Abstract
Large-scale scientific and engineering computation is normally accomplished through the interaction of collaborating groups and diverse heterogeneous resources. Grid computing is emerging as an applicable paradigm, whilst, there is a critical challenge of authorization in the grid infrastructure. This paper proposes a Parallelized Subtask-level Authorization Service architecture (PSAS) based on the least privilege principle, and presents a context-aware authorization approach and a flexible task management mechanism. The minimization of the privileges is conducted by decomposing the parallelizable task and re-allotting the privileges required for each subtask. The dynamic authorization is carried out by constructing a multi-value community policy and adaptively transiting the mapping. Besides applying a relevant management policy, a delegation mechanism collaboratively performs the authorization delegation for task management. In the enforcement mechanisms involved, the authors have extended the RSL specification and the proxy certificate, and have modified the Globus gatekeeper, jobmanager and the GASS library to allow authorization callouts. Therefore the authorization requirement of an application is effectively met in the presented architecture.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Preview
Unable to display preview. Download preview PDF.
References
Foster, I., Kesselman, C., Tuecke, S.: The Anatomy of the Grid: Enabling Scalable Virtual Organizations. International Journal of Supercomputer Applications 15(3), 200–222 (2001)
Grimshaw, A., Wulf, W.A., et al.: The Legion Vision of a Worldwide Virtual Machine. Communications of the ACM 40(1), 39–45 (1997)
Foster, I., Kesselman, C.: Globus: a metacomputing infrastructure toolkit. International Journal of Supercomputer Applications 11(2), 115–128 (1997)
Tuecke, S., et al.: Internet X.509 Public Key Infrastructure Proxy Certificate Profile (2002)
Foster, I., Kesselman, C., Tsudik, G., Tuecke, S.: A Security Architecture for Computational Grids. In: Proc. of 5th ACM Conference on Computer and Communications Security Conference (1998)
Kagal, L., Finin, T., Peng, Y.: A Delegation Based Model For Distributed Trust. In: IJCAI 2001 Workshop on Autonomy, Delegation, and Control (2001)
Salzer, J.R., Schroeder, M.D.: The Protection of Information in Computer Systems. Proc. of the IEEE (1975)
Pearlman, L., Welch, V., et al.: A Community Authorization Service for Group Collaboration. In: Proc. of the 3rd IEEE International Workshop on Policies for Distributed Systems and Networks (2002)
Johnston, W., Mudumbai, S., et al.: Authorization and Attribute Certificates for Widely Distributed Access Control. In: Proc. of IEEE 7th International Workshops on Enabling Technologies: Infrastructures for Collaborative Enterprises (1998)
Alfieri, R., et al.: VOMS: an Authorization System for Virtual Organizations. In: Proc. of the 1st European Across Grids Conference (2003)
Lorch, M., Adams, D.B., et al.: The PRIMA System for Privilege Management, Authorization and Enforcement in Grid Environments. In: Proc. of the 4th International Workshop on Grid Computing (2003)
Lorch, M., Kafura, D.: Supporting Secure Ad-hoc User Collaboration in Grid Environments. In: Proc. of the 3rd IEEE/ACM International Workshop on Grid Computing (2002)
Zhang, G., Parashar, M.: Dynamic Context-aware Access Control for Grid Applications. In: Proc. of the 4th International Workshop on Grid Computing (2003)
Sandhu, R., Coyne, E., et al.: Role-based Access Control Models. In: Proc. of the 5th ACM Workshop on Role-Based Access Control (2000)
Keahey, K., Welch, V., et al.: Fine-Grain Authorization Policies in the Grid: Design and Implementation. In: Proc. of the1st International Workshop on Middleware for Grid Computing (2003)
Kim, S., Kim, J., Hong, S., et al.: Workflow-based Authorization Service in Grid. In: Proc. of the 4th International Workshop on Grid Computing (2003)
Romberg, M.: The UNICORE Architecture: Seamless Access to Distributed Resources. In: Proc. of the 8th IEEE International Symposium on High Performance Distributed Computing (1999)
Dey, A.K., Abowd, G.D.: The Context Toolkit: Aiding the Development of Context- Aware Applications. In: Proc. of Human Factors in Computing Systems: CHI 1999 (1999)
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2004 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Huang, C., Song, G., Zheng, Y., Chen, D. (2004). An Authorization Architecture Oriented to Engineering and Scientific Computation in Grid Environments. In: Yew, PC., Xue, J. (eds) Advances in Computer Systems Architecture. ACSAC 2004. Lecture Notes in Computer Science, vol 3189. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-540-30102-8_39
Download citation
DOI: https://doi.org/10.1007/978-3-540-30102-8_39
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-540-23003-8
Online ISBN: 978-3-540-30102-8
eBook Packages: Springer Book Archive