OAuth 기반의 대리 인증서 위임 서비스

With increasing grid computing application in more and more industries and sectors, grid security has grown into the most critical as well as important aspect in overall application architecture. This article, from architecture layer security dimension, studies security issue in grid computing environments, indicating architecture layer based security solutions in current grid computing and proposing grid security recommendations as well, which will contribute to further defining and analyzing security strategy in grid computing and function as a guideline to the development of grid computing technology. Keywords: grid security infrastructure; security strategy; grid computing

Participants in virtual organizations commonly need to share resources such as data archives, computer cycles, and networks, resources usually available only with restrictions based on the requested resource's nature and the user's identity. Thus, any sharing mechanism must have the ability to authenticate the user's identity and determine whether the user is authorized to request the resource. Virtual organizations tend to be fluid, however, so authentication mechanisms must be flexible and lightweight, allowing administrators to quickly establish and change resource-sharing arrangements. Nevertheless, because virtual organizations complement rather than replace existing institutions, sharing mechanisms cannot change local policies and must allow individual institutions to maintain control over their own resources. Our group has created and deployed an authentication and authorization infrastructure that meets these requirements: the Grid Security Infrastructure (I. Foster et al., 1998). GSI offers secure single sign-ons and preserves site control over access policies and local security. It provides its own versions of common applications, such as FTP and remote login, and a programming interface for creating secure applications. Dozens of supercomputers and storage systems already use GSI, a level of acceptance reached by few other security infrastructures.

A distributed system such as a grid infrastructure consists of different institutions and organizations that, with the goal of sharing resources with each other, need to establish trust relationships and security policies. Most implemented systems make use of the PKI-compliant grid security infrastructure (GSI) for authentication purposes and use different authorization methods that rely on users' membership in the grid logical domain (the virtual organization). However, each grid site hosting a resource provider needs to set its own admission policies for decentralized management. Focusing on web grid resources, the paper describes security mechanisms acting at global network, VO and target site levels. This papers provides a method based on the Java handlers ' technique available for a resource provider at a target grid site to secure its web resources. Moreover, the paper proposes the future use of an integration system between a VO-based system and federated identity-based infrastructure.

The most prevalent grid security standard, grid security infrastructure uses an authentication protocol based on public key infrastructure (PKI). Certificateless public key cryptography (CL-PKC) overcomes PKI certificate management problems and is well aligned with grid computing demands. Security and efficiency are the main grid authentication protocol objectives. Practical, efficient CL-PKC-based authentication protocols for real grid environments is widely acknowledged as a challenging issue. Unfortunately, certificateless authenticated key agreement protocols rely on bilinear pairings, which are extremely computational expensive. In this paper, we present a novel pairing-free certificateless two-party authenticated grid key agreement (GPC-AKA) protocol, providing a lighter weight key management approach for grid users. We then propose the first practical GPC-AKA implementation as a proof of concept. We also compare the efficiency of GPC-AKA to other proposed work in the literature.

Grid security solutions address critical requirements and are constructed from building blocks comprising cryptographic algorithms and protocols. Choosing the most appropriate algorithms and protocols requires an ongoing evaluation of performance and security properties, given continuing advances in system performance, optimizations, security analyses, and cryptographic techniques. Today, the Globus Toolkit's grid security infrastructure (GSI) is a leading provider of security solutions based on the RSA cryptosystem. Recently, cryptosystems based on bilinear pairings have been proposed as an alternative with the promise of increased efficiency and scalability. In this work we evaluate this alternative compared to elliptic curve cryptography (ECC) and RSA in terms of their computation and communication overheads for today's grid systems. Our analysis and experiments lead us to conclude that RSA continues to be a good choice for the foreseeable future. Furthermore, our results are intuitively aligned with the high-performance, high-bandwidth, and high-latency nature of grid systems.

GlideinWMS is a distributed workload manager that has been used in production for many years to provision resources for experiments like CERN’s CMS, many Neutrino experiments, and the OSG. Its security model was based mainly on GSI (Grid Security Infrastructure), using X.509 certificate proxies and VOMS (Virtual Organization Membership Service) extensions. Even when other credentials, like SSH keys, were used to authenticate with resources, proxies were also added all the time, to establish the identity of the requestor and the associated memberships or privileges. This single credential was used for everything and was, often implicitly, forwarded wherever needed. The addition of identity and access tokens and the phase-out of GSI forced us to reconsider the security model of GlideinWMS, to handle multiple credentials which can differ in type, technology, and functionality. Both identity tokens and access tokens are supported. GSI proxies even if no more mandatory, are still used, together with various JWT (JSON Web Token) based tokens and other certificates. The functionality of the credentials, defined by issuer, audience, and scope, also differ: a credential can allow access to a computing resource, or can protect the GlideinWMS framework from tampering, or can grant read or write access to storage, can provide an identity for accounting or auditing, or can provide a combination of any the formers. Furthermore, the tools in use do not include automatic forwarding and renewal of the new credentials so credential lifetime and renewal requirements became part of the discussion as well. In this paper, we will present how GlideinWMS was able to change its design and code to respond to all these changes.

