Using OGRO and certiver to improve OCSP validation for grids

Authors:
Jesus Luna;Manel Medina;Oscar Manso
Affiliations:
Computer Architecture Department, Polytechnic University of Catalonia, Barcelona, Spain;Computer Architecture Department, Polytechnic University of Catalonia, Barcelona, Spain;CertiVeR, Technical Director
Venue:
GPC'06 Proceedings of the First international conference on Advances in Grid and Pervasive Computing
Year:
2006

Citing 3
Cited 3

An Online Credential Repository for the Grid: MyProxy

HPDC '01 Proceedings of the 10th IEEE International Symposium on High Performance Distributed Computing
A Community Authorization Service for Group Collaboration

POLICY '02 Proceedings of the 3rd International Workshop on Policies for Distributed Systems and Networks (POLICY'02)
Towards a unified authentication and authorization infrastructure for grid services: implementing an enhanced OCSP service provider into GT4

EuroPKI'05 Proceedings of the Second European conference on Public Key Infrastructure

On-demand Trust Evaluation

GRID '06 Proceedings of the 7th IEEE/ACM International Conference on Grid Computing
Interoperable grid PKIs among untrusted domains: an architectural proposal

GPC'07 Proceedings of the 2nd international conference on Advances in grid and pervasive computing
The CloudGrid approach: Security analysis and performance evaluation

Future Generation Computer Systems

Quantified Score

Hi-index	0.00

Visualization

Abstract

Authentication and authorization in many distributed systems rely on the use of cryptographic credentials that in most of the cases have a defined lifetime. This feature mandates the use of mechanisms able to determine whether a particular credential can be trusted at a given moment. This process is commonly named validation. Among available validation mechanisms, the Online Certificate Status Protocol (OCSP) stands out due to its ability to carry near real time certificate status information. Despite its importance for security, OCSP faces considerable challenges in the computational Grid (i.e. Proxy Certificate's validation) that are being studied at the Global Grid Forum's CA Operations Work Group (CAOPS-WG). As members of this group, we have implemented an OCSP validation infrastructure for the Globus Toolkit 4, composed of the CertiVeR Validation Service and our Open GRid Ocsp (OGRO) client library, which introduced the Grid Validation Policy. This paper summarizes our experiences on that work and the results obtained up to now. Furthermore we introduce the pre-validation concept, a mechanism analogous to the Authorization Push-Model, capable of improving OCSP validation performance in Grids. This paper also reports the results obtained with OGRO's pre-validation rules for Grid Services as a proof of concept.