Numerous Grid workflow engines exist, each generally specialized for a single application domain such as protein folding. Although the underlying purpose and functionality of the Grid workflow engines are similar, and they make use of a common set of Grid protocols, the implementations vary vastly, making interoperation among them nearly impossible. On the other hand, the concept of workflows of Web services is very popular in the enterprise domain and many engines exist for business workflows. These mostly revolve around the Business Process Execution Language (BPEL), an emerging standard for Web services workflow description. We study three different business workflow engines - Microsoft's BizTalk Server, Microsoft's Windows Workflow Foundation and Oracle's Business Process Manager and analyze how each of these engines can be adapted to e-science and the Grid environment. We have implemented widely-used grid workflows on each of these engines and show quantitatively and qualitatively that each business engine has positive and negative aspects for large-scale e-science.

Grid portals are an increasingly popular mechanism for creating customizable, Web-based interfaces to Grid services and resources. Due to the powerful, general-purpose nature of Grid technology, the security of any portal or entry point to such resources cannot be taken lightly. This is particularly true if the portal is running inside of a trusted perimeter, such as a Science Gateway running on an SDSC machine for access to the TeraGrid. To evaluate the current state of Grid portal security, we undertake a comparative analysis of the three most popular Grid portal frameworks that are being pursued as frontends to the TeraGrid: GridSphere, OGCE and Clarens. We explore general challenges that Grid portals face in the areas of authentication (including user identification), authorization, auditing (logging) and session management then contrast how the different Grid portal implementations address these challenges. We find that although most Grid portals address these security concerns to a certain extent, there is still room for improvement, particularly in the areas of secure default configurations and comprehensive logging and auditing support. We conclude with specific recommendations for designing, implementing and configuring secure Grid portals.

User authentication is a crucial security component for most computing systems. But since the security needs of different systems vary widely, authentication mechanisms are similarly diverse. In particular, independently-managed Web and grid services vary with regard to the type of security token (credential) used to prove user identity (username/password, X.509 signing, Kerberos, etc.). Forcing users to manage and present credentials manually for each service is tedious, error-prone and potentially insecure. In contrast, we present CredEx, an open-source, standards-based Web service that facilitates the secure storage of credentials and enables the dynamic exchange of different credential types using the WS-Trust token exchange protocol. With CredEx, a user can achieve single sign-on by acquiring a single (default) credential then dynamically exchanging that credential as needed for services that authenticate a different way. We describe the design and implementation of CredEx by focusing on its use in bridging password-based Web services and PKI-based grid services, illustrating how interoperability between these realms can be based upon the WS-Security and WS-Trust specifications.

Users of Web and grid services often must temporarily delegate some or all of their rights to a software entity to perform actions on their behalf. The problem with the typical grid services approach (X. 509 proxy certificates) is that commercial Web services tooling fails to recognize these certificates or process them properly. The security assertion markup language (SAML) is a standardized XML-based framework for exchanging authentication, authorization and attribute information. SAML has broadening commercial support but lacks delegation capabilities. To address this shortcoming, we exploit SAML's inherent extensibility to create a delegation framework for Web and grid services that supports both direct and indirect delegation. We develop a set of verification rules for delegation tokens that rely on WS-Security X.509 signatures, but do not force any trust relationship between the delegatee and the target service. We have implemented the framework on two common Web service hosting environments: Java/Tomcat and .NET. By leveraging existing Web services standards, we make it easier for Grid practitioners to build and consume Web and grid services without resorting to grid-specific protocols.

Promising the combination of dynamic configuration, scalability and redundancy, peer-to-peer (P2P) networks have garnered tremendous interest lately. Before long, this interest extended to P2P sharing of disparate databases. While many have explored the data placement and coordination difficulties involved in such systems, far fewer have examined the unique challenges involved in updating P2P-distributed data items. In addressing that problem, we present an adapted version of the traditional quorum-consensus approach that is better suited to the P2P domain. Further, we explore the many tradeoffs introduced by this flexible update scheme, especially in the areas of data freshness, data availability, access latency and redundancy. Our simulation results demonstrate that if the data replication or quorum levels are sufficiently high it is possible to achieve a near-zero probability of stale data access. However, since more nodes are involved in quorum-building, the cost of high data confidence is slower access times. Keeping with the flexibility theme, our philosophy is to leave control in the hands of individual peers, letting them choose parameters and tradeoff performance to meet their unique needs.

The Open Grid Services Architecture (OGSA) has been a major step forward for Grid Computing, but its de facto reliance on the Web Services Resource Framework (WSRF) and WS-Notification have left some in the community questioning if the Grid software and protocols have become too complex. In this paper, we consider the feasibility of an "alternative" software stack, based on WS-Transfer and WS-Eventing. We compare and evaluate WSRF/WS-Notification vs. WS-Transfer/WSEventing, first via a "hello world" service and then via a more complete Grid scenario for remote execution called "Grid-in-a-Box". By qualitatively and quantitatively evaluating each approach, we find that while subtle differences exist (e.g., the naming of resources, the creation of resources), the stacks are overwhelmingly equivalent in their functionality and implied performance. Overall, this paper uniquely shows that there could be alternative software stacks for OGSA-based Grids.