DidaWiki

Questa pagina è in sola lettura. Puoi visualizzare il sorgente, ma non puoi modificarlo. Contatta l'amministratore se pensi che ci sia un errore.
Grid is a computational environment where heterogeneous resources are
virtualized and outsourced to multiple users across the Internet. The in-
creasing popularity of the resources visualization is explained by the emerg-
ing suitability of such technology for automated execution of heavy parts of
business and research processes. Efficient and flexible model for access and
usage control over computational Grid resources is a prominent challenge.
This talk will outline the novel access and usage control model providing
the fine-grained and continuous control over computational Grid resources.
The approach takes into account peculiarities of Grid: service-oriented archi-
tecture, long-lived interactions, heterogeneity and distribution of resources,
openness and high dynamics.
We tackle the access and usage control problem by Usage CONtrol (UCON)
model, introduced by R. Sandhu and J. Park. UCON is an attribute-based
access control model where an access decision is formed by evaluating autho-
rization and condition predicates, and fulfillment of obligation actions. Con-
tinuous control and mutability of attributes are main novelties of the UCON
model regarding traditional access control model. UCON assumes that at-
tributes might change during execution of granted access rights. Continuous
control means that an access decision is made not only before allowing access
a service, but also when the access is in progress, i.e. the requestor executes
access rights.
Access and usage control over Grid services is considered on three levels of
abstraction: policy, enforcement and implementation. The policy level intro-
duces security policies designed to specify the desired granularity of control:
coarse-grained policies that manages access and usage of Grid services, and
fine-grained policies that monitor the usage of underlying resources allocated
for a particular Grid service instance. The enforcement level presents the
architecture of the state-full reference monitor designed to enforce security
policies on coarse- and fine-grained levels of control. The implementation
level presents a proof-of-concept realization of our access and usage control
model in Globus Toolkit.