As distributed, on-line communities are increasingly supported by the global, interconnected computing infrastructure, methods must be developed to securely manage their interactions. The virtual organization (VO) concept provides a security and discovery context whereby collaboration across multiple administrative domains can be enabled while enforcing joint security policies. In the era of cloud computing, VOs can be used to manage "community clouds", i.e., Cloud federations. In this paper, we describe a method for re-purposing the Open Stack Keystone service to act as a VO Management System (VOMS) called Key VOMS. With minor changes, it can be used to manage access to services that are registered for use by members of any given VO. These services can be arbitrary infrastructure-level or application-level services. This is illustrated by using Key VOMS to manage access to a set of RSS feed topics. While very flexible, the use of an external, third-party, such as Key VOMS, raises fundamental semantic interoperability and trust delegation issues that must be addressed in future work.

This paper presents on-going research to define the basic models and architecture patterns for federated access control in heterogeneous (multi-provider) multi-cloud and inter-cloud environment. The proposed research contributes to the further definition of Intercloud Federation Framework (ICFF) which is a part of the general Intercloud Architecture Framework (ICAF) proposed by authors in earlier works. ICFF attempts to address the interoperability and integration issues in provisioning on-demand multi-provider multi-domain heterogeneous cloud infrastructure services. The paper describes the major inter-cloud federation scenarios that in general involve two types of federations: customer-side federation that includes federation between cloud based services and customer campus or enterprise infrastructure, and provider-side federation that is created by a group of cloud providers to outsource or broker their resources when provisioning services to customers. The proposed federated access control model uses Federated Identity Management (FIDM) model that can be also supported by the trusted third party entities such as Cloud Service Broker (CSB) and/or trust broker to establish dynamic trust relations between entities without previously existing trust. The research analyses different federated identity management scenarios, defines the basic architecture patterns and the main components of the distributed federated multi-domain Authentication and Authorisation infrastructure.

This paper describes approaches for supporting virtual organizations (VOs) in OpenStack. A VO provides a security and discovery context whereby collaboration across multiple sites can be enabled while enforcing joint security policies. VOs were developed in the grid computing arena to manage international scientific collaborations. However, the VO abstraction is not grid-specific and is applicable in any distributed computing environment, including inter-clouds. To address the need to securely manage on-demand data sharing in disaster response efforts, we prototyped VO support in OpenStack. To evaluate our practical implementation approach, and other related work, we systematically define the VO design space. This also allows us to clearly identify outstanding issues and recommendations for future work to realize effective cloud federations.

OpenStack is an open source cloud computing project that is enjoying wide. While many cloud deployments may be stand-alone, it is clear that secure federated community clouds, i.e., inter-clouds, are needed. Hence, there must be methods for federated identity management (FIM) that enable authentication and authorisation to be flexibly enforced across federated environments. Since there are many different FIM protocols either in use or in development today, this paper addresses the goal of adding protocol independent federated identity management to the OpenStack services. After giving a motivating example for secure cloud federation, and describing the conceptual design for protocol independent federated access, a detailed federated identity protocol sequence is presented. The paper then describes the implementation of the protocol independent system components, along with the incorporation of two different FIM protocols, namely SAML and Keystone proprietary. Finally performance measurements of the protocol independent components, and the two different protocols dependent components are presented, before the paper concludes with the current limitations.

Cloud computing has the potential for tremendous benefits, but wide scale adoption has a range of challenges that must be met. We review these challenges and how they relate to scientific computing. To achieve the portability, interoperability, and economies of scale that clouds offer, it is clear that common design principles must be widely adopted in both the user community and marketplace. To this end, we argue that a private-to-public cloud deployment trajectory will be very common, if not dominant. This trajectory can be used to define a progression of needed common practices and standards which, in turn, can be used to define deployment, development and fundamental research agendas. We then survey the cloud standards landscape and how the standards process could be driven by major stakeholders, e.g., large user groups, vendors, and governments, to achieve scientific and national objectives. We conclude with a call to action for stakeholders to actively engage in driving this process to a successful conclusion.

The advent of affordable high performance computing (HPC) resources, such as computing clusters and grids, has transformed the computational capabilities of many organizations. However, the lack of convenient interfaces to such valuable resources limits their effectiveness, restricting their user base to a small set of highly skilled programmers and computer scientists. Without such an interface, domain specialists lacking exceptional knowledge of HPC systems are challenged in their ability to utilize these computing grids. This paper describes the design and implementation of a Web-based user interface aimed at increasing the usability and transparency of a 341-node computing cluster to multiple applications and user communities, by developing a streamlined Web interface. In discussion of the design, we address several common concerns including security, extensibility, and maintainability. We also outline two distinct solutions to this problem: our earliest approach using open-source grid computing tools such as the Globus Toolkit and Gridportlets, and our most current implementation, which uses a prototype Python-based Web application developed as a part of this paper. We then assess our experience with both approaches and conceptually evaluate them based on the common concerns mentioned above. Finally, we argue that, despite the flexibility afforded by the industrial-strength grid tools, a simpler, home-grown approach similar to our Python-based prototype is most effective in terms of time and maintainability for enterprises seeking to develop similar Web-based front ends for their computing resources. We conclude that our approach provides better value to a set of users as it increases in both number and diversity.

