Citation Context

...mproves the security of the grid computational services by integrating into the security architecture a component that performs a continuous usage control of these services by monitoring the behavior of the applications executed on behalf of grid users. This component enforces a fine grain security policy that consists in an highly detailed description of the correct behavior of the applications executed on computational service. Only the applications whose behavior is consistent with the security policy are executed on the computational resource. This work extends the approach we depicted in [3] and presents an implementation within the Globus framework. The paper is organized as follows. Section 2 briefly describes the main features of the grid computational services. Section 3 defines the model of resource monitoring we are interested in, and Section 4 describes the security policy and 1 a language for its specification. Section 5 describes the design and some implementation details of our prototype dedicated to the Java Virtual Machine, and its integration within the Globus toolkit. Section 6 draws the conclusions and describes future work. 2. Computational Services A Virtual Orga...

Citation Context

... used toolkit for Grid computing is Globus [2]. In particular, most of the work has been devoted to access control techniques for accessing a service at the coarse grain level, e.g., see [10, 12]. In =-=[1, 7]-=-, we started a fine grained run-time access control framework for Grid services. It was based on a behavioral policy language that describes the correct sequence of actions that the applications are a...

Citation Context

...c distributed dedicated entities to perform the law realization. Our assumption differs in that it uses the ESB as a centralized mechanism that either performs on-the-fly enforcement or delegates it to a trusted entity. We explicitly focus on access and usage control policies, and unlike other approaches, we offer a concrete model and a proof-of-concept implementation. Concerning the policy language, elaborate access control languages (e.g., Ponder [12], EPAL [13], SPL [14]) are unable to express obligations that pertain to usage control. More generic usage control centric languages are POLPA [15] and OSL [16]; while the former does not explicitly address obligations, the latter is not supported by an implementation. Unaware of any implementation of a generic usage control language that supports compensations, we have developed a proof-of-concept policy language fit for the ESB. Compared to theoretic works on access control compensations [17], violation management [18] and obligation assessment [19, 20], we go beyond access control and provide an implementation of compensations on the fly. This means that whenever a violation of some service usage rule is detected, the correction happe...

Citation Context

...s can be smoothly adapted to the case of mobile code. This extension requires analysing bytecode instead of source code when extracting usage policies and when constructing the CFG. Martinelli et al. =-=[2,29,30]-=- model security policies as process algebras. They implement a custom JVM, with an execution monitor that traps system calls and fires them concurrently to the policy. When a trapped system call is no...

Citation Context

...probabilities, etc. Process algebra lays down axioms on processes composition to describe a complex behavior of a system. Formalization of UCON using POLPA. Formal model proposed by Martinelli et al. =-=[60]-=-–[62], [67], [82] is compliant with the original UCON model and convenient to express all 24 basic policy types. It has operational semantics and describes UCON system behavior as a process resulting ...