TY - GEN
T1 - A credential renewal service for long-running jobs
AU - Kouřil, Daniel
AU - Basney, Jim
N1 - Copyright:
Copyright 2009 Elsevier B.V., All rights reserved.
PY - 2005
Y1 - 2005
N2 - Jobs on the Grid require security credentials throughout their run for accessing secure Grid resources, such as GridFTP data repositories. However, delegating long-lived credentials to long-running jobs brings an increased risk that a credential will be compromised and misused. Additionally, it is often difficult to predict the run-time of jobs on the Grid, due to changes in application performance and resource load, making it difficult to set the lifetime of the delegated credential in advance. We have developed a solution to this problem for the EU DataGrid project using the MyProxy online credential repository and have further evolved it during the EGEE project. Users store their long-lived credentials in a dedicated MyProxy server and delegate short-lived credentials to their jobs. When a job's credential nears expiration, the Workload Management System retrieves a new short-lived credential from the MyProxy server on the user's behalf and uses it to refresh the job's credential. The MyProxy server's policy specifies which services may obtain credentials on the user's behalf, and all operations are logged at the MyProxy server, where access to credentials may be restricted if a compromise is detected or suspected. This system has been used for credential renewal in Grids in Europe for over three years. In this paper, we present the system design, describe our experiences, and discuss the security implications of this approach.
AB - Jobs on the Grid require security credentials throughout their run for accessing secure Grid resources, such as GridFTP data repositories. However, delegating long-lived credentials to long-running jobs brings an increased risk that a credential will be compromised and misused. Additionally, it is often difficult to predict the run-time of jobs on the Grid, due to changes in application performance and resource load, making it difficult to set the lifetime of the delegated credential in advance. We have developed a solution to this problem for the EU DataGrid project using the MyProxy online credential repository and have further evolved it during the EGEE project. Users store their long-lived credentials in a dedicated MyProxy server and delegate short-lived credentials to their jobs. When a job's credential nears expiration, the Workload Management System retrieves a new short-lived credential from the MyProxy server on the user's behalf and uses it to refresh the job's credential. The MyProxy server's policy specifies which services may obtain credentials on the user's behalf, and all operations are logged at the MyProxy server, where access to credentials may be restricted if a compromise is detected or suspected. This system has been used for credential renewal in Grids in Europe for over three years. In this paper, we present the system design, describe our experiences, and discuss the security implications of this approach.
UR - http://www.scopus.com/inward/record.url?scp=33749671579&partnerID=8YFLogxK
UR - http://www.scopus.com/inward/citedby.url?scp=33749671579&partnerID=8YFLogxK
U2 - 10.1109/GRID.2005.1542725
DO - 10.1109/GRID.2005.1542725
M3 - Conference contribution
AN - SCOPUS:33749671579
SN - 0780394933
SN - 9780780394933
T3 - Proceedings - IEEE/ACM International Workshop on Grid Computing
SP - 63
EP - 68
BT - Proceedings of the 6th IEEE/ACM International Workshop on Grid Computing
T2 - 6th IEEE/ACM International Workshop on Grid Computing
Y2 - 13 November 2005 through 14 November 2005
ER -