Managing and exchanging sensitive information securely is a paramount concern for different domains such as scientific, finance, cybersecurity, and healthcare. The increasing reliance on computing workflows and digital data transactions requires ensuring that sensitive information is protected from unauthorized access, tampering, or misuse and ensuring data integrity and transparency. To address this need, several approaches have been proposed such as JWT, SciTokens, Verifiable Credentials, and Smart Contracts which provide different methods for managing and exchanging information securely in centralized or decentralized and trustworthy environments. However, each technology offers unique advantages and limitations that require a comprehensive analysis to understand its potential and challenges. In our previous study, we conducted a comprehensive analysis of these approaches for authenticating and securing access to scientific data. This research further proposes a novel blockchain-based verifiable credentials that integrate the concept of Smart Contracts. The aim of this study is to introduce a decentralized and privacy-preserving authentication mechanism to enable stakeholders to share, verify, or revocation of their data with enhanced security, transparency, and trust. The proposed framework utilizes two different blockchain frameworks, Hyperledger Fabric and Ethereum to conduct comprehensive research to evaluate the effectiveness of both frameworks for the development of verifiable credentials. Our analysis indicates that Hyperledger Fabric offers enhanced security and ensures robust integrity through a private network and chaincode mechanism for authentication and access to data. As a result of our analysis, we adopt Hyperledger Fabric for the implementation and demonstration of the final version of our framework. We evaluate the proposed approach with a set of educational data to measure the effectiveness of the system. We find the proposed framework enables users to share data effectively within a secure network and only authorized stakeholders are allowed to access the shared data.

Research networks provide high-speed wide-area network connectivity between research and education institutions to facilitate large-scale data transfers. However, scalability issues of legacy transfer applications such as scp and FTP hinder the effective utilization of these networks. Although researchers extended the legacy transfer applications to increase their performance by exploiting I/O and network parallelism, these solutions necessitate users to fine-tune parallelism level, a task that is challenging even for experienced users due to the dynamic nature of networks. In this article, we propose an online optimization algorithm,Falcon, to tune the degree of parallelism for file transfers to maximize transfer throughput while keeping system overhead at a minimum. As research networks are shared infrastructures, we introduce a game theory-inspired novel utility function to evaluate the performance of various parallelism levels such that competing transfers are guaranteed to converge to a fair and stable solution. We assessed the performance ofFalconin isolated and production high-speed networks and found that it can discover optimal transfer parallelism in as little as 20 seconds and outperform the state-of-the-art solutions by more than$2\times$. Moreover,Falconis guaranteed to converge to Nash Equilibrium when multiple transfers compete for the same resources with the help of its game theory-inspired utility function. Finally, we demonstrate thatFalconcan also be used as a central transfer scheduler to speed up convergence time, increase stability, and enforce system/user-level resource limitations in shared networks.

Science Gateways bridge multiple computational grids and clouds, acting as overlay cyber infrastructure. Gateways have three logical tiers: a user interfacing tier, a resource tier and a bridging middleware tier. Different groups may operate these tiers. This introduces three security challenges. First, the gateway middleware must manage multiple types of credentials associated with different resource providers. Second, the separation of the user interface and middleware layers means that security credentials must be securely delegated from the user interface to the middleware. Third, the same middleware may serve multiple gateways, so the middleware must correctly isolate user credentials associated with different gateways. We examine each of these three scenarios, concentrating on the requirements and implementation of the middleware layer. We propose and investigate the use of a Credential Store to solve the three security challenges.

SUMMARY CILogon provides a federated X.509 certification authority for secure access to cyberinfrastructure such as the Extreme Science and Engineering Discovery Environment. CILogon relies on federated authentication (Security Assertion Markup Language (OASIS, Burlington, MA (USA)) and OpenID) for determining user identities when issuing certificates. Federated authentication enables users to obtain certificates using existing identities (university, Google, etc.). Federated authentication also enables CILogon to serve a national‐scale user community without requiring a large network of registration authorities performing manual user identification. CILogon supports multiple levels of assurance and custom interfaces for specific user communities. In this article, we introduce the CILogon service and describe experiences and lessons learned from the first 3 years of operation. © 2014 The Authors. Concurrency and Computation: Practice and Experience published by John Wiley & Sons Ltd.

A science gateway is a web portal that provides a convenient interface to data and applications in support of a research community. Standard security concerns apply to science gateways, including confidentiality of pre-publication research data, integrity of research results, and availability of services provided to researchers. In this paper we identify existing science gateway security recommendations and provide our own perspective.

