A community authorization service for group collaboration

By Laura Pearlman, Von Welch, Ian T Foster, Carl Kesselman, Steven Tuecke. Proceedings Third International Workshop on Policies for Distributed Systems and Networks, 2002

756 citations recorded by the source corpus.

In "grids" and "collaboratories", we find distributed communities of resource providers and resource consumers, within which often complex and dynamic policies govern who can use which resources for which purpose. We propose a new approach to the representation, maintenance and enforcement of such policies that provides a scalable mechanism for specifying and enforcing these policies. Our approach allows resource providers to delegate some of the authority for maintaining fine-grained access control policies to communities, while still maintaining ultimate control over their resources. We also describe a prototype implementation of this approach and an application in a data management context.

Subfields: Computer Networks and Communications, Information Systems and Management

View Paper: https://www.semanticscholar.org/paper/5949c5ec91a8506ae6356ce77bc7c7e9f4db46d1

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Computer Networks and Communications

In Information Systems and Management

Citations in the corpus

VOMS, an Authorization System for Virtual Organizations (2003, methodology): “This means that the ultimate decision about what happens in a farm is removed from the farm administrator and put in the hands of the CAS administrator , thus breaking one of the fundamental rules of the grid: the farm administrator has total control about what happens on his machines.”
SHARP: an architecture for secure resource peering (2003, background): “Many systems use signed assertions to specify access privileges, including CRISIS [9], NASD [24], the Globus Community Authorization Service (CAS) [35], and systems for decentralized trust management discussed below.”
On Death, Taxes, and the Convergence of Peer-to-Peer and Grid Computing (2003, background): “Much work has been expended within the Grid community on both technical and organizational issues associated with creating and operating persistent, multi-purpose infrastructure services for authentication [24], authorization [38, 53], discovery [16], resource access, data movement, and so forth.”
Giggle: A Framework for Constructing Scalable Replica Location Services (2002, background): “CASCON'98 Conference.”
The Globus Striped GridFTP Framework and Server (2005, methodology): “Globus GridFTP provides an implementation that supports both a Globus “gridmapfile” and Community Authorization Service [44] credentials, which may”
Brain Meets Brawn: Why Grid and Agents Need Each Other (2004, background): “More recent work has focused on the application of richer policy statements and the creation of community based authorization and assertion authorities [27].”
Security for Grid services (2003, background): “CAS allows a VO to express the policy that has been outsourced to it by the resource providers in the VO.”
Dynamic virtual clusters in a grid site manager (2003, background): “The outlines of the next-generation grid are now visible [9, 10, 12, 13, 25]: it will include policy-based resource management, distributed authorization, dynamic instantiation of software environments and services, resource reservations for predictable application service quality, and dynamic adapt”
SNAP: A Protocol for Negotiating Service Level Agreements and Coordinating Resource Management in Distributed Systems (2002, methodology): “However, for security reasons, the computation is not performed using a group account, but rather, a temporary account is dynamically created for the computation (In [30], we describe a community authorization service which can be used to authorize activities on behalf of a user community).”