Globus Security Infrastructure

Globus Security Infrastructure
Name	Globus Security Infrastructure
Developer	Globus Alliance
Released	1998
Programming language	C (programming language), Python (programming language)
Operating system	Unix-like
Platform	Grid computing
Genre	Middleware (computer science)
License	BSD license

Globus Security Infrastructure is a middleware security framework designed to provide authentication, authorization, and delegation services for large-scale distributed computing environments such as Grid computing, High Performance Computing, and scientific e‑Science projects. Originating within the Globus Alliance, it has been integrated into research infrastructures involving institutions like National Science Foundation, Lawrence Berkeley National Laboratory, Argonne National Laboratory, and international collaborations such as European Grid Infrastructure. The system emphasizes interoperable credential management and protocol support to enable secure resource sharing across organizational boundaries like Lawrence Livermore National Laboratory and Oak Ridge National Laboratory.

Overview

The project emerged to address cross-domain security challenges faced by projects including TeraGrid, EGEE, LIGO Scientific Collaboration, and Large Hadron Collider experiments at CERN. It provides a suite of services and libraries that interact with standards from Internet Engineering Task Force working groups, leverage public key infrastructure approaches exemplified by initiatives such as X.509 and integrate with identity federation efforts like Shibboleth. The design goal was to support single sign-on and delegation for workflows spanning research centers such as Fermilab and SLAC National Accelerator Laboratory.

Architecture and Components

The architecture comprises a set of modular services and client libraries that interface with resource managers and data transfer tools including GridFTP and Globus Toolkit components. Core elements include an authentication service, an authorization framework, a credential management subsystem, and plugins for gateways used by projects like Open Science Grid and PRACE. Interoperability is achieved via standards adopted by organizations such as OASIS and specifications from IETF. The infrastructure integrates with directory services like LDAP deployments at institutions such as University of Chicago and trust anchors managed by national CA efforts like DOE (United States Department of Energy) repositories.

Authentication and Authorization Mechanisms

Authentication relies on public key certificates following X.509 conventions and supports username mapping strategies employed by resource providers including university clusters at Stanford University and Massachusetts Institute of Technology. Authorization is handled through policy assertions and community authorization services analogous to models used by Virtual Organization Membership Service and policy frameworks seen in Globus Toolkit deployments. Delegation primitives permit applications from collaborations such as Human Genome Project and Square Kilometre Array to act on behalf of users when interacting with services hosted at facilities like European Organisation for Nuclear Research.

Certificate and Credential Management

Certificate issuance workflows align with practices from certification authorities in projects like IGTF and national initiatives such as UK e-Science CA schemes. Credential management supports short‑lived proxy certificates, mechanisms for renewal, and revocation concepts paralleling those in X.509 Public Key Infrastructure and certificate repositories used by NASA science gateways. Tools for managing keys and proxies have been used by science gateways at University of California, Berkeley and data portals for collaborations including Earth System Grid Federation.

Security Features and Protocols

Security features include mutual authentication, single sign-on facilities, delegation via proxy certificates, and integration with secure transport protocols specified by IETF such as Transport Layer Security. Interoperability with data movement protocols like GridFTP ensures authenticated, authorized transfers for experiments at Brookhaven National Laboratory and archives used by NOAA. The infrastructure also interfaces with token and assertion mechanisms from federated identity projects like SAML-based systems and adaptations used in initiatives such as Internet2.

Deployment and Use Cases

Deployments have occurred across national and international research infrastructures: examples include production grids like TeraGrid, compute fabric in Open Science Grid, data grids for LHC Grid activities, and domain-specific gateways for projects like NEES and iPlant (now CyVerse). Use cases span secure job submission to clusters at National Center for Supercomputing Applications, authenticated data replication for IPCC model archives, and federated access for multi‑institution collaborations such as GENI prototypes. Integrations with resource schedulers at national labs and campuses enabled cross‑site workflows in climate modeling, astrophysics, and bioinformatics consortia including Sanger Institute collaborations.

Limitations and Challenges

Adoption faced challenges due to the complexity of managing X.509 certificates across diverse user communities, user experience limitations documented by campus IT groups at University of Michigan, and interoperability hurdles with newer identity paradigms such as OAuth and OpenID Connect used by commercial providers like Google and Microsoft. Scalability of trust management in nationwide infrastructures and the operational overhead for certificate authorities used by entities like DOE and NSF projects posed administrative burdens. Migration toward federated identity models and integration with contemporary orchestration systems at facilities such as NERSC remain ongoing technical and policy efforts.

Category:Computer security