A national-scale authentication infrastructure

그리드 환경에서 그리드 서비스를 웹 인터페이스 및 웹 서비스로 제공하기 위해 웹 표준 기술에 기반을 둔 그리드-웹 애플리케이션이 증가하고 있다. 그러나 웹 표준 보안 구조에서 위임 인증 방법의 부재로 웹 애플리케이션에 그리드 보안 시스템 GSI를 통합하는 것은 매우 어렵다. 이를 해결하기 위해서는 온라인 자격증명 저장 서비스를 이용하여 웹 애플리케이션에서 그리드 자격증명을 사용할 수 있도록 해야 한다. 본 논문에서는 그리드-웹 애플리케이션과 사용자 간의 상호 신뢰를 전제로 하는 온라인 자격증명 저장 서비스인 MyProxy를 사용하는 방법의 문제점을 분석하고, 상호 신뢰를 바탕으로 하지 않는 그리드 자격증명 위임 서비스를 제안한다. 이 서비스의 자격증명 교환 프로토콜은 OAuth에 X.509 인증 위임 절차를 추가한 것이다. 이 위임 서비스는 그리드-웹 애플리케이션에게 단일 로그온을 제공하고, 하나 이상의 그리드 자격증명을 위임하고 획득할 수 있는 보안 방법을 제공한다. Grid web applications by standard Web technology are increasingly used to provide grid service to users as normal Web user interface and service. It is however difficult to integrate a grid security system such as Grid Security Infrastructure (GSI) into Web applications because the delegation way of standard Web security is not the same as the one of Grid security. This can be solved by allowing Web applications to get a Grid credential by using an online credential repository system such as MyProxy. In this paper, we investigate the problem that occurs when MyProxy, which assumes mutual trust between a user and Grid web application, is adapted for achieving security integration between Web and Grid, and we propose a new Grid proxy delegation service to delegate a Grid credential to the Web without assuming mutual trust. In the service, the X.509 proxy delegation process is added to OAuth protocol for credential exchange, and authentication can be done by an external service such as OpenID. So, users can login onto the Grid web application in a single sign-on manner, and are allowed to securely delegate and retrieve multiple credentials for one or more Virtual Organizations.

A distributed system such as a grid infrastructure consists of different institutions and organizations that, with the goal of sharing resources with each other, need to establish trust relationships and security policies. Most implemented systems make use of the PKI-compliant grid security infrastructure (GSI) for authentication purposes and use different authorization methods that rely on users' membership in the grid logical domain (the virtual organization). However, each grid site hosting a resource provider needs to set its own admission policies for decentralized management. Focusing on web grid resources, the paper describes security mechanisms acting at global network, VO and target site levels. This papers provides a method based on the Java handlers ' technique available for a resource provider at a target grid site to secure its web resources. Moreover, the paper proposes the future use of an integration system between a VO-based system and federated identity-based infrastructure.

Grids enable uniform access to resources by implementing standard interfaces to resource gateways. In the Open Science Grid (OSG), privileges are granted on the basis of the user's membership to a Virtual Organization (VO). However, Grid sites are solely responsible to determine and control access privileges to resources using users' identity and personal attributes, which are available through Grid credentials. While this guarantees full control on access rights to the sites, it makes VO privileges heterogeneous throughout the Grid and hardly fits with the Grid paradigm of uniform access to resources. To address these challenges, we are developing the Scalable Virtual Organization Privileges Management Environment (SVOPME), which provides tools for VOs to define and publish desired privileges and assists sites to provide the appropriate access policies. Moreover, SVOPME provides tools for Grid sites to analyze site access policies for various resources, verify compliance with preferred VO policies, and generate directives for site administrators on how the local access policies can be amended to achieve such compliance without taking control of local configurations away from site administrators. This paper discusses what access policies are of interest to the OSG community and how SVOPME implements privilege management for OSG.

GlideinWMS is a distributed workload manager that has been used in production for many years to provision resources for experiments like CERN’s CMS, many Neutrino experiments, and the OSG. Its security model was based mainly on GSI (Grid Security Infrastructure), using X.509 certificate proxies and VOMS (Virtual Organization Membership Service) extensions. Even when other credentials, like SSH keys, were used to authenticate with resources, proxies were also added all the time, to establish the identity of the requestor and the associated memberships or privileges. This single credential was used for everything and was, often implicitly, forwarded wherever needed. The addition of identity and access tokens and the phase-out of GSI forced us to reconsider the security model of GlideinWMS, to handle multiple credentials which can differ in type, technology, and functionality. Both identity tokens and access tokens are supported. GSI proxies even if no more mandatory, are still used, together with various JWT (JSON Web Token) based tokens and other certificates. The functionality of the credentials, defined by issuer, audience, and scope, also differ: a credential can allow access to a computing resource, or can protect the GlideinWMS framework from tampering, or can grant read or write access to storage, can provide an identity for accounting or auditing, or can provide a combination of any the formers. Furthermore, the tools in use do not include automatic forwarding and renewal of the new credentials so credential lifetime and renewal requirements became part of the discussion as well. In this paper, we will present how GlideinWMS was able to change its design and code to respond to all these changes.

