Fine-grain access control for securing shared resources in computational grids
- 1 January 2002
- conference paper
- Published by Institute of Electrical and Electronics Engineers (IEEE)
Abstract
Computational grids provide computing power by sharing resources across administrative domains. This sharing, coupled with the need to execute untrusted code from arbitrary users, introduces security hazards. This paper addresses the security implications of making a computing resource available to untrusted applications via computational grids. It highlights the problems and limitations of current grid environments and proposes a technique that employs run-time monitoring and a restricted shell. The technique can be used for setting up an execution environment that supports the full legitimate use allowed by the security policy of a shared resource. Performance analysis shows up to 2.14 times execution overhead improvement for shell-based applications. The approach proves effective and provides a substrate for hybrid techniques that combine static and dynamic mechanisms to minimize monitoring overheads.Keywords
This publication has 12 references indexed in Scilit:
- Enhancing the scalability and usability of computational grids via logical user accounts and virtual file systemsPublished by Institute of Electrical and Electronics Engineers (IEEE) ,2005
- Condor-a hunter of idle workstationsPublished by Institute of Electrical and Electronics Engineers (IEEE) ,2003
- A sense of self for Unix processesPublished by Institute of Electrical and Electronics Engineers (IEEE) ,2002
- Execution monitoring of security-critical programs in distributed systems: a specification-based approachPublished by Institute of Electrical and Electronics Engineers (IEEE) ,2002
- Intrusion detection via static analysisPublished by Institute of Electrical and Electronics Engineers (IEEE) ,2002
- Punch: web portal for running toolsIEEE Micro, 2000
- Globus: a Metacomputing Infrastructure ToolkitThe International Journal of Supercomputer Applications and High Performance Computing, 1997
- Safe kernel extensions without run-time checkingPublished by Association for Computing Machinery (ACM) ,1996
- Efficient software-based fault isolationPublished by Association for Computing Machinery (ACM) ,1993
- Interposition agentsPublished by Association for Computing Machinery (ACM) ,1993