Distributed Access Control for Grid Environments Using Trust Management Approach

In this paper, we propose a role-based access control (RBAC) system for data resources in the Storage Resource Broker (SRB). The SRB is a Data Grid management system, which can integrate heterogeneous data resources of virtual organizations (VOs). The SRB stores the access control information of individual users in the Metadata Catalog (MCAT) database. However, because of the specific MCAT schema structure, this information can only be used by the SRB applications. If VOs also have many non-SRB applications, each with its own storage format for user access control information, it creates a scalability problem with regard to administration. To solve this problem, we developed a RBAC system with Shibboleth, which is an attribute authorization service currently being used in many Grid environments. Thus, the administration overhead is reduced because the role privileges of individual users are now managed by Shibboleth, not by MCAT or applications. In addition, access control policies need to be specified and managed across multiple VOs. For the specification of access control policies, we used the Core and Hierarchical RBAC profile of the eXtensible Access Control Markup Language (XACML); and for distributed administration of those policies, we used the Object, Metadata and Artifacts Registry (OMAR). OMAR is based on the e-business eXtensible Markup Language (ebXML) registry specifications developed to achieve interoperable registries and repositories. Our RBAC system provides scalable and fine-grain access control and allows privacy protection. Performance analysis shows that our system adds only a small overhead to the existing security infrastructure of the SRB.

In this paper, we present a role-based access control method for accessing databases through the Open Grid Services Architecture – Data Access and Integration (OGSA-DAI) framework. OGSA-DAI is an efficient Grid-enabled middleware implementation of interfaces and services to access and control data sources and sinks. However, in OGSA-DAI, access control causes substantial administration overhead for resource providers in virtual organizations (VOs) because each of them has to manage a role-map file containing authorization information for individual Grid users. To solve this problem, we used the Community Authorization Service (CAS) provided by the Globus Toolkit to support the role-based access control (RBAC) within OGSA-DAI. CAS uses the Security Assertion Markup Language (SAML). Our method shows that CAS can support a wide range of security policies using role-privileges, role hierarchies, and constraints. The resource providers need to maintain only the mapping information from VO roles to local database roles and the local policies in the role-map files, so that the number of entries in the role-map file is reduced dramatically. Also, unnecessary authentication, mapping and connections can be avoided by denying invalid requests at the VO level. Thus, our access control method provides increased manageability for a large number of users and reduces day-to-day administration tasks of the resource providers, while they maintain the ultimate authority over their resources. Performance analysis shows that our method adds very little overhead to the existing security infrastructure of OGSA-DAI.

A secure information service for monitoring large scale grids

A global and parallel file system for grids

A Virtual Organization (VO) consists of some real organizations with common interests, which aims to provide inter organizational associations to reach some common goals by sharing their resources with each other. Providing security mechanisms, and especially a suitable access control mechanism, which enforces the defined security policy is a necessary requirement in VOs. Since VO is a complex environment with the huge number of users and resources, traditional access control models cannot satisfy VOs security requirements. Most of the current proposals are basically based on the attributes of users and resources. In this paper, we suggest using a combination of the semantic based access control (SBAC) model, and the attribute based access control (ABAC) model with the shared ontology of subjects' attributes in VOs. In this model, each participating organization makes its access control decisions according to an enhanced model of the ABAC model. However, access decision in the VO is made in more abstract level through an enhanced model of theSBACmodel. Using the ontology of users and resources in this model facilitates access control in large scale VOs with numerous organizations. By the combination ofSBACand ABAC, we attain their benefits and eliminate their shortcomings. In order to show the applicability of the proposed model, an access control system, based on the proposed model, has been implemented in Java using available APIs, including Sun's XACML API, Jena, Pellet, and Protege.

In this paper, we first present a linear programming based approach for modeling and solving the resource matching problem in grid environments with heterogeneous resources. The resource matching problem described takes into account resource sharing, job priorities, dependencies on multiple resource types, and resource specific policies. We then propose Web service style architecture for online matching of independent jobs with resources in a grid environment and describe a prototype implementation. Our preliminary performance results indicate that the linear programming based approach for resource matching is efficient in speed and accuracy and can keep up with high job arrival rates of an important criterion for online resource matching systems. Also, the Web service style architecture makes the system scalable and extendable. It can also be integrated with other existing grid services in a straightforward manner.

Collaboration is used for information sharing and activity coordinating, and it exists broadly in many fields. Group communication enables efficient communication between a set of processes logically organized into groups and communicating via multicast in an asynchronous environment. One of the key technologies for collaborative applications is secure group communication. Current research on secure group communication scarcely considers the existing security mechanism in local systems. As a result, group communication systems couldn 't provide general support for collaborative applications running on a specific system. Based on the existing grid security technologies, we propose an authentication and access control framework at virtual organization (VO) level for group communication in grid environment. By introducing role-based access control (RBAC) and attribute-based approach, we define group management policies and design group control protocols. The protocols are analyzed from three aspects: compatibility, performance, and security. Finally, we implement a prototype based on GridShib.