System management aspects are described for the process of grid-enabling a vibroacoustic analysis application using the Globus Toolkit 3.2.1. This is the first step in a project intended to grid-enable a suite of tools being developed as a service-oriented enterprise architecture for spacecraft telemetry analysis. Many of the applications in the suite are compute intensive and would benefit from significantly improved performance. In this paper we show the advantage of using Globus to grid-enable a single tool in a vibroacoustic analysis flow, with the result that using as few as eleven nodes, that tool's runtime improved by a factor of eight. While communication overhead does affect performance, these results also indicate that coordinated communication and execution scheduling as part of workflow management would be able to significantly improve overall efficiency. In the larger context, our experience also shows that the service-oriented architecture approach, using grid computing tools, can provide a more flexible system design, in addition to improved performance and increased utilization of resources. We also provide some lessons learned in using the Globus Toolkit

This paper investigates the use of advanced communication services in grid environments. Such services can include augmented communication semantics (e.g., filtering), collective operations, content-based and policy-based routing, and managing communication scope to manage feasibility. These services could be implemented and deployed in a variety of ways, such as a traditional network of servers, or as a middleware forwarding and routing layer, or even in an active network. In any of these approaches, topology-awareness can play a major role in their performance and scalability. As a case study, we demonstrate here a communication service to support time management in distributed simulations that is managed using a grid computing toolkit. We also present emulation and simulation results to demonstrate the scalability that topology-awareness enables for services such as time management. Since the design space for communication services offers so many possibilities and alternatives, we argue for the definition of proper high-level models and APIs such that the underlying implementations and scope of deployment can be developed and improved with minimal impact on applications.

In grid computing environments, network bandwidth discovery and allocation is a serious issue.Before their applications are running, grid users will need to choose hosts based on available bandwidth.Running applications may need to adapt to a changing set of hosts.Hence, a tool is needed for monitoring network performance that is integral to the grid environment.To address this need, Gloperf was developed as part of the Globus grid computing toolkit.Gloperf is designed for ease of deployment and makes simple, end-to-end TCP measurements requiring no special host permissions.Scalability is addressed by a hierarchy of measurements based on group membership and by limiting overhead to a small, acceptable, fixed percentage of the available bandwidth.Since this fixed overhead may push host-pair revisit time into the tens-of-hours, we also quantitatively examine the "trajectory" of the cost-error trade-off for measurement frequency.

The potential for faults in distributed computing systems is a significant complicating factor for application developers. While a variety of techniques exist for detecting and correcting faults, the implementation of these techniques in a particular context can be difficult. Hence, we propose a fault detection service designed to be incorporated, in a modular fashion, into distributed computing systems, tools, or applications. This service uses well-known techniques based on unreliable fault detectors to detect and report component failure, while allowing the user to tradeoff timeliness of reporting against false positive rates. We describe the architecture of this service, report on experimental results that quantify its cost and accuracy, and describe its use in two applications, monitoring the status of system components of the GUSTO computational grid testbed and as part of the NetSolve network-enabled numerical solver.

The binary predicate execution model (BPEM) is a computational model that combines logic programming, semantic nets, and message-driven computation into a paradigm for the construction of highly parallel knowledge-base systems. Simulation results are presented that demonstrate the ability of BPM to exploit effectively the resources of a loosely coupled computer network consisting of large numbers of independent processing elements. These simulations suggest performance on the order of 10/sup 5/ logical inferences per second for 256 processing elements in an n-cube configuration. A very important feature of the BPEM is that it scales-up linearly under simple OR-parallelism and AND-parallelism. Hence, the BPEM can scale-up to exploit parallelism efficiently in very large semantic networks and knowledge bases.>

There is a direct correspondence between semantic networks and a subset of logic programs, restricted only to binary predicates. The advantage of the latter is that it can describe not only the nodes and arcs comprising a semantic net, but also the data-retrieval operations applied to such nets. The main objective of this paper is to present a data-driven model of computation that permits this subset of logic programs to be executed on a highly parallel computer architecture. We demonstrate how logic programs may be converted into collections of data-flow graphs in which resolution is viewed as a process of finding matches between certain graph templates and portions of the data-flow graphs. This graph fitting process is carried out by messages propagating asynchronously through the data-flow graph; thus computation is entirely data driven, without the need for any centralized control and centralized memory. This permits a potentially large number of independent processing elements to cooperate in solving a given query.