Abstract
The widespread acceptance and uptake of Grid technology can only be achieved if it can be ensured that the security mechanisms needed to support Grid based collaborations are at least as strong as local security mechanisms. The predominant way in which security is currently addressed in the Grid community is through Public Key Infrastructures (PKI) to support authentication. Whilst PKIs address user identity issues, authentication does not provide fine grained control over what users are allowed to do on remote resources (authorisation). The Grid community have put forward numerous software proposals for authorisation infrastructures such as AKENTI [1], CAS [2], CARDEA [3], GSI [4], PERMIS [5,6,7] and VOMS [8,9]. It is clear that for the foreseeable future a collection of solutions will be the norm. To address this, the Global Grid Forum (GGF) have proposed a generic SAML based authorisation API which in principle should allow for fine grained control for authorised access to any Grid service. Experiences in applying and stress testing this API from a variety of different application domains are essential to give insight into the practical aspects of large scale usage of authorisation infrastructures. This paper presents experiences from the DTI funded BRIDGES project [10] and the JISC funded DyVOSE project [11] in using this API with Globus version 3.3 [12] and the PERMIS authorisation infrastructure.
This is a preview of subscription content, log in via an institution.
Buying options
Tax calculation will be finalised at checkout
Purchases are for personal use only
Learn about institutional subscriptionsPreview
Unable to display preview. Download preview PDF.
References
Johnston, W., Mudumbai, S., Thompson, M.: Authorization and Attribute Certificates for Widely Distributed Access Control. In: IEEE 7th Int. Workshop on Enabling Technologies: Infrastructure for Collaborative Enterprises, http://www-itg.lbl.gov/security/Akenti/
Pearlman, L., et al.: A Community Authorisation Service for Group Collaboration. In: Proceedings of the IEEE 3rd International Workshop on Policies for Distributed Systems and Networks (2002)
Lepro, R.: Cardea: Dynamic Access Control in Distributed Systems, NASA Technical Report NAS-03-020 (November 2003)
Globus Grid Security Infrastructure (GSI), http://www-unix.globus.org/toolkit/docs/3.2/gsi/index.html
Chadwick, D.W., Otenko, A., Ball, E.: Role-based Access Control with X.509 Attribute Certificates. IEEE Internet Computing, 62–69 (March-April 2003)
Chadwick, D.W., Otenko, A.: The PERMIS X.509 Role Based Privilege Management Infrastructure. Future Generation Computer Systems 936, 1–13 (2002)
Privilege and Role Management Infrastructure Standards Validation project, http://www.permis.org
VOMS Architecture. European Datagrid Authorization Working group, September 5 (2002)
Steven Newhouse. Virtual Organisation Management. The London E-Science centre, http://www.lesc.ic.ac.uk/projects/oscar-g.html
BioMedical Research Informatics Delivered by Grid Enabled Services project (BRIDGES), http://www.nesc.ac.uk/hub/projects/bridges
Dynamic Virtual Organisations in e-Science Education project (DyVOSE), http://www.nesc.ac.uk/hub/projects/dyvose
Globus, http://www.globus.org
Housley, R., Polk, T.: Planning for PKI: Best Practices Guide for Deploying Public Key Infrastructures. Wiley Computer Publishing, Chichester (2001)
ITU-T Recommendation X.509, ISO/IEC 9594-8: 2001, Information technology – Open Systems Interconnection – Public-Key and Attribute Certificate Frameworks (2001)
JISC Authentication, Authorisation and Accounting (AAA) Programme Technologies for Information Environment Security (TIES), http://www.edina.ac.uk/projects/ties/ties_23-9.pdf
Whitten, A., Tygar, J.D.: Why Johnny can’t encrypt: a usability evaluation of PGP 5.0. In: Paper presented at the 9th USENIX security symposium, Washington (1999)
Chadwick, D., Otenko, O.: A Comparison of the Akenti and PERMIS Authorization Infrastructures, in Ensuring Security in IT Infrastructures. In: El-Hadidi, M.T. (ed.) Proceedings of ITI First International Conference on Information and Communications Technology (ICICT 2003), Cairo University, pp. 5–26 (2003)
Conceptual AuthZ Framework and Classification (DOC), https://forge.gridforum.org/docman2/ViewCategory.php?group_id=55&category_id=458
Stell, A.J.: Grid Security: An Evaluation of Authorisation Infrastructures for Grid Computing, MSc Dissertation, University of Glasgow (2004)
ITU-T Rec. X.509, ISO/IEC 9594-8. The Directory: Authentication Framework (2000)
UK e-Science Certification Authority, http://www.grid-support.ac.uk
ITU-T Rec X.812, ISO/IEC 10181-3:1996, Security Frameworks for open systems: Access control framework (1995)
Welch, V., Siebenlist, F., Chadwick, D., Meder, S., Pearlman, L.: Use of SAML for OGSA Authorization (June 2004), https://forge.gridforum.org/projects/ogsa-authz
OASIS. Assertions and Protocol for the OASIS Security Assertion Markup Language (SAML) v1.1. September 2 (2003), http://www.oasis-open.org/committees/security/
Cardiovascular Functional Genomics project, http://www.brc.dcs.gla.ac.uk/projects/cfg/
Open Grid Service Architecture – Data Access and Integration project (OGSA-DAI), http://www.ogsadai.org.uk
IBM Information Integrator, http://www.ibm.com
EMBL-EBI European Bioinformatics Institute, http://www.ebi.ac.uk/ensembl/
OpenSSL to create certificates, http://www.flatmtn.com/computer/Linux-SSLCertificates.html
Von Welch/Jennifer Schopf personal communications
Jokl, J., Basney, J., Humphrey, M.: Experiences using Bridge CAs for Grids. In: Proceedings of UK Workshop on Grid Security Practice, Oxford (July 2004)
Virtual Organisations for Trials and Epidemiological Studies project (VOTES), http://www.nesc.ac.uk/hub/projects/votes
Shibboleth, http://shibboleth.internet2.edu/
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2005 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Sinnott, R.O., Stell, A.J., Chadwick, D.W., Otenko, O. (2005). Experiences of Applying Advanced Grid Authorisation Infrastructures. In: Sloot, P.M.A., Hoekstra, A.G., Priol, T., Reinefeld, A., Bubak, M. (eds) Advances in Grid Computing - EGC 2005. EGC 2005. Lecture Notes in Computer Science, vol 3470. Springer, Berlin, Heidelberg. https://doi.org/10.1007/11508380_28
Download citation
DOI: https://doi.org/10.1007/11508380_28
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-540-26918-2
Online ISBN: 978-3-540-32036-4
eBook Packages: Computer ScienceComputer Science (R0)