Re-thinking Grid Security Architecture

Abstract

Abstract-The security models used in Grid systems today strongly bear the marks of their diverse origin. Historically retrofitted to the distributed systems they are designed to protect and control, the security model is usually limited in scope and applicability, and its implementation tailored towards a few specific deployment scenarios. A common approach towards even the "basic" elements such as authentication to resources is only now emerging, whereas for more complex issues such as community organization, integration of site access control with operating systems, crossdomain resource provisioning, or overlay community Grids ("late authentication" for pilot job frameworks or communitybased virtual machines) there is no single coherent and consistent "security" view. Via this paper we aim to share some observations on current security models and solutions found in Grid architectures and deployments today and identify architectural limitations in solving complex access control and policy enforcement scenarios in distributed resource management. The paper provides a short overview of the OGSA security services and other security solutions used in Grid middleware and operations practice. However, it is becoming clear that further development in Grid requires a fresh look at the concepts, both operationally and securitywise. This paper analyses the security aspects of different types of Grids and a set of use cases that may require extended security functionality, such as dynamic security context management, and management of stateful services. Recent developments in open systems security, and revisiting basic security concepts in networking and computing including the OSI Security Architecture and the concepts used in the Trusted Computing Base provide interesting examples on how some of the conceptual security problems in Grid can be addressed, and on how the shortcomings of current systems and the frequently proposed "ad-hoc" stop-gaps for what are in fact complex security manageability problems may be avoided. This paper is thus intended to initiate and stimulate the wider discussion on the concepts of Grid security, thereby setting the scene for and providing input to a Grid security taxonomy leading to a more consistent Grid Security Architecture.

Security Infrastructure for On-demand Provisioned Cloud Infrastructure Services

“…Grid security architecture is primarily based on the Virtual Organisations (VO) that are created by the cooperating organisations that share resources (which however remain in their their ownership) based on mutual agreement between VO members and common VO security policy. In Grids, VO actually acts as a federation of the users and resources that enables federated access control based on the federated security and trust model [20,21].…”

“…We refer in this paper to the Security Services Lifecycle Management (SSLM) model proposed by authors in earlier work [20]. The SSLM describes security services operation in generically distributed multidomain environment and extends the existing SLM frameworks (and SDF in particular) with the additional stages "Reservation Session Binding" (as part of the SDF reservation stage) and "Registration and Synchronisation" (as part of the SDF deployment stage), which specifically target such scenarios as the provisioned services/resources restoration, upgrade or migration (in the framework of the active provisioning session) and provide necessary mechanisms for remote data protection by binding them to the provisioning session context and remote run-time environment.…”

Security Services Lifecycle Management in On-Demand Infrastructure Services Provisioning

“…Grid security architecture is primarily based on the Virtual Organisations (VO) that are created by the cooperating organisations that share resources (which however remain in their remaining in their ownership) based on mutual agreement between VO members and common VO security policy. In Grids, VO actually acts as a federation of the users and resources that enables federated access control based on the federated trust and security model [19,20].…”

Accessing the Data Security Model in Distributed System

“…For grid computing the security is based on public key infrastructure (PKI). Kerberos password etc [9]. Hasan et al, introduced threat model named CIAA threat model.…”