Cycle-scavenging grids appeal to organizations with large numbers of workstations that remain idle outside of normal working hours. This represents a potential source of grid computing cycles, but the security and isolation issues that come with the use of non-dedicated resources have slowed their adoption in the enterprise. In this paper we present Cyclotron, a prototype cycle-scavenging grid solution that leverages virtualization and a declarative security policy-based access control infrastructure, supporting flexible authorization rules and the constrained delegation of access rights, to address these requirements. Copyright © 2009 John Wiley & Sons, Ltd.

A central task in the context of logic-based decentralized authorization languages is that of gathering credentials from credential providers, required by the resource guard's policy to grant a user's access request. This paper presents an abduction-based algorithm that computes a specification of missing credentials without communicating with remote credential providers. The specification is used to gather credentials from credential providers in a single pass, without involving any communication with the resource guard. The credentials gathered thus are pushed to the resource guard at authorization time. This approach decouples authorization from credential gathering, and, in comparison to server-side pull methods, reduces the number of messages sent between participants, and allows for environments in which some credential providers are unknown or unavailable to the resource guard at authorization time.

The problem of authorization in large-scale decentralized systems has been addressed by a number of logic-based policy languages utilizing delegation of authority and distributed security credentials. A central task in this context is that of gathering a set of credentials for a given access request. Previous approaches have focused on methods in which credentials are pulled on-demand from credential providers during authorization. These methods may result in multiple, and potentially futile, costly queries to the same remote credential provider, and require that providers be known and available to the resource guard at access time. A novel decentralized protocol is presented in this paper to address these shortcomings. The approach uses logical abduction to statically and locally compute a specification of credentials needed to satisfy a given query against a policy. Based on such a specification, credentials are gathered using a single-pass protocol that queries each provider only once and does not involve any communication with the resource guard. The credentials gathered thus are then pushed to the resource guard at authorization time. This approach decouples authorization from credential gathering, and, in comparison to server-side pull methods, reduces the number of messages sent between participants, and allows for communication topologies in which some credential providers are unknown or unavailable to the resource guard at authorization time.

Grid access control policy languages today are generally one of two extremes: either extremely simplistic, or overly complex and challenging for even security experts to use. In this paper, we explicitly identify requirements for an access control policy language for grid data and then consider six specific data access use-cases that have been problematic in today's grids: attribute-based access, role-based access, "role-deny" access, impersonation-based access, delegation-based access, and capability-based access. We evaluate the security policy assertion language (SecPAL) against those requirements, specifically in the context of these six use-cases involving GridFTP.NET. We find that while some of these six use-cases are individually possible via existing Grid authorization systems, we believe that SecPAL uniquely offers a single approach that meets the requirements of a grid access control policy language, thereby creating support for a wide range of expanded scenarios for grid data access.

Dans une implementation exemplaire, un schema de securite a deux branches comprend un premier niveau qui ne permet pas l'usage des negations et un second niveau qui permet l'usage des negations. Dans une autre implementation exemplaire, une table de demandes d'autorisation fait correspondre des operations respectives specifiques aux ressources avec des demandes d'autorisation associees respectives. Dans encore une autre implementation exemplaire, des demandes d'autorisation peuvent avoir des negations mais pas les assertions individuelles.

The Security Policy Assertion Language (SecPAL) provides a flexible and robust declarative authorization language developed for large-scale Grid Computing Environments (GCEs). This specification describes the XML syntax and data encoding conventions required to support an implementation of SecPAL.