Trustworthy Distributed Computing CROWN Project Prof Jinpeng Huai

Trustworthy Distributed Computing: CROWN Project Prof. Jinpeng Huai, Beihang University crown@act. buaa. edu. cn http: // www. crown. org. cn http: //www. crown. org. cn

Agenda • Research Programs • CROWN Project CROWN：基于广域网络的科研环境 http: //www. crown. org. cn

Research Programs • CROWN: China Research and Development Environment Over Wide-area Network – 2004 – 2006, National Science Foundation of China (NSFC) • Goal: Providing Grid-enabled research environment for scientists • • Resource Sharing Collaborating Trustworthy Distributed Computing Grid Infrastructure Research & Construction CROWN：基于广域网络的科研环境 http: //www. crown. org. cn

CROWN • Top five universities and research institutes, other pilot applications • Many valuable research resources CROWN：基于广域网络的科研环境 http: //www. crown. org. cn

Outline • Research Programs • CROWN Project CROWN：基于广域网络的科研环境 http: //www. crown. org. cn

CROWN Project – CROWN resource organization – CROWN middleware – CROWN Security – Pilot applications – International collaboration CROWN：基于广域网络的科研环境 http: //www. crown. org. cn

1. CROWN Resource Organization • Tree-like Resource Organization & Management Gateway to EU Data. Grid Region Switch Other Regions Gateway to Other Testbed Domain RLDS Node Services Domain RLDS Node Device http: //www. crown. org. cn CROWN：基于广域网络的科研环境 Device Driver Service

2. CROWN Middleware Architecture CROWN：基于广域网络的科研环境 http: //www. crown. org. cn

2. CROWN Middleware • CROWN Node Server – WSRF-compliant grid service container – Base services: resource monitoring and service deployment – Key features • Hot/Remote/Secure service deployment • Dynamic resource information collecting CROWN：基于广域网络的科研环境 http: //www. crown. org. cn

Overlay for Grid Computing • ROST: Remote & Hot Service Deployment with Trustworthiness in CROWN – the remote & hot deployment by dynamically updating the runtime environment configuration and therefore avoiding restarting the runtime system. – In addition, we add trust negotiation for remote service deployment, which greatly increases flexibility and security of CROWN：基于广域网络的科研环境 http: //www. crown. org. cn

2. CROWN Middleware • CROWN RLDS – Resource Locating and Description Service • GIMS: Grid Information Model Service • Resource Information publish & finding • Dynamic topology management • Advanced GIQL Query CROWN：基于广域网络的科研环境 http: //www. crown. org. cn

Overlay for Grid Computing • Efficient Information Service Management Using Service Club in CROWN – existing information service architectures suffers from poor scalability, long search response time, and huge traffic overhead. Handle resource discovery and management process – In S-Club, an overlay based on existing GIS mesh network of CROWN is built, so that GISs are organized as service clubs. Each club serves for a certain type of service while each GIS may join one or more clubs. Performance of S-Club is evaluated by comprehensive simulations. We further deploy SClub in our CROWN Grid environment. CROWN：基于广域网络的科研环境 http: //www. crown. org. cn

2. CROWN Middleware • CROWN Designer – WSRF-compliant service/pure web service development environment – Resource view – Drag & drop service deployment – Eclipse plug-in based CROWN：基于广域网络的科研环境 http: //www. crown. org. cn

2. CROWN Middleware • CROWN Portal – Grid Application Consuming Environment CROWN：基于广域网络的科研环境 http: //www. crown. org. cn

3. CROWN Security • Security Challenges for CROWN – CROWN is widely distributed – span the whole country. – The underlying platforms are heterogeneous – both hardware and OS. – The environment is dynamic - always changing: users, computers, instruments join and leave freely. CROWN：基于广域网络的科研环境 http: //www. crown. org. cn

3. CROWN Security • CROWN. ST: Secure and Trustworthy – Providing full-fledged security functionalities for grid applications – Fulfilling the requirements for trustworthiness, configurability, extensibility, fine-grained control. – Complying with the documents brought out by GGF. CROWN：基于广域网络的科研环境 http: //www. crown. org. cn

