Authorization with multiple Virtual Organizations

Mobile Grid Services has given the ability to move jobs, data and application software from nodes to nodes during jobs execution in the grid environment. These migrations depend on the grid’s users and the grid’s nodes policies. The heterogeneity, diversity of policies and attributes leads to a need for policy management tools that can handle these problems. Also, before the users can submit their jobs or run their applications on a certain resource or system they may need to guarantee that this resource or system has not been compromised, which could result in their own application or data being stolen or asking for certain users to be allowed to access the service. To date, not enough attention has been paid to policies that deal with such concerns. Most existing grid systems have support only limited types of policies (e.g. CPU resources). A few designs consider enforcing data policies in their architecture. Therefore, we propose a dynamic policy framework that addresses these issues (user-submitted policy, data policy and multiple Virtual Organizations (VOs).

Grid computing is now in widespread use, integrating geographical computing resources across multiple virtual organizations to achieve high performance computing. A single grid does not often provide a vast resource because virtual organizations have inadequate computing resource restrictions for management on an organizational scale. This paper presents a new grid architecture named Multi-Grid, which integrates multiple computational grids from different virtual organizations. This study builds a resource broker on multiple grid environments, integrating a number of single grids from different virtual organizations without the limit of organizations. The purpose of the multiple-grid resource is to avoid wasting resources. In addition, this study proposes a Multi-Grid Resource Selection Strategy (MRGSS) for the resource broker to better allocate resources before submitting jobs, to avoid network congestion that consequently causes a decrease in performance.

A secure collaboration service for dynamic virtual organizations

Grids enable uniform access to resources by implementing standard interfaces to resource gateways. In the Open Science Grid (OSG), privileges are granted on the basis of the user's membership to a Virtual Organization (VO). However, Grid sites are solely responsible to determine and control access privileges to resources using users' identity and personal attributes, which are available through Grid credentials. While this guarantees full control on access rights to the sites, it makes VO privileges heterogeneous throughout the Grid and hardly fits with the Grid paradigm of uniform access to resources. To address these challenges, we are developing the Scalable Virtual Organization Privileges Management Environment (SVOPME), which provides tools for VOs to define and publish desired privileges and assists sites to provide the appropriate access policies. Moreover, SVOPME provides tools for Grid sites to analyze site access policies for various resources, verify compliance with preferred VO policies, and generate directives for site administrators on how the local access policies can be amended to achieve such compliance without taking control of local configurations away from site administrators. This paper discusses what access policies are of interest to the OSG community and how SVOPME implements privilege management for OSG.

In this paper, we present a role-based access control method for accessing databases through the Open Grid Services Architecture – Data Access and Integration (OGSA-DAI) framework. OGSA-DAI is an efficient Grid-enabled middleware implementation of interfaces and services to access and control data sources and sinks. However, in OGSA-DAI, access control causes substantial administration overhead for resource providers in virtual organizations (VOs) because each of them has to manage a role-map file containing authorization information for individual Grid users. To solve this problem, we used the Community Authorization Service (CAS) provided by the Globus Toolkit to support the role-based access control (RBAC) within OGSA-DAI. CAS uses the Security Assertion Markup Language (SAML). Our method shows that CAS can support a wide range of security policies using role-privileges, role hierarchies, and constraints. The resource providers need to maintain only the mapping information from VO roles to local database roles and the local policies in the role-map files, so that the number of entries in the role-map file is reduced dramatically. Also, unnecessary authentication, mapping and connections can be avoided by denying invalid requests at the VO level. Thus, our access control method provides increased manageability for a large number of users and reduces day-to-day administration tasks of the resource providers, while they maintain the ultimate authority over their resources. Performance analysis shows that our method adds very little overhead to the existing security infrastructure of OGSA-DAI.

Participants in virtual organizations commonly need to share resources such as data archives, computer cycles, and networks, resources usually available only with restrictions based on the requested resource's nature and the user's identity. Thus, any sharing mechanism must have the ability to authenticate the user's identity and determine whether the user is authorized to request the resource. Virtual organizations tend to be fluid, however, so authentication mechanisms must be flexible and lightweight, allowing administrators to quickly establish and change resource-sharing arrangements. Nevertheless, because virtual organizations complement rather than replace existing institutions, sharing mechanisms cannot change local policies and must allow individual institutions to maintain control over their own resources. Our group has created and deployed an authentication and authorization infrastructure that meets these requirements: the Grid Security Infrastructure (I. Foster et al., 1998). GSI offers secure single sign-ons and preserves site control over access policies and local security. It provides its own versions of common applications, such as FTP and remote login, and a programming interface for creating secure applications. Dozens of supercomputers and storage systems already use GSI, a level of acceptance reached by few other security infrastructures.