Jefferson Tan

Bridging organizational network boundaries on the grid

The grid offers significant opportunities for performing wide area distributed computing, allowing multiple organizations to collaborate and build dynamic and flexible virtual organisations. However, existing security firewalls often diminish the level of collaboration that is possible, and current grid middleware often assumes that there are no restrictions on the type of communication that is allowed. Accordingly, a number of collaborations have failed because the member sites have different and conflicting security policies. In this paper we present an architecture that facilitates inter-organization communication using existing grid middleware, without compromising the security policies in place at each of the participating sites. Our solutions are built on a number of standard secure communication protocols such as SSH and SOCKS. We call this architecture Remus, and will demonstrate its effectiveness using the Nimrod/G tools.

Executing Large Parameter Sweep Applications on a Multi-VO Testbed

Applications that span multiple virtual organizations (VOs) are of great interest to the eScience community. However, recent attempts to execute large-scale parameter sweep applications (PSAs) with the Nimrod/G tool have exposed problems in the areas of fault tolerance, data storage and trust management. In response, we have implemented a task-splitting approach, which breaks up large PSAs into a sequence of dependent subtasks, improving fault tolerance; provides a garbage collection technique, which deletes unnecessary data; and employs a trust delegation technique that facilitates flexible third party data transfers across different VOs.

Domain-specific metamodels for heterogeneous information systems

There is considerable interest in developing distributed information systems on top of legacy systems. Over the last two decades, many issues and solutions have been brought forward pertaining to issues of integration, e.g., schema integration, schema mapping. We have developed a schema mapping framework that features domain-specific metamodels, metamodel-driven schema translation, and semi-automated schema mapping driven by the metamodel. First, we exploit metamodels, i.e., models about models, which transcend heterogeneity among different data models. Second, we enhance them with domain semantics to better express metadata, resulting in less ambiguous information schemas. Third, we develop our own methods of schema translation and schema mapping based on the domain-specific metamodel, capable of a significant degree of semi-automation for convenience and adherence to the metamodel. Finally, our metadata management framework uses metadata repositories that facilitate reuse, interoperability and extensibility. This paper describes our implementation and utilization of domain-specific metamodels within the schema mapping framework that we have developed.

High-throughput cardiac science on the Grid

Cardiac electrophysiology is a mature discipline, with the first model of a cardiac cell action potential having been developed in 1962. Current models range from single ion channels, through very complex models of individual cardiac cells, to geometrically and anatomically detailed models of the electrical activity in whole ventricles. A critical issue for model developers is how to choose parameters that allow the model to faithfully reproduce observed physiological effects without over-fitting. In this paper, we discuss the use of a parametric modelling toolkit, called Nimrod, that makes it possible both to explore model behaviour as parameters are changed and also to tune parameters by optimizing model output. Importantly, Nimrod leverages computers on the Grid, accelerating experiments by using available high-performance platforms. We illustrate the use of Nimrod with two case studies, one at the cardiac tissue level and one at the cellular level.

Shibboleth and community authorization services: enabling role-based grid access

Classical authentication and authorization in grid environments can become a user management issue due to the flat nature of credentials based on X.509 certificates. While such credentials are able to identify user affiliations, such systems typically