Advanced security for virtual organizations: the pros and cons of centralized vs decentralized security models

Sinnott, R.O., Chadwick, D.W., Doherty, T., Martin, D., Stell, A., Stewart, G., Su, L. and Watt, J. (2008) Advanced security for virtual organizations: the pros and cons of centralized vs decentralized security models. In: Priol, T., Lefevre, L. and Buyya, R. (eds.) CCGRID 2008 Eighth IEEE International Symposium on Cluster Computing and the Grid : proceedings : 19-22 May, 2008, Lyon, France. IEEE Computer Society: Los Alamitos, USA, pp. 106-113. ISBN 9780769531564 (doi: 10.1109/CCGRID.2008.67)

Abstract

Grids allow for collaborative e-Research to be undertaken, often across institutional and national boundaries. Typically this is through the establishment and management of virtual organizations (VOs) where policies on access and usage of resources across partner sites are defined and subsequently enforced. For many existing VOs, these agreements have been lightweight and erred on the side of flexibility with minimal constraints on the kinds of jobs a user is allowed to run or the amount of resources that can be consumed. For many new domains such as e-Health, such flexibility is simply not tenable. Instead, precise definitions of what jobs can be run, and what data can be accessed by who need to be defined and enforced by sites. The role based access control model (RBAC) provides a well researched paradigm for controlling access to large scale dynamic VOs. However, the standard RBAC model does not specify how roles should be defined and made known to local resource sites (who are always deemed to be autonomous to make access control decisions). Two main possibilities exist based on either a centralized or decentralized approach to VO role management. We present the advantages and disadvantages of the centralized and decentralized role models and describe how we have implemented them in a range of security focused e-Research domains at the National e-Science Centre (NeSC) at the University of Glasgow.

• Item Type: Book Sections
• Status: Published
• Refereed: Yes
• Glasgow Author(s) Enlighten ID: Stell, Mr Anthony and Watt, Dr John and Doherty, Mr Thomas and Sinnott, Professor Richard and Martin, Mr David
• Authors: Sinnott, R.O., Chadwick, D.W., Doherty, T., Martin, D., Stell, A., Stewart, G., Su, L., and Watt, J.
• Subjects: Q Science > QA Mathematics > QA75 Electronic computers. Computer science
• College/School: University Services > IT Services > Computing Service; University Services > IT Services > E-Science
• Publisher: IEEE Computer Society
• ISBN: 9780769531564
• Copyright Holders: Copyright © 2008 IEEE Computer Society
• Publisher Policy: Reproduced in accordance with the copyright policy of the publisher.