Delegation is a key facility in dynamic, distributed and collaborative environments like Grids and enables an effective use of a wide range of dynamic applications. Traditional delegation frameworks approach a top-down model of delegation for delegating rights from a superior to a subordinate in advance before a delegate starts off a delegated task. However, a top-down model of delegation cannot meet all the requirements of dynamic execution of distributed applications, as in such environments, required access rights for completing a task cannot easily be anticipated in advance. Delegating fewer rights than required for completing a task may cause the task execution to fail while delegating more rights than needed may threaten abuse by malicious parties. It is therefore reasonable and more robust to utilize a mechanism that allows determining and acquiring only required rights and credentials for completing a task, when they are needed. This is what we call an on-demand delegation framework, which realizes a bottom-up delegation model and provides a just-in-time acquisition of rights for a restricted and dynamic delegation. In this paper we elaborate the concept of bottom-up delegation and describe how an on-demand delegation framework can leverage workflows to meet the requirements of the least privileges principle. We also discuss the vital need for dynamic and adaptive scientific workflows to support an on demand delegation framework.We present three different models of bottom-up delegation, which cover a wide range of usage scenarios in Grids and dynamic collaborative environments. Using a standard RBAC authorization model and a graph-based workflow model (DAG), we define and analyze a formal model of our proposed bottom-up delegation approach.

Federating security and trust is one of the most significant architectural requirements in grids. In this regard, one challenging issue is the cross-organizational authentication and identification. Organizations participated in Virtual Organizations (VOs) may use different security infrastructures that implement different authentication and identification protocols. Thus, arises an architectural need to provide a mechanism for a lightweight, rapid and interoperable translation of security credentials from an original format to a format understandable by recipients. In this paper, we describe the development and the implementation of an architecture for credential mapping in grids using off-the-shelf technologies and standard specifications. Our open-source implementation of this architecture provides support for an on-the-fly exchange for different types of security credentials used by diverse grid security infrastructures.

Problem solving environments (PSEs) are increasingly important for scientific discovery. Today's most challenging problems often require multi-disciplinary teams, the ability to analyze very large amounts of data, and the need to rely on infrastructure built by others rather than reinventing solutions for each science team. The TeraGrid Science Gateways program recognizes these challenges and works with science teams to harness high-end resources that significantly extend a PSE's functionality.

In recent years, trust negotiation has been proposed as a novel authorization solution for use in open-system environments, in which resources are shared across organizational boundaries. Researchers have shown that trust negotiation is indeed a viable solution for these environments by developing a number of policy languages and strategies for trust negotiation that have desirable theoretical properties. Further, existing protocols, such as TLS, have been altered to interact with prototype trust negotiation systems, thereby illustrating the utility of trust negotiation. Unfortunately, modifying existing protocols is often a time-consuming and bureaucratic process that can hinder the adoption of this promising technology. In this paper, we present Traust, a third-party authorization service that leverages the strengths of existing prototype trust negotiation systems. Traust acts as an authorization broker that issues access tokens for resources in an open system after entities use trust negotiation to satisfy the appropriate resource access policies. The Traust architecture was designed to allow Traust to be integrated either directly with newer trust-aware applications or indirectly with existing legacy applications; this flexibility paves the way for the incremental adoption of trust negotiation technologies without requiring widespread software or protocol upgrades. We discuss the design and implementation of Traust, the communication protocol used by the Traust system, and its performance. We also discuss our experiences using Traust to broker access to legacy resources, our proposal for a Traust-aware version of the GridFTP protocol, and Traust's resilience to attack.

Grid security solutions address critical requirements and are constructed from building blocks comprising cryptographic algorithms and protocols. Choosing the most appropriate algorithms and protocols requires an ongoing evaluation of performance and security properties, given continuing advances in system performance, optimizations, security analyses, and cryptographic techniques. Today, the Globus Toolkit's grid security infrastructure (GSI) is a leading provider of security solutions based on the RSA cryptosystem. Recently, cryptosystems based on bilinear pairings have been proposed as an alternative with the promise of increased efficiency and scalability. In this work we evaluate this alternative compared to elliptic curve cryptography (ECC) and RSA in terms of their computation and communication overheads for today's grid systems. Our analysis and experiments lead us to conclude that RSA continues to be a good choice for the foreseeable future. Furthermore, our results are intuitively aligned with the high-performance, high-bandwidth, and high-latency nature of grid systems.

Abstract Science gateways have emerged as a concept for allowing large numbers of users in communities to easily access high‐performance computing resources which previously required a steep learning curve to utilize. In order to reduce the complexity of managing access for these communities, which can often be large and dynamic, the concept of community accounts is being considered. This paper proposes a security model for community accounts, organized by the four As of security: Authentication, Authorization, Auditing and Accounting. Copyright © 2006 John Wiley & Sons, Ltd.

