The Research On Security Technologies Of Enterprise Computing Environment

The development of distributed computing technologies have improved the interoperability of the Enterprise Computing Environment(ECE). At the same time, it presents a great security challenge for enterprise.How to enforce the security of ECE has become the focus for research. Based on the study of the security technologies of ECE, the thesis describes the security architecture and mechanism of the EXIST system, which provides a e-government oriented data exchanging services.The thesis makes a detailed analysis and description on the design and implementation of main security technologies in this system.In EXIST system's distributed architecture, the exchanging hub acts as the server and the adapter acts as the client. Web services is used as the way of service interaction. Firstly, the thesis makes a research on OSI and ECE's security architecture.,based on which the EXIST system's security architecture is layouted and designed.The system makes use of structurized user management model and resource management model based on LDAP to enforce system management seucrity, which facilitates the system's implementation of Role-Based Access Control(RBAC). The system utilizes Public Key Infrastructure(PKI) to implement strong authentication and Privilege Management Infrastructure(PMI) to implement strong authorization. RBAC is used to implement system's access control. The thesis makes a study of the above three technologies and makes a detailed description on the design and implementation of RBAC based on PMI.In the last part, the thesis makes a research on the web services and its security technologies. The system's web services security is implemented with XML signature, XML encryption and SOAP security extensions, which ensure the data's confidentiality and integrity in the process of service interaction.In general, with the qulified security architecture and services, the EXIST system satisfies the security requirements of e-government oriented data exchanging.