Large-scale scientific and engineering applications are increasingly being hosted as Grid services using Globus middleware complying to the Open Grid Services Architecture (OGSA) framework. In order for users to fully embrace Grid applications, seamless access to Grid services is required. In working towards this aim we present the design and implementation of Grid clients that utilise the language-independent Microsoft .NET Framework that can be deployed without software prerequisites (zero-deployment). We demonstrate runtime security authentication interoperability between Microsoft Windows-native SSPI and the Globus GSSAPI, with full proxy support. This is demonstrated with a .NET GridFTP client, called MyGridFTP. We believe that this is one of the first implementations to use Windows native security infrastructure to interoperate with the Grid Security Infrastructure in Globus. This paves the way for language-independent .NET clients to be written that are fully interoperable with Globus-based Grid services. This work is part of a larger experimental aerodynamics Wind Tunnel Grid project, which has significant requirements for data management from acquisition, collating, processing, analysis and visualisation.

DNA has emerged as a promising storage medium to meet the soaring need for archival data storage because of its exceptional storage density and stability. However, current DNA-based data storage systems are incompetent of achieving high-quality random multiplexed access and frequently accessed data storage, which impedes its practical applications. Here, a dual-mode storage system is proposed that combines DNA-based archival data and nanodot-based active data. This novel data-storage system is constructed by writing the active and archival data on the same substrate through a facile two-step process involving scanning probe lithography (SPL), DNA synthesis, and chemical immobilization. The data files are categorized and stored orderly in different microregions of the substrate to achieve efficient random access. On each microregion, the nanodot array stores not only the concise information for the archival DNA data but also contains the corresponding primer sequence. Such interrelation between active and archival data allows for facilely data reading by efficient microscopic modalities and in situ polymerase chain reaction (PCR). Facilitated by the integration of nanodot and DNA, this novel dual-mode storage system demonstrates efficient data access and the potential of excellent storing capacity, paving the way for the advancement of DNA-based data storage.

With increasing grid computing application in more and more industries and sectors, grid security has grown into the most critical as well as important aspect in overall application architecture. This article, from architecture layer security dimension, studies security issue in grid computing environments, indicating architecture layer based security solutions in current grid computing and proposing grid security recommendations as well, which will contribute to further defining and analyzing security strategy in grid computing and function as a guideline to the development of grid computing technology. Keywords: grid security infrastructure; security strategy; grid computing

Federating security and trust is one of the most significant architectural requirements in grids. In this regard, one challenging issue is the cross-organizational authentication and identification. Organizations participated in Virtual Organizations (VOs) may use different security infrastructures that implement different authentication and identification protocols. Thus, arises an architectural need to provide a mechanism for a lightweight, rapid and interoperable translation of security credentials from an original format to a format understandable by recipients. In this paper, we describe the development and the implementation of an architecture for credential mapping in grids using off-the-shelf technologies and standard specifications. Our open-source implementation of this architecture provides support for an on-the-fly exchange for different types of security credentials used by diverse grid security infrastructures.

The most prevalent grid security standard, grid security infrastructure uses an authentication protocol based on public key infrastructure (PKI). Certificateless public key cryptography (CL-PKC) overcomes PKI certificate management problems and is well aligned with grid computing demands. Security and efficiency are the main grid authentication protocol objectives. Practical, efficient CL-PKC-based authentication protocols for real grid environments is widely acknowledged as a challenging issue. Unfortunately, certificateless authenticated key agreement protocols rely on bilinear pairings, which are extremely computational expensive. In this paper, we present a novel pairing-free certificateless two-party authenticated grid key agreement (GPC-AKA) protocol, providing a lighter weight key management approach for grid users. We then propose the first practical GPC-AKA implementation as a proof of concept. We also compare the efficiency of GPC-AKA to other proposed work in the literature.

Grid security solutions address critical requirements and are constructed from building blocks comprising cryptographic algorithms and protocols. Choosing the most appropriate algorithms and protocols requires an ongoing evaluation of performance and security properties, given continuing advances in system performance, optimizations, security analyses, and cryptographic techniques. Today, the Globus Toolkit's grid security infrastructure (GSI) is a leading provider of security solutions based on the RSA cryptosystem. Recently, cryptosystems based on bilinear pairings have been proposed as an alternative with the promise of increased efficiency and scalability. In this work we evaluate this alternative compared to elliptic curve cryptography (ECC) and RSA in terms of their computation and communication overheads for today's grid systems. Our analysis and experiments lead us to conclude that RSA continues to be a good choice for the foreseeable future. Furthermore, our results are intuitively aligned with the high-performance, high-bandwidth, and high-latency nature of grid systems.

