Policy Based Dynamic Negotiation for Grid Services

Policy-based dynamic negotiations allow more flexible authorization in complex Grid environments, and relieve both users and administrators from up front negotiations and registrations. This paper describes how such negotiations overcome current Grid authorization limitations, and how policy-based negotiation mechanisms can be easily integrated into a Grid infrastructure. Such an extension provides advanced access control and automatic credential fetching, and can be integrated and implemented in the new version 4.0 of the Globus Toolkit

Policy-driven Negotiation for Authorization in the Grid

Abstract — In many Grid services deployments, the clients and servers reside in different administrative domains. Hence, there is a requirement both to discover each other’s authorization policy, in order to be able to present the right assertions that allow access, and to reveal as little as possible of the access policy details to unauthorized parties. This paper describes a mechanism where the client and servers are semantically annotated with policies that protect their resources. These annotations specify both constraints and capabilities that are used during a negotiation to reason about and communicate the need to see certain credentials from the other party and to determine whether requested credentials can be obtained and revealed. The result of the negotiation is a state where both parties have satisfied their policy constraints for a subsequent interaction or where such interaction is disallowed by either or both. Furthermore, we present an implementation of a prototype, based on the PEERTRUST policy language and its reasoning engine, that is integrated in the Web services runtime component of the Globus Toolkit. The negotiation process is facilitated through the implementation of WSRF-compliant service interfaces for protocol message exchanges. I