In today's distributed computing environments, like Grids and Clouds, authentication and authorization decisions take place in the middleware or on the compute and storage resources themselves. Thus, in both cases the decision is felled within the local network of the hosting organization. This is due to several drawbacks in common firewalls. For one, most firewalls only utilize the tupel of IP addresses, port numbers and protocol parameters to decide which connection are legitimate and which are not. This offers minimal configurability, which in complex environments like the Grid or the Cloud is not sufficient for optimal fine grained decisions. Also, the inability of application level firewalls to deal with dynamically opened server ports for encrypted connections like they are in use by GridFTP require very lax firewall rules to be set, if the Grid or Cloud is to operate unhindered.

In modern grids, authentication is usually implemented via an X.509 PKI (public key infrastructure). Proxy certificates are employed to facilitate interaction with the grid, especially for purposes of delegation and single sign-on. We propose modifications to the grid security infrastructure that allow reporting of proxy usage information to a database, giving the end user an opportunity to review by whom and for which purpose his credentials were used. By means of a standardized protocol for certificate revocation, they can then revoke affected proxies and stop abuse.

To secure communication in Grids many efforts have been made regarding authentication and authorization. Due to some application requirements it is up to now recommended to open wide port ranges on firewalls. This configuration is commonly accepted as insecure. We present an approach to enhance the security of firewalled Grid components by a new method to dynamically authorize TCP connections on firewalls. The authorization decision relies on the authenticated identity of users or conveyed attribute assertions. Authentication information is transferred within the TCP three-way-handshake. To distinguish the authentication information from application data a new TCP option tcpauthn is introduced. The new method TCP-AuthN leads to a new paradigm in firewall operation as the firewall comes to the final decision to allow or reject/deny a connection after the third segment of the TCP three-way-handshake is verified. The firewall denies/rejects each connection on an individual basis depending on the user's proven identity.

The delegation of user rights is an essential functionality of GSI-based grid environments. This mechanism facilitates proxy certificates that are derived from the users' end- entity certificates and enables grid services to act in the issuing user's name. Currently, the implementation of the GSI forces users to delegate their complete scope of rights. Compromised proxy credentials can thus be used to perform every action users are entitled to. While this is no major issue for traditional Grid communities, it effectively prevents security sensitive communities like medical users from using the Grid. This paper presents a user-based approach to restrict the scope of rights that are delegated by the user. Thus, the risk imposed by compromised proxy credentials is significantly reduced. We define a policy extension for proxy certificates that contains fine-grained authorization policies expressed in XACML. These are used to limit delegated privileges for the access of storage and compute resources. The mechanisms shown in this paper enable users to restrict the delegated rights to the access of specific files on storage resources and to the execution of specific compute jobs. The respective policy enforcement takes place on the gLite IO-Service and the gLite computing element. Compatibility to the existing proxy certificate renewal mechanism is preserved by an extension to the MyProxy service. Finally, we present a GridSphere-based graphical front-end that simplifies the process of policy specification and submission of jobs to the grid.