of other business systems, no re-authentication is required, which brings great convenience to the user.

The principle of the present invention is that, generally, a distributed file system includes a metadata server name node and a large number of data storage server data nodes. The name node is responsible for managing the metadata information of file resources. Metadata consists of three parts, which are file system directory tree information, correspondence between files and data blocks split from files, and distribution position information of data blocks on data nodes. File resources stored in the distributed file system are split into data blocks of the same size, and these data blocks will be copied and stored in multiple data nodes. The unified authentication method proposed by the present invention is applied in a distributed file system to solve the problem of authority management among file resources belonging to different business systems.

This method is divided into three levels: the first level is a unified authentication module, which realizes the access authority authentication of file resources on the business layer; the second level is file resources, that is, data blocks stored in each data node; the last level is The user accessing the file system. When a user accesses the distributed file system, the user enters the user name and password on the client, and maps to the unified authentication module of the name node through a unified interface to realize authority authentication. The authentication module first checks whether the user exists, and if the user does not exist, it will return a login failure; if the user search and comparison is successful, it will return a credential, as long as the user access process is not over, the user can carry the credential to access between different business systems file resource.

The specific scheme of the unified authentication method proposed by the present invention is as follows:

Deploy LDAP (Lightweight Directory Access Protocol) server and CAS (Central Authentication Service) server in the distributed file system, so that the CAS server and LDAP server can bidirectionally read and store data;

When a user accesses the distributed file system through the Web application service process, check whether the user's session exists, if not, redirect to the CAS server, check the TGT (Ticket Granting Ticket user authentication certificate ticket), if the TGT does not exist or TGT error requires the user to log in again. After the user enters the user name and password, the unified authentication single sign-on is performed on the LDAP server;

After the LDAP authentication is completed, the CAS returns to the user the legal TGT and ST (Service Ticket) and redirects them to the distributed file system according to the user's current Web application service process. After the distributed file system receives the returned ST, the CAS server must also verify the validity of the ST. If it is legal and valid, it will confirm that the user can access the resources in the distributed file system.

After the user obtains the permission to access a business system in the distributed file system, when the user accesses the file resources of other business systems, the user access process only needs to provide ST, and the accessed business system redirects the received ST to CAS The server verifies the legitimacy and whether it has expired. If the ST does not exist or the ST has expired, it will return a verification TGT. If the TGT is valid, the CAS will re-grant the user a ST.

Furthermore, in terms of user/user group, role/authority assignment design, LDAP stores data in a tree structure, and the end of the branch of the tree is the user who accesses the file resource, and considers the problem of role division when storing user entities. In order to facilitate user management, LDAP user groups and user roles for accessing file resources are mapped, that is, two-group division is adopted, users/user groups correspond to roles, and roles correspond to permissions.

By adopting the method of the present invention, the unified authority management of multiple business domains under the distributed file system can be realized, that is, when the user logs in to a certain business system and then uses the file resources of other business systems, there is no need to re-authenticate, and the unified authentication module The implementation of the distributed file system reduces the development of independent authentication modules, saving manpower and financial resources; adopting the combination of LDAP server and CAS server can greatly reduce the repetition of data storage and reduce the occupation of network resources; the present invention adopts dual Group division realizes the corresponding roles of users/user groups, and the mutual mapping of roles and permissions, which greatly facilitates user management.

Description of drawings

Fig. 1 is the realization flowchart of the method of the present invention.

Detailed ways

The present invention will be described in further detail below in conjunction with the accompanying drawings and embodiments.

The flow process of the inventive method is as shown in Figure 1, deploys LDAP server and CAS server in distributed file system, makes CAS server and LDAP server bidirectionally read and store data;

When a user accesses the distributed file system through the web application service process, check whether the user's session exists. If not, redirect to the CAS server and check the TGT. If the TGT does not exist or the TGT is wrong, the user needs to log in again. The user enters After entering the user name and password, perform unified authentication single sign-on on the LDAP server;

LDAP server and CAS server can bidirectionally read and store data. After the LDAP authentication is completed, the CAS returns the legal TGT and ST to the user, and redirects them to the file system according to the user's current Web application service process. After the file system receives the returned ST, the CAS server needs to verify the legal validity of the ST, and if it is legal and valid, it will confirm that the user can access the resource.

After the user obtains the permission to access one of the business systems, when the user accesses the file resources of other business systems, the user access process only needs to provide ST, and the accessed business system redirects the received ST to the CAS server to verify the legality and whether it is expired, if the ST does not exist or the ST has expired, the verification TGT will be returned, and if the TGT is valid, the CAS will re-grant the user an ST.

In terms of user/user group, role/authority assignment design, LDAP stores data in a tree structure, and the end of the branch of the tree is the user who accesses the file resource. When storing user entities, the problem of role division is considered. In order to facilitate user management, LDAP user groups and user roles for accessing file resources are mapped, that is, two-group division is adopted, users/user groups correspond to roles, and roles correspond to permissions.

The present invention is not limited to the above-mentioned embodiments, and all equivalent replacements or technical solutions formed by equivalent replacements fall within the protection scope of the present invention.

Claims (2)

1. a unified authentication method based on distributed file system, is characterized in that, comprises the steps: Deploy the LDAP server and CAS server in the distributed file system, so that the CAS server and LDAP server can read and store data bidirectionally; When a user accesses the distributed file system through the web application service process, check whether the user's session exists. If not, redirect to the CAS server and check the TGT. If the TGT does not exist or the TGT is wrong, the user needs to log in again. The user enters After entering the user name and password, perform unified authentication single sign-on on the LDAP server; After the LDAP authentication is completed, the CAS returns the legal TGT and ST to the user, and redirects to the distributed file system according to the user's current Web application service process; the distributed file system receives the returned ST, and the CAS server Authenticate the legality and validity of the ST, and if it is legal and valid, confirm that the user can access the resources in the distributed file system; After the user obtains the permission to access a business system in the distributed file system, when the user accesses the file resources of other business systems, the user access process only needs to provide ST, and the business system to be accessed re-enters the received ST Directed to the CAS server to verify the validity of the ST and whether it has expired. If the ST does not exist or the ST has expired, it will return a verification TGT. If the TGT is legal, the CAS will re-grant the user an ST. 2. method according to claim 1, it is characterized in that, in user/user group, in role/permission assignment design, the user group of LDAP and the user role of access file resource are mapped, promptly adopt double group division, user / User groups correspond to roles, and roles correspond to permissions.