Significant effort is currently invested in application integration, enabling business processes of different companies to interact and form complex multiparty processes. Web service standards, based on WSDL (Web Service Definition Language), have been adopted as process-to-process communication paradigms. However, the conceptual modeling of applications using Web services has not yet been addressed. Interaction with Web services is often specified at the level of the source code; thus, Web service interfaces are buried within a programmatic specification.In this article, we argue that Web services should be considered first-class citizens in the specification of Web applications. Thus, service-enabled Web applications should benefit from the high-level modeling and automatic code generation techniques that have long been advocated for Web application design and implementation. To this end, we extend a declarative model for specifying data-intensive Web applications in two directions: (i) high-level modeling of Web services and their interactions with the Web applications which use them, and (ii) modeling and specification of Web applications implementing new, complex Web services.Our approach is fully implemented within a CASE tool allowing the high-level modeling and automatic deployment of service-enabled Web applications.

We developed an identifier mapping application for bio-informatics research in Java programming language. It is easy to use and provides many usability functionalities that are expected as essentials for a professional appli-cation. It supports three widely used mapping services and can convert many ids from one source database in-to many target databases at once. Id mapping across service providers is possible by remapping the resultant ids. Because it adheres to the NetBeans platform archi-tecture, it can be incorporated into other NetBeans plat-form applications as an id mapping provider without adaption or modification.Availability: You can access the application at http://ne-on. gachon.ac.kr/idmapper.html.Keywords: ID mapping, java, netbeans, rich client, web services Introduction “-omics” style experiments, such as sequencing, micro-array, and proteomics, generate enormous amounts of data (Kim et al., 2006, Kim et al., 2008). To integrate and analyze the data in various respects, multiple tools are used. Each tool supports its own set of identifiers for genes or gene products. Even though there are widely used identifiers, such as Ensembl (Flicek et al., 2008), NCBI RefSeq (Pruitt et al., 2007), UniProt (The Uniprot Consortium, 2008) and HGNC (Povey et al., 2001), there is no universal identifier. When multiple tools and services are used, identifier conversion prob-lems across multiple databases arise frequently. A small research group can not afford its own mapping service and relies on external services. There exist efforts to reconcile identifiers across multiple source databases, such as the David gene ID conversion tool (Huang et al., 2008), MatchMiner (Bussey et al., 2003), IDconverter (Alibes et al., 2007), Onto- translate (Khatri et al., 2006), PICR (Cote et al., 2007), Synergizer (Brriz et al., 2008), and Biomart (Smedley et al., 2009). Services that are provided in the form of a web page can not be incorporated into other applications easily. Only a few services provide API access for batch map-ping or incorporation into other applications. The Protein Identifier Cross-Reference (PICR) service is a web application that provides interactive and pro-grammatic (SOAP and REST) access to a mapping algo-rithm that uses the UniProt Archive (UniParc) as a data warehouse to offer protein cross-references. The Syner-gizer is a service for translating between sets of bio-logical identifiers. It can, for example, translate Ensembl Gene IDs to Entrez Gene IDs, or IPI IDs to HGNC gene symbols, and much more. The Synergizer works via a web interface (for users who are not programmers) or through a web service (for programmatic access). BioMart is a query-oriented data management system, developed jointly by the Ontario Institute for Cancer Research (OICR) and the European Bioinformatics Insti-tute (EBI). It can be accessed via web services and can be adapted for identifier mapping. BridgeDb, though not released publically yet, is an-other attempt at an id mapping framework for bio-informatics applications. BridgeDb lets one add the fol-lowing capabilities quickly and easily: translate identi-fiers from one system to another, search references by id or symbol, and link out to online information for an identifier. Applications, such as the PathVisio pathway analysis tool, WikiPathways, CyThesaurus Cytoscape plug-in, and the NetworkMerge Cytoscape plug-in, are utilizing functionalities provided by BridgeDB.