Smart grid is the upgradation of the existing grid in terms of cost, communication infrastructure, internet of things and reliable technologies. In ambitious flagship programme of digital India-project an initiative of India, the potential fields of the missions are identified in the area are smart energy, smart grids, smart homes and smart cities. More than 100 smart cities are planned for information and communication technology driven solutions with big data analytics in India. The exponential growth in smart grids has given certain security risks, cyber threats and protection of stored data as Nation security. Smart Grids, comprising of several communication, monitoring intelligent, metering and electrical equipment used in power grid, have a greater exposure to grid security and cyber-attacks which are potentially disrupt distribution in a city. The paper discusses the electrical grid, challenges in smart grid and the use of Advanced Encryption Standard (AES) algorithm enable with field-programmable gate array (FPGA) hardware in smart grids. The AES encryption and decryption chip is designed in Xilinx ISE 14.2 software, synthesized on SPARTAN-3E FPGA and verified with some test cases to ensure that AES can be employed in smart grid security and communication infrastructure.

Future institutions and enterprises, called virtual organizations are formed by society as entirely decentralized and distributed organizations. In virtual organizations, new forms of intellectual human cooperation smooth traditional competition. The place of traditional hierarchy is replaced by cooperation coordination. Cooperation economy in virtual organizations going out of their framework, conditioned by factors of the society organization as integrity, becomes a modification of economy of societal integrity, so-called new entity economy. The personality of human work as well as work organization is changing. The work and people's interdependence problems and human work organization depend on virtual cooperation in real-time and a communication environment of storing and exchanging resources and coordination of documents' circle. The organization of human cooperation is comprised of two factors: first, a computer and information factor that promotes the creation and improvement of information resources, synthesis of processing methods, and information environment helping team-work; second, a communication and organizational factor that incorporates the problems of the synthesis of storing structures, computer information exchange, and interactive direct communication. © 2005 Wiley Periodicals, Inc. Hum Factors Man 15: 49–69, 2005.

Yamata-no-Orochi is an authentication and authorization infrastructure across multiple service domains and provides Internet services with unified authentication and authorization mechanisms. In this paper, Yamata-no-Orochi is incorporated into a video distribution system to verify its general versatility as a multi-domain authentication and authorization infrastructure for Internet services. This paper also reduces the authorization time of Yamata-no-Orochi to fulfill the processing time constrains of the video distribution system. The evaluation results show that all the authentication and authorization processes work correctly and the performance of Yamata-no-Orochi is practical for the video distribution system.

In this paper, we propose a role-based access control (RBAC) system for data resources in the Storage Resource Broker (SRB). The SRB is a Data Grid management system, which can integrate heterogeneous data resources of virtual organizations (VOs). The SRB stores the access control information of individual users in the Metadata Catalog (MCAT) database. However, because of the specific MCAT schema structure, this information can only be used by the SRB applications. If VOs also have many non-SRB applications, each with its own storage format for user access control information, it creates a scalability problem with regard to administration. To solve this problem, we developed a RBAC system with Shibboleth, which is an attribute authorization service currently being used in many Grid environments. Thus, the administration overhead is reduced because the role privileges of individual users are now managed by Shibboleth, not by MCAT or applications. In addition, access control policies need to be specified and managed across multiple VOs. For the specification of access control policies, we used the Core and Hierarchical RBAC profile of the eXtensible Access Control Markup Language (XACML); and for distributed administration of those policies, we used the Object, Metadata and Artifacts Registry (OMAR). OMAR is based on the e-business eXtensible Markup Language (ebXML) registry specifications developed to achieve interoperable registries and repositories. Our RBAC system provides scalable and fine-grain access control and allows privacy protection. Performance analysis shows that our system adds only a small overhead to the existing security infrastructure of the SRB.

Attendance systems in higher education are vital for tracking student participation and engagement, offering valuable data for academic analysis. With hybrid classes, automation improves efficiency and ensures compliance. However, current systems focus on technical aspects while neglecting integrity issues like buddy punching. This paper proposed to utilize Google Advertising Identifier (GAID) as the authentication mechanism to enhance the integrity of the automated attendance system. The GAID is originally designed to provide targeted advertisements customized based on user preferences and is unique to each device, enabling specific user profiling. This research suggests leveraging this attribute to create an automated authentication mechanism that links the user's ID with the device used to log into the system. To achieve this goal, a cloud-based attendance system and Android application has been developed and tested for reliable authentication, which effectively monitors student attendance and ensures the integrity of the process. The system prevents unauthorized access by authenticating students' devices using pre-bound attributes. It detects incorrect GAIDs and blocks logins from unregistered devices, thereby preventing buddy punching. This seamless authentication works well on Android and can expand to all platforms using identifiers like Apple's IDFA and the ATT framework, improving usability and attendance monitoring efficiency.