Large collaborative infrastructures that span multiple organizations such as those that enable grid computing and scientific experimentation are being deployed and used today. In order to secure these infrastructures a comprehensive requirements study is needed that takes into account the novel risks, threats, and operational issues brought on by the large-scale, distributed nature of these systems. In this paper we argue that gaps in security policies and procedures combined with organizational autonomy are the primary drivers motivating a set of requirements that go beyond those observed today. With three example infrastructures in mind, namely, Teragrid, LHC Grid, and GEM, we explore the novel risks, threats, and operational issues to compose a set of operational security requirements; the satisfaction of which are essential for securing such large collaborative infrastructures

In recent years, trust negotiation (TN) has been proposed as a novel access control solution for use in open system environments in which resources are shared across organizational boundaries. Researchers have shown that TN is indeed a viable solution for these environments by developing a number of policy languages and strategies for TN which have desirable theoretical properties. Further, existing protocols, such as TLS, have been altered to interact with prototype TN systems, thereby illustrating the utility of TN. Unfortunately, modifying existing protocols is often a time-consuming and bureaucratic process which can hinder the adoption of this promising technology.In this paper, we present Traust, a third-party authorization service that leverages the strengths of existing proto-type TN systems. Traust acts as an authorization broker that issues access tokens for resources in an open system after entities use TN to satisfy the appropriate resource access policies. The Traust architecture was designed to allow Traust to be integrated either directly with newer trust-aware applications or indirectly with existing legacy applications; this exibility paves the way for the incremental adoption of TN technologies without requiring widespread software or protocol upgrades. We discuss the design and implementation of Traust, the communication protocol used by the Traust system, and its performance. We also discuss our experiences using Traust to broker access to legacy resources, our proposal for a Traust-aware version of the GridFTP protocol, and Traust's resilience to attack.

User authentication is a crucial security component for most computing systems. But since the security needs of different systems vary widely, authentication mechanisms are similarly diverse. In particular, independently-managed Web and grid services vary with regard to the type of security token (credential) used to prove user identity (username/password, X.509 signing, Kerberos, etc.). Forcing users to manage and present credentials manually for each service is tedious, error-prone and potentially insecure. In contrast, we present CredEx, an open-source, standards-based Web service that facilitates the secure storage of credentials and enables the dynamic exchange of different credential types using the WS-Trust token exchange protocol. With CredEx, a user can achieve single sign-on by acquiring a single (default) credential then dynamically exchanging that credential as needed for services that authenticate a different way. We describe the design and implementation of CredEx by focusing on its use in bridging password-based Web services and PKI-based grid services, illustrating how interoperability between these realms can be based upon the WS-Security and WS-Trust specifications.

Abstract The MyProxy online credential repository has been used by the Grid computing community for over four years for managing security credentials in the Grid public key infrastructure. MyProxy improves usability by giving users access to their credentials over the network using password authentication, allowing users to delegate their credentials via Web browser interfaces to the Grid, and supporting credential renewal for long‐running jobs. MyProxy helps administrators secure users' private keys by providing an online service from which users retrieve short‐lived credentials without distributing long‐lived keys to potentially vulnerable end‐systems. This paper describes the MyProxy system and its use. Copyright © 2005 John Wiley & Sons, Ltd.

Abstract As Grid deployments increase, the challenge remains to create a scalable, multi‐organizational authentication infrastructure. Public key infrastructures (PKIs) are widely used for authentication in Grids, due in large part to the success of the Globus toolkit, despite the challenges and difficulties both for PKI administrators and users. The Bridge Certificate Authority (CA) is a compromise between a strictly hierarchical PKI and a mesh PKI and achieves many of the benefits of the hierarchical PKI and mesh PKI but has been untested for use with Grid software. This paper reports on the use of a Bridge CA with two representative Grid software packages: the Globus Toolkit v2 and WSRF.NET. We find that both packages support Bridge CAs sufficiently today to be usable in Grid software architectures, although not without limitations. In this paper, and through these experiments, we build the case for using Bridge CAs for Grid computing. Copyright © 2005 John Wiley & Sons, Ltd.

Public key infrastructures suffer from usability and security problems associated with the request for and secure management of end user credentials. Online credential repositories provide mechanisms to ease these shortcomings but pose attractive targets for attacks due to the accumulation of credentials and the need for remote access to these credentials. Through the extension of an existing credential repository with a cryptographic coprocessor for secure storage of credentials an increase in the security of the service can be achieved. This higher security permits the use of online credential repositories with a wide variety of certificates without violating certification authority regulations. Also, the improved performance afforded by hardware support improves the scalability of a centralized credential storage.

Access to remote data is one of the principal challenges of Grid computing. While performing I/O, Grid applications must be prepared for server crashes, performance variations and exhausted resources. To achieve high throughput in such a hostile environment, applications need a resilient service that moves data while hiding errors and latencies. We illustrate this idea with Kangaroo, a simple data movement system that makes opportunistic use of disks and networks to keep applications running. We demonstrate that Kangaroo can achieve better end-to-end performance than traditional data movement techniques, even though its individual components do not achieve high performance.

Data-intensive applications in the Condor high-throughput computing (HTC) environment can place heavy demands on network resources for checkpointing and remote data access. We have developed mechanisms to monitor, control and schedule network usage in Condor. By managing network resources, these mechanisms provide administrative control over Condor's network usage and improve the execution efficiency of Condor applications.