AutoPKI: A PKI Resources Discovery System

Pala, Massimiliano; Smith, Sean W.

doi:10.1007/978-3-540-73408-6_11

Cited by 4 publications

(3 citation statements)

References 10 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…We also integrated PRQP into OpenCA's Lib-PKI (M. Pala, 2008b) which will be the core library for OpenCA Next Generation Certification Authority software (M. Pala, 2008c). At present, the developed software is available as a stand-alone application (M. Pala, 2008d). In the future, we plan to integrate a PRQP client and a PRQP server into the Globus Toolkit.…”

Section: Integrating Prqp Into Gsimentioning

confidence: 99%

Interoperable PKI Data Distribution in Computational Grids

Pala

Cholia

Rea

et al. 2009

International Journal of Grid and High Performance Computing

Self Cite

View full text Add to dashboard Cite

One of the most successful working examples of virtual organizations, computational grids need authentication mechanisms that interParticipants in VOs need to share resources, including data storage, computational power and network bandwidth. Because these resources are valuable, access is usually limited, based on the requested resource and the requesting user's identity. In order to enforce these limits, each grid has to provide secure authentication of users and applications.Erroneously granting access to unauthorized or even malicious parties can be dangerous even within a single organization---and is unacceptable in such large VOs.Moreover, the dynamic nature of grid VOs requires the authentication mechanisms to be flexible enough to easily allow administrators to manage trust and quickly re-arrange resourcesharing permissions. Indeed, VOs are usually born from the aggregation of already existing organizations and constitute an umbrella that groups the participating organizations rather than

show abstract

Section: Integrating Prqp Into Gsimentioning

confidence: 99%

Interoperable PKI Data Distribution in Computational Grids

Pala

Cholia

Rea

et al. 2009

International Journal of Grid and High Performance Computing

Self Cite

View full text Add to dashboard Cite

show abstract

“…By using a software implementation on commonly available hardware, a client requires around 12ms to retrieve a signed response from a Resource Query Authority [25]. Moreover, in the Grid environment, the protocol can be executed as little as once per day by the authentication framework, thus making the already small overhead introduced by PRQP negligible.…”

Section: Efficient Prqp Response Cachingmentioning

confidence: 99%

“…The PKI Resource Discovery Protocol The notion of a discovery protocol for PKIs first appeared in in our earlier paper [25], which proposed the PKI Resource Query Protocol (PRQP) 2 to provide pointers to any available PKI resource from a particular CA. The PRQP [24] has been already discussed in the IETF PKIX working group.…”

Section: Allowing For Better Interoperability Between Grid Pkismentioning

confidence: 99%

Extending PKI Interoperability in Computational Grids

Pala

Cholia

Rea

et al. 2008

2008 Eighth IEEE International Symposium on Cluster Computing and the Grid (CCGRID)

Self Cite

View full text Add to dashboard Cite

One of the most successful working examples of virtual organizations, computational grids need authentication mechanisms that inter-operate across domain boundaries. Public Key Infrastructures (PKIs) provide sufficient flexibility to allow resource managers to securely grant access to their systems in such distributed environments. However, as PKIs grow and services are added to enhance both security and usability, users and applications must struggle to discover available resources-particularly when the Certification Authority (CA) is alien to the relying party. This paper 1 presents how to overcome these limitations of the current grid authentication model by integrating the PKI Resource Query Protocol (PRQP) into the Grid Security Infrastructure (GSI). Authentication in Virtual OrganizationsComputational grids provide researchers, institutions and organizations with many thousands of nodes that can be used to solve complex computational problems. To leverage collaborations between entities, users of computational grids are often consolidated under very large Virtual Organizations (VOs). Participants in VOs need to share resources, including data storage, computational power and network bandwidth. Because these resources are valuable, access is usually limited, based on the requested resource and the requesting user's identity. In order to enforce these limits, each grid has to provide secure authentication of users and applications. Erroneously granting access to unauthorized or even malicious parties can be dangerous even within a single organization-and is unacceptable in such large VOs. Moreover, the dynamic nature of grid VOs requires the authentication mechanisms to be flexible enough to easily allow administrators to manage trust and 1 The authors would like to thank the IGTF members for their contribution and inspiring suggestions.

show abstract

A unified and flexible solution for integrating CRL and OCSP into PKI applications

2009

View full text Add to dashboard Cite

Public key certificates (PKCs) are used nowadays in several security protocols and applications, so as to secure data exchange via transport layer security channels, or to protect data at the application level by means of digital signatures. However, many security applications often fail to manage properly the PKCs, in particular when checking their validity status. These failures are partly due to the lack of experience (or training) of the users who configure these applications or protocols, and partly due to the scarce support offered by some common cryptographic libraries to the application developers.This paper describes the design and implementation of a light middleware dealing with certificate validation in a unified way. Our middleware exploits on one side the libraries that have already been defined or implemented for certificate validation, and it constructs a thin layer, which provides flexibility and security features to the upper layer applications. In our current approach, this layer boasts an integrated approach to support various certificate revocation mechanisms, it protects the applications from some common security attacks, and offers several configuration and performance options to the programmers and to the end users. We describe the architecture of this approach as well as its practical implementation in the form of a library based on the famous OpenSSL security library, and that can be easily integrated with other certificate‐aware security applications. Copyright © 2009 John Wiley & Sons, Ltd.

show abstract

AutoPKI: A PKI Resources Discovery System

Cited by 4 publications

References 10 publications

Interoperable PKI Data Distribution in Computational Grids

Interoperable PKI Data Distribution in Computational Grids

Extending PKI Interoperability in Computational Grids

A unified and flexible solution for integrating CRL and OCSP into PKI applications

Contact Info

Product

Resources

About