Amincin Token da Bincike a Cikin Kwamfutocin Rarraba: Bincike da Shawarwari

Teburin Abubuwan Ciki

1 Gabatarwa

Ƙungiyar Aiki ta Amincin Token da Bincike (TTT) tana magance manyan ƙalubale a cikin al'ummomin kwamfutocin rarraba (WLCG, EGI, IGWN) yayin sauyawa daga takaddun shaida na X.509 zuwa tsarin Tabbatar da Ainihi da Izinin (AAI) na tushen token. Wannan sauyi na tsari yana buƙatar sake tunani game da manufofi da hanyoyin da aka ƙera da farko don tsarin X.509 da VOMS.

2 Tokoki, Aminci da Bincike

2.1 Bayanan Baya na Token

Mafita na tushen token, waɗanda masu samarwa na kasuwanci (Google, Microsoft) suka ƙera da farko, ana amfani da su ta hanyar kayayyakin more rayuwa na kwamfutocin rarraba. Sauyin ya ƙunshi Masu Samar da Haɗin OpenID (OPs) ciki har da Indigo IAM, RCIAM, Dandalin GEANT Core AAI, da CILogon.

2.2 Tsarin Aminci a cikin Tsarin Token

Tsarin aminci yana canzawa daga tsarin PKI mai matsayi zuwa tabbatar da ainihi na tushen token mai rarrabawa. Manyan ƙalubale sun haɗa da tabbatar da mai bayarwa, soke token, da kafa aminci a cikin yankuna daban-daban.

2.3 Ƙalubalen Bincike

Kiyaye binciken aikin daidai da tsarin X.509 yana haifar da manyan ƙalubale a cikin yanayin token, yana buƙatar sabbin hanyoyin aiki ga masu gudanar da tsarin.

3 Aiwatar da Fasaha

3.1 Tsarin Token na JWT

Tokokin Yanar Gizo na JSON (JWT) suna bin ƙayyadaddun RFC9068 tare da muhimman fage:

• iss: Alamar mai bayar da token
• sub Batun (daidai da DN a cikin takaddun shaida)
• aud Masu sauraro da aka yi niyya
• scope Ayyuka masu izini
• jti Alamar token na musamman
• exp/iat/nbf Da'awar ingancin lokaci

3.2 Tushen Lissafi

Amincin token ya dogara ne akan sa hannu na sirri. Ana iya wakilta tsarin tabbatarwa kamar haka:

$\text{Tabbatar}(token, makulli) = \text{gaskiya} \iff \text{Sa hannu}(header.payload) = \text{sa hannu}$

Inda algorithm ɗin sa hannu yawanci yake amfani da RS256: $\text{RSASSA-PKCS1-v1_5 ta amfani da SHA-256}$

3.3 Aiwarar da Lambar

// Misalin lambar ingancin token
function validateToken(token, issuerConfig) {
    // Rarrabe kan token
    const header = base64decode(token.split('.')[0]);
    
    // Tabbatar da sa hannu ta amfani da makullin jama'a na mai bayarwa
    const signingKey = getPublicKey(issuerConfig.iss, header.kid);
    const isValid = verifySignature(token, signingKey);
    
    // Tabbatar da da'awar
    if (isValid) {
        const payload = getTokenPayload(token);
        return validateClaims(payload, {
            issuer: issuerConfig.iss,
            audience: expectedAudience,
            expiration: currentTime
        });
    }
    return false;
}

4 Sakamakon Gwaji

Ƙungiyar aiki ta gudanar da gwaji mai yawa a cikin tarin tsaka-tsakin tsarin da yawa. Manyan binciken sun haɗa da:

5 Aikace-aikacen Gaba

Tsarin AAI na tushen token yana ba da damar sabbin iyawa ciki har da:

• Ainihi na tarayya a cikin kayayyakin more rayuwa na bincike
• Izinin kuzari dangane da halaye na ainihin lokaci
• Ingantaccen kwarewar mai amfani ta hanyar rage sarrafa takaddun shaida
• Ingantaccen tsaro ta hanyar takaddun shaida masu gajeren rai

6 Nassoshi

1. Jones, M., da sauransu. "Yanayin Token na Yanar Gizo na JSON (JWT) don Tokokin Shiga na OAuth 2.0" RFC 9068 (2021)
2. Ƙungiyar Aiki ta Izinin WLCG. "Izinin Tushen Token don WLCG" (2023)
3. Hardt, D. "Tsarin Izinin OAuth 2.0" RFC 6749 (2012)
4. Sakimura, N., da sauransu. "OpenID Connect Core 1.0" (2014)