CROWN. ST Architecture CROWN：基于广域网络的科研环境 http: //www. crown. org. cn

Security Processing Chain in Each Node CROWN：基于广域网络的科研环境 http: //www. crown. org. cn

ST-CROWN: Key Components (1) • Authentication Handler and Service – Deployment: • peer node • peer domain – Functionality: • authenticating grid users or services by verifying signatures • building or verifying the certificate chains – Standards: PKIX, WS-Security, WS-Policy, SAML CROWN：基于广域网络的科研环境 http: //www. crown. org. cn

CROWN. ST: Key Components (1) CROWN：基于广域网络的科研环境 http: //www. crown. org. cn

CROWN. ST Key Components (2) • Authorization handler and service – Deployment • peer node • peer domain – Functionality • makeing access control decisions according to specified policies – Standards: XACML, SAML CROWN：基于广域网络的科研环境 http: //www. crown. org. cn

CROWN. ST Key Components (2) CROWN：基于广域网络的科研环境 http: //www. crown. org. cn

CROWN. ST Key Components (3) • Automatic Trust Negotiation (ATN) Handler and Service – Deployment • peer node – Functionality • Building trust relationship between the requester and service on the fly by gradually disclosing credentials according to both parties’ privacy policy CROWN：基于广域网络的科研环境 http: //www. crown. org. cn

CROWN. ST Key Components (3) Negotiation procedure between TNAs Structure of TNA CROWN：基于广域网络的科研环境 http: //www. crown. org. cn

CROWN. ST Key Components (4) • Identity Mapping and Credential Conversion Service – Deployment • at the edge of regions – Functionality • mapping identity between heterogeneous identity management infrastructure, such as PKI and Kerberos. – Standards: SAML CROWN：基于广域网络的科研环境 http: //www. crown. org. cn

Trustworthy Computing in P 2 P and Grid • Distributed Access Control in CROWN Groups • Access Control Policy Negotiation for Remote Hot-deployed Grid Service • Tru. Grid: A Self-Sustaining Trustworthy Grid CROWN：基于广域网络的科研环境 http: //www. crown. org. cn

Distributed Access Control in CROWN • Security in collaborative groups is an active research topic and has been recognized by many organizations in the past few years. • we propose a fine-grained and attribute-based access control framework for our key project, CROWN grid. To avoid single point of failure and enhance scalability of the system, we employ a distributed delegation authorization mechanism. We successfully implement our proposed access control in CROWN：基于广域网络的科研环境 http: //www. crown. org. cn

4. Pilot Applications • Bioinformatics: blast, cap 3, genscan… • Atmospheric applications – Climate simulation for past 1000 years – AREM • Regional Eta-coordinate numerical prediction model • Rain or storm predication CROWN：基于广域网络的科研环境 http: //www. crown. org. cn

CROWN：基于广域网络的科研环境 http: //www. crown. org. cn

Pilot Applications • SDG: Scientific Data Grid – Share scientific data from all institutes of CAS with China or even world scientists • UDMGrid: University Digital Museum Grid – Provide an integrated UDM data sharing environment using grid technologies – Currently 4 UDMs are integrated • Beihang university • Yunnan University • Nanjing University • Shandong University CROWN：基于广域网络的科研环境 http: //www. crown. org. cn

International Collaborations • UK: e-Science, 4 Universities – OMII – Testing from ETF since May 23, 2005 • France: Object. Web, INRIA • Germany: Fh. G, JSI (Sino-German Joint Software Institute) • Hong Kong University of Science and Technology • Others, such as GT CROWN：基于广域网络的科研环境 http: //www. crown. org. cn

Our Next step • CROWN 2. 0 and its applications • Extensive R&D Cooperation in key tech, such as Network-centric OS, application developing model, security and trust, and killer apps. • Build Int. Testingbed & its links to the world, promote Grid’s Tech and Apps – collaborate with other countries from EU, – through standardization actively join the international standardization CROWN：基于广域网络的科研环境 http: //www. crown. org. cn

Thank You! Q&A crown@act. buaa. edu. cn CROWN：基于广域网络的科研环境 http: //www. crown. org. cn

CROWN：基于广域网络的科研环境 http: //www. crown. org. cn