GRIDipedia – The European Grid Marketplace

Instead of detailed patterns describing every aspect of the licence management architecture we here merely describe the general architecture. The reason is that in this architecture all aspects of licence management related grid middleware are handled in a straightforward manner -- namely by treating licences as a standard grid resource.

The extension correspondingly ranges from an extended job submission over a correspondingly extended authorization of licence usage to a possible adaption of local schedulers, the required extension of the resource management and finally -- described in detail, since this is not a straightforward extension – the secure access to the licence server.  

In passing we note that this proposed architecture affects all middlewares.

There are a number of side-effects: One implication is, that in this scenario security of the access to a licence server is handled at the remote grid site. Accordingly there is a certain level of trust required between grid site (or rather – the licence proxy at the grid site) and the licence server. It is doubtful whether licence owners (e.g companies) are willing to agree to this trust relationship. Access to owned licences at the company licence server therefore very likely requires that the latter is located outside the company firewall, e.g. in a DMZ.

On the other hand: Such a solution then already would allow the modification of the job submission in order to allow a cost-efficient usage of licences.

To top

Motivation

This architecture will enable the grid middlewares to use existing client-server licence schemes.

Applicability

The architecture is applicable to any client-server mechanism with an IP-centric security scheme. We note that this type of architecture provides an interface from a (usually certificate based) authentication to a network layer security and therefore is also suitable for other non-licence scenarios (e.g. remote data access) 

Participants

All grid components which are related to either job submission, authorization, identity management (roles and rights)  local schedulers and resource managers, licence client, licence proxy, licence server and finally – accounting and billing services.

Collaboration

In general, collaboration of all components with respect to licences is handled analogously to other grid resources. The main difference is the extension with respect to licence resources throughout the middleware. After successful authentification and authorization (including licence related issues) this extended resource list is passed through the whole grid middleware execution stack and evaluated at the resource manager. At this step the licence proxy – see below – is dynamically reconfigured on a per-job basis.

Consequences

This architecture allows the traditional network level based security to be applied in a grid context. The architecture therefore not only is useful for the gridification of (network level security based) client-server licence management but also for other forms of data access to external sources. In this context we emphasize that a circuit level gateway by nature cannot be compromised from an unapproved of IP-address.

Related Patterns

To our knowledge management of licences is not supported by any current grid middleware.