Dynamic security perimeters for inter-enterprise service integration

Abstract

Levaraging the convergence of Grid and Web services technologies, we anticipate the emergence of new business and scientific computing paradigms that are based on dynamic Virtual Organisations (VO). These VOs span across organisational boundaries and enable the enactment of collaborative processes that integrate services, resources and knowledge in order to perform tasks that the VO partners could not undertake on their own. Such a dynamic and complex structure opens several challenging problems relating to VO security.

In this paper, we summarise a novel architecture supporting Grid-enabled collaboration for the purposes of Application Service Provision. We then focus on the underpinning security architecture that enables the federated management and distributed enforcement of dynamic security perimeters for virtual communities of services, and on resources that span across administrative and enterprise boundaries. We highlight how this architecture, realised in the context of a European research project developing a Grid platform for application serviced provision, addresses the outstanding challenges that underlie the automation of trust and security management in scalable, multi-institutional, and dynamic Virtual Organisations.

Introduction

Application Service Provision (ASP) is a business model, originally derived from the idea of using the Internet or other wide area networks to provide online application services on a rental basis — commercially delivering computing as a service. The ASP model takes advantage of several technological breakthroughs that have made it feasible to sell computing as a service rather than a product. The traditional ASP model can be understood as an evolution of outsourcing — clients enjoy the benefit of offloading complex and expensive IT infrastructure to the ASPs while maintaining control and visibility of the business processes. However, performance, security, reliability and maintenance are still bound by the constraints of solutions originally designed for specialised in-house implementations.

More recently, a new form of ASP has emerged (called IBSP — Internet Business Service Provider in [1]), based on a Business Model that better exploits the wide adoption of the Internet and the Web. The IBSP model focuses on ASPs providing applications that are Internet-enabled by design and network-centric (e.g. being themselves a bundle of loosely coupled Internet-enabled services). IBSPs and Independent Software Vendors (ISV) [2] target economies of scale, in addition to economies of skill. They run their services in a multi-tenancy model, supporting thousands of customers on a single code basis; they reduce hardware and administration costs by partitioning and distributing resources, while reducing client-side development and maintenance investment by using standard Web technology at the client side interface as well.

In parallel to IBSP, utility computing has emerged as a paradigm where shared infrastructure can be provided on demand to multiple customers [12]. The business model lets companies pay for IT services as needed, charge customers per-use or by metered use, following an analogy to the “electric company” paradigm: “when usage spikes, so does the bill”. Supporting this charging model requires dynamic allocation of resources and integration of services.

Leveraging the convergence of Grid and Web services technologies, we anticipate the emergence of new business and scientific computing paradigms that are based on dynamic Virtual Organisations (VOs). These VOs span across organisational boundaries and enable the enactment of collaborative processes that integrate services, resources and knowledge in order to perform tasks that the VO partners could not undertake on their own. Such a dynamic and complex structure opens up several challenging problems related to the VO security. (See [8] for an indicative overview of these challenges.):

• collaborating services and resources may be based in different security domains;

• on-demand collaboration implies trust has to be established in real time on a P2P basis;

• collaborators need protection from other VO members, as well as from outsiders;

• the same service or resource may participate in different VOs, and hence different (potentially conflicting) security policies may apply;

• security conditions for a service or resource may differ throughout the life of the VO;

• no centralised administrative point implies a devolved policy management scheme combined with distributed enforcement at a peer level.

A suitable architecture must provide a security and trust management infrastructure that meets these requirements. We will introduce the basic elements of such an architecture, the underlying model of which has been analysed in [4], [5], [11], and gradually explain how it aims to address the above requirements by means of dynamic security perimeters.

According to [17], a security perimeter is defined as “the boundary of the domain (introduced by space or logical architecture of the system) in which security policy or security architecture applies”. Correspondingly (and in a context more applicable to the IBSP and ISV business models), dynamic security perimeters contain communities of agents, services and resources that collaborate in order to enact a business process, and may span across several organisational (security) domains. Each perimeter contains only those network entities that are involved in the enactment of a specific task at a time. Its lifetime is bound between the initiation and completion of that activity, and its membership may expand or shrink dynamically as the new services and resources are pulled-in and others (which are already in) are released after fulfilling their tasks, or are expelled for misbehaving. In the context of each perimeter, a network entity is allowed to perform actions and communicate in accordance with the roles that it may assume, as agreed by the contributing Organisations.

The results reported in this paper have been produced in the context of the European projects GRASP (www.eu-grasp.net) and TrustCoM (www.eu-trustcom.com), and are a part of a novel VO security solution that is currently in an advanced stage of prototype development.

The remainder of the paper is structured as follows: in Section 2, we summarise a business motivation and give an overview of a VO ecosystem used for prototyping the security solution presented in this paper. In Section 3, we describe the security models underpinning this security solution, and examine its architecture from various viewpoints: the underlying logical model, the underlying interaction and communication models, the life-cycle model of a “dynamic security perimeter” during the enactment of a collaborative activity, and the enforcement of both message-level security and access control decisions. In Section 4, we describe our experiences with a first prototype implementation that has been developed in the context of the EU project GRASP, and provide a more elaborate description of how the security protocol and enforcement mechanisms described in previous sections of the paper have been realised over a.NET based Web/Grid services platform. In Section 5, we review related work and we compare our work with the current “state-of-the-art” of Grid and VO security solutions. In Section 6, we conclude by summarising the main results and plans for future development.