Secure Grid Computing - GridSec Project - University of Southern ...
Secure Grid Computing - GridSec Project - University of Southern ...
Secure Grid Computing - GridSec Project - University of Southern ...
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
NPC-2004 Oct. 18, 2004<br />
Trust Integration over a VPN Ring<br />
Aggregate costs in Single Sign-on<br />
operation over VPN vs. PKI Services<br />
V<br />
V<br />
Site S 2<br />
Site S 1<br />
Site S 4<br />
V<br />
SeGO<br />
Server<br />
VPN<br />
Gateway<br />
Hosts<br />
Site S 3<br />
Physical backbone<br />
VPN tunnel ring<br />
V Trust Vector<br />
Trust vector<br />
propagation<br />
User application<br />
and SeGO server<br />
negotiation<br />
Cooperating gateways working together<br />
to establish VPN tunnels for trust integration<br />
V<br />
Aggregate Service Cost<br />
10<br />
8<br />
6<br />
4<br />
GSI based<br />
VPN based<br />
2<br />
0<br />
10 20 30 40 50 60 70 80 90 100<br />
<strong>Grid</strong> Size<br />
October 18, 2004, Kai Hwang http://<strong>Grid</strong>Sec.usc.edu<br />
7<br />
October 18, 2004, Kai Hwang http://<strong>Grid</strong>Sec.usc.edu<br />
8<br />
Global <strong>Grid</strong>Sec Testing Environment<br />
International Collaborators in USA,<br />
France, China, and Australia<br />
USC NetShield Intrusion Defense System<br />
for Protecting Local Network<br />
<strong>of</strong> <strong>Grid</strong> <strong>Computing</strong> Resources<br />
INRIA,<br />
Sophia<br />
Antipolis,<br />
France<br />
ICT <strong>of</strong> CAS<br />
Beijing,<br />
China<br />
Melbourne<br />
<strong>University</strong>,<br />
Australia<br />
The <strong>Grid</strong>Sec<br />
over Internet<br />
USC Gateway,<br />
Los Angeles<br />
Trojan<br />
Cluster in<br />
IGC Lab.<br />
USC/ISD<br />
Supercluster<br />
USC NetShield Defense<br />
System and Testing<br />
Facilities<br />
Security<br />
Policy<br />
Manager<br />
Security<br />
Database<br />
ISP<br />
The<br />
Internet<br />
Network<br />
Router<br />
The<br />
NetShield<br />
System<br />
Firewall<br />
Datamining for Anomaly<br />
Intrusion Detection (IDS)<br />
Risk<br />
Assessment<br />
System (RAS)<br />
Intrusion<br />
Response<br />
System (IRS)<br />
Victim’s<br />
Internal<br />
Network<br />
October 18, 2004, Kai Hwang http://<strong>Grid</strong>Sec.usc.edu<br />
9<br />
October 18, 2004, Kai Hwang http://<strong>Grid</strong>Sec.usc.edu<br />
10<br />
Security-Driven Heuristics for Trusted Job<br />
Scheduling on Risky <strong>Grid</strong>s<br />
• Min-min heuristics:<br />
‣ For each job, the resource site that gives the earliest completion time is<br />
selected first. The job that has the minimum earliest completion time is<br />
assigned to the selected resource site.<br />
• Sufferage heuristics:<br />
‣ The Sufferage heuristic is based on the idea that better mappings are<br />
generated by assigning a site to a job that would “suffer” most in terms <strong>of</strong><br />
expected completion time<br />
• Three secure and risky scheduling modes:<br />
‣ <strong>Secure</strong> mode – Allocate jobs only to those <strong>Grid</strong> sites with security level<br />
exceeding the job requirement (SD < SL)<br />
‣ Risky mode – Allocate jobs to any available <strong>Grid</strong> sites without checking<br />
the risk level or the job demand<br />
‣ f-risky mode – Allocate jobs to those <strong>Grid</strong> sites taking at most f % risk<br />
Risk scale:<br />
0 f 100%<br />
( ) 0 P fail = P( fail)<br />
f<br />
P( fail )