The grid facilitates coordinated resource sharing and problem solving in dynamic, multi-institutional virtual organisation (VO). Groups within the VO communicate efficiently by multicasting the shared information. Groups within a VO can be dynamic, because users, resources or sites can join or leave a group at any time. In addition, one member may belong to multiple groups simultaneously. In this context, maintaining data privacy against untrusted users is of utmost importance in the grid environment. This necessitates the encryption of information that is transmitted among the grid entities. To preserve security in communication, the multicast information should be encrypted using a group key. The challenges faced in maintaining security in a VO includes dynamic authentication of group members, dynamic creation, updation and distribution of group keys. In view of the challenges, this paper proposes an efficient approach for dynamic group key generation and distribution. This paper also proposes a novel approach for establishing domain to domain communication using trust relationship among the entities. The proposed approaches were implemented, tested and evaluated on GridSim.

Distributed environments with the users decoupling from resource providers are generally defined as utility Grids. This paper focuses on the problems of an efficient scheduling in virtual organizations (VOs) of utility Grids. The proposed scheduling model ensures the VO stakeholders preferences and provides strategies for effective resources utilization. An approach based on the combination of the cyclic scheduling scheme, backfilling and several heuristic procedures is proposed and studied. Comparative simulation results are introduced for different algorithms and heuristics. Resource domain composition and heterogeneity as well as the VO pricing policy are taken into account. Considered scheduling approaches provide different benefits depending on the VO scheduling objectives. The results justify the use of the proposed approaches in a broad range of the resource environment parameters.

Scheduling divisible workloads in distributed systems has been one of the interesting research problems over the last few years. Most of the scheduling algorithms previously introduced are based on the master-worker model. However, the majority of these algorithms assume that workers are dedicated machines, which is a wrong assumption in distributed environments such as Grids. In this work, we propose a dynamic scheduling methodology that takes into account the three prominent aspects of Grids: heterogeneity, dynamicity, and uncertainty. Our contribution is threefold. First, we present an analytical model for processing local and Grid tasks at each non-dedicated worker. Second, we present a simple prediction method to forecast the available CPU capacity and bandwidth at each worker. Third, we introduce a dynamic, multi-round scheduling algorithm.

A secure collaboration service for dynamic virtual organizations

This paper discusses how the Virtual Organisation (VO) concept can be used for managing dynamic security associations in collaborative Grid applications and for complex resource provisioning. The paper contains both research part and discusses further development of the popular VO management software the VO Membership Service (VOMS). The paper provides an overview of current practices in VO management in major Grid projects including operational procedures and the supporting security middleware. The paper identifies open issues and basic requirements to the VO security functionality and services and suggests possible directions of further research and development. The proposed conceptual VO model and VO management framework provide a basis for consistent VO services definition and development to support different VO operational models. The paper intends to provide a framework for common understanding of the VO concept among Grid community and collaborative community and industry. The paper is based on experiences gained from the major Grid based and Grid oriented projects in collaborative applications and complex resource provisioning.

Dynamic inter-domain collaborations and resource sharing comprise two key characteristics of mobile Grid systems. However, inter-domain collaborations have proven to be vulnerable to conflicts that can lead to privilege escalation. These conflicts are detectable in inter-operation policies, and occur due to cross-domain role relationships. In addition, resource sharing requires to be enhanced with resource usage management in virtual organizations where mobile nodes act as resource providers. In this case the enforcement of resource usage policies and quality of service policies are required to be supported due to the limited capabilities of the devices. Yet, the ANSI INCITS 359-2004 standard RBAC model provides neither any policy conflict resolution mechanism among domains, nor any resource usage management functionality. In this paper, we propose the domRBAC model for access control in mobile Grid systems at a low administrative overhead. The domRBAC is defined as an extension of the standardized RBAC by incorporating additional functionality to cope with requirements posed by the aforementioned systems. As a result, domRBAC facilitates collaborations among domains under secure inter-operation, and provides support for resource usage management in the context of multi-domain computing environments, where mobile nodes operate as first-class entities.Keywordsmobile Gridrole based access control (RBAC)secure inter-operationresource usage managementcross-domain authorization

A Virtual Organization (VO) in the Grid is a collection of users and distributed resources, in which resources are shared by users. VOs are dynamically created for some goals and then disappear after the goals are achieved. Conventional Grid architectures have been proposed for a single or static VO environment. In this paper, we propose a ticket-based Grid services architecture to support the dynamic VO environment. Tickets contain information and delegated rights of resource providers, VO managers, and users. By using these tickets, the proposed architecture supports various services in the dynamic VO environment, such as VO management, fine-grained authorization, resource information, and resource management.

This paper describes the design and development of a flexible, customer-driven, security infrastructure for Gridbased Collaborative Environments. The paper proposes further development of the access control model built around a service or resource provisioning agreement (e.g., an experiment or project) that is used as a basis for an instant access control policy definition and virtual association of users and resources. Workflow management technology is considered as a solution for dynamic security context management during the lifetime of an experiment. The paper analyses the required functionality and suggests extensions to the generic AAA Authorisation framework in order to support complex collaboration scenarios in dynamic virtualised environments. The paper provides implementation details on the use of XACML for fine-grained access control policy definition for complex resources and team-based role management, and SAML for secure credentials exchange. In addition, the paper discusses how the Virtual Organisations (VO) concept can be used for experiment-based dynamic security association management. The proposed technical solutions are intended to be compatible and interoperable with the current implementation of the Grid security middleware in the Globus Toolkit and gLite. The paper is based on experiences gained from major Grid-based and Gridoriented projects in collaborative applications and complex resource provisioning.