Smart grid is the upgradation of the existing grid in terms of cost, communication infrastructure, internet of things and reliable technologies. In ambitious flagship programme of digital India-project an initiative of India, the potential fields of the missions are identified in the area are smart energy, smart grids, smart homes and smart cities. More than 100 smart cities are planned for information and communication technology driven solutions with big data analytics in India. The exponential growth in smart grids has given certain security risks, cyber threats and protection of stored data as Nation security. Smart Grids, comprising of several communication, monitoring intelligent, metering and electrical equipment used in power grid, have a greater exposure to grid security and cyber-attacks which are potentially disrupt distribution in a city. The paper discusses the electrical grid, challenges in smart grid and the use of Advanced Encryption Standard (AES) algorithm enable with field-programmable gate array (FPGA) hardware in smart grids. The AES encryption and decryption chip is designed in Xilinx ISE 14.2 software, synthesized on SPARTAN-3E FPGA and verified with some test cases to ensure that AES can be employed in smart grid security and communication infrastructure.

Application design driven by user needs is an increasing trend: such applications may not be anticipatable using traditional requirement and build approaches. Mashup refers to an integrated application programming interface (API) that combines data from different data destination or third party sources for Web services. This Web service provides a combined API that is technologically valid and compatible with other Web applications. In recent years, Web mashups have been tested for solving many issues in existing Web applications, such as e-science. In this paper, we analyzed a real service problem in a current virtual organization to show current limitations of using a distributed architecture, and to describe a Web service orientated architecture using the mashup concept. We provide a schematic solution for a paradigmatic user application problem, illustrated by a specific map usage need based on geographical information system data. Specifically, our illustrative application is finding the closest hotel within walking range of a meeting venue. Based on the case issues, we outline a generic architecture that offers a dynamic solution for Web portals providing services for dynamic user needs.

A Web-Based Perioperative Dashboard as a Platform for Anesthesia Informatics Innovation.

The World Wide Web has evolved gradually from a document delivery platform to an architecture for distributed programming. This largely unplanned evolution is apparent in the set of interconnected languages and protocols that any Web application must manage. This paper presents Ur/Web, a domain-specific, statically typed functional programming language with a much simpler model for programming modern Web applications. Ur/Web's model is unified, where programs in a single programming language are compiled to other "Web standards" languages as needed; supports novel kinds of encapsulation of Web-specific state; and exposes simple concurrency, where programmers can reason about distributed, multithreaded applications via a mix of transactions and cooperative preemption. We give a tutorial introduction to the main features of Ur/Web and discuss the language implementation and the production Web applications that use it.

In the era of technology, attack on computer infrastructure is considered as the most severe threat. Web server is one of the most important components of this infrastructure. Preventive measures must be taken to deal with these attacks on the web servers. For this reason, vulnerability detection needs to be carried out in an effective way and should be mitigated as soon as possible. In this paper, an effective framework for vulnerability detection of web application is proposed. This framework targets the web applications developed with content management systems (CMSs). It obtains prior knowledge of the vulnerable extensions of a specific CMS from its contributors. The framework is run against a target web server using a well-known port scanning tool, Nmap. It checks if there is any existing matches for the vulnerable extension installed in that web application. Finally, the framework gives an output comprised of the installed extensions along with the installed vulnerable extensions in that web application. Although the output result is shown in the Nmap console, the framework is a segregated entity that works in collaboration with Nmap. Thus this framework can be well-utilized by the security specialists to assess the security of a web application in an easier and effective way and also to evaluate vulnerability of web servers; hence shielding the web applications from various kinds of security threats.

Internet contains a tremendous amount of valuable web applications that can be used in many systems. To use this kind of applications with other systems, the interaction needs to be in a standard structured format such as XML web service. In this paper, we present a method to convert the current web applications into standard XML web services. The system design and implementation are presented. We applied the proposed system on two test cases: Jordan University of Science and Technology (JUST) course online schedule and Wiley product search engine.

Internet has been dominating the world nearly a decade. Web application is known to be the most widespread platform of the internet especially when it comes to share resources, e-commerce services, education and business platforms. Since the usage of web applications are increasing dramatically, it’s becoming more vulnerable for security attacks. Each year, organizations facing many security attacks towards their web applications. Although many security practices and mitigations have been applying in web application, however there are still some security loophole issues can be found in web application. For instance, these loopholes can be referred as lack of secure coding (standards) implemented in web application, lack of formal security training approach for web developers and improper security testing for their web application. Besides, social engineering attacks also tremendously increasing each year. Many organizations were compromised through phishing attacks due to lack of awareness among users (employees). As a solution to overcome the issues, a research project will be carried out to implement a system called Nscanner to detect Structured Query Language injection (SQLi) and Cross-Site Scripting (XSS) vulnerabilities for web application. Moreover, the developer also will design a malware detection feature based on machine learning approach to detect malware found in attachments from emails in order to prevent malware phishing attacks.