Jim Basney

This paper introduces Cybershuttle, a new type of user-facing cyberinfrastructure that provides seamless access to a range of resources for researchers, enhancing their productivity. The Cybershuttle Research Environment is built on open source Apache Airavata software and uses a hybrid approach that integrates locally deployed agent programs with centrally hosted middleware. This enables end-to-end integration of computational science and engineering research across a range of resources, including users’ local resources, centralized university computing and data resources, computational clouds, and NSF-funded national-scale computing centers. To ensure a user-centered approach, we have designed the scientific user environments with the best user-centered design practices.

Managing and exchanging sensitive information securely is a paramount concern for the scientific and cybersecurity community. The increasing reliance on computing workflows and digital data transactions requires ensuring that sensitive information is protected from unauthorized access, tampering, or misuse. This research paper presents a comparative analysis of three novel approaches for authenticating and securing access to scientific data: SciTokens, Verifiable Credentials, and Smart Contracts. The aim of this study is to investigate the strengths and weaknesses of each approach from trust, revocation, privacy, and security perspectives. We examine the technical features and privacy and security mechanisms of each technology and provide a comparative synthesis with the proposed model. Through our analysis, we demonstrate that each technology offers unique advantages and limitations, and the integration of these technologies can lead to more secure and efficient solutions for authentication and access to scientific data.

CILogon provides a federated X.509 certification authority for secure access to cyberinfrastructure such as the Extreme Science and Engineering Discovery Environment (XSEDE). CILogon relies on federated authentication (SAML and OpenID) for determining user identities when issuing certificates. Federated authentication enables users to obtain certificates using existing identities (university, Google, etc.). Federated authentication also enables CILogon to serve a national-scale user community without requiring a large network of registration authorities performing manual user identification. CILogon supports multiple levels of assurance and custom interfaces for specific user communities. In this article we introduce the CILogon service and describe experiences and lessons learned from the first three years of operation.

Federating security and trust is one of the most significant architectural requirements in grids. In this regard, one challenging issue is the cross-organizational authentication and identification. Organizations participated in Virtual Organizations (VOs) may use different security infrastructures that implement different authentication and identification protocols. Thus, arises an architectural need to provide a mechanism for a lightweight, rapid and interoperable translation of security credentials from an original format to a format understandable by recipients. In this paper, we describe the development and the implementation of an architecture for credential mapping in grids using off-the-shelf technologies and standard specifications. Our open-source implementation of this architecture provides support for an on-the-fly exchange for different types of security credentials used by diverse grid security infrastructures.

In recent years, trust negotiation has been proposed as a novel authorization solution for use in open-system environments, in which resources are shared across organizational boundaries. Researchers have shown that trust negotiation is indeed a viable solution for these environments by developing a number of policy languages and strategies for trust negotiation that have desirable theoretical properties. Further, existing protocols, such as TLS, have been altered to interact with prototype trust negotiation systems, thereby illustrating the utility of trust negotiation. Unfortunately, modifying existing protocols is often a time-consuming and bureaucratic process that can hinder the adoption of this promising technology. In this paper, we present Traust, a third-party authorization service that leverages the strengths of existing prototype trust negotiation systems. Traust acts as an authorization broker that issues access tokens for resources in an open system after entities use trust negotiation to satisfy the appropriate resource access policies. The Traust architecture was designed to allow Traust to be integrated either directly with newer trust-aware applications or indirectly with existing legacy applications; this flexibility paves the way for the incremental adoption of trust negotiation technologies without requiring widespread software or protocol upgrades. We discuss the design and implementation of Traust, the communication protocol used by the Traust system, and its performance. We also discuss our experiences using Traust to broker access to legacy resources, our proposal for a Traust-aware version of the GridFTP protocol, and Traust's resilience to attack.

In order for Grids to become relied upon for critical infrastructure and scientific computing, Grid-wide management must be automated so that it is possible in quickly and comprehensively respond to or anticipate specific environmental changes and requirements. That is, due to the disjoint administration of Grids which results in high communication requirements as well as large numbers of skilled administrators, manual reconfiguration of large portions of a Grid in such situations is not a viable solution. We have developed an architecture that allows changes to the grid configuration to be automated in response to operator input or sensors placed throughout the Grid. Additionally, our architecture allows the resource owner to specify who is allowed to alter the configuration of his resource and what types of reconfigurations are allowed. This permits the automation of reconfiguration while retaining owner control of the individual resources. Our experiments show that this architecture can be used to reconfigure a representative GT4-based development grid to enforce maximum latency limits on a Virtual Organization's jobs by dynamically controlling job priorities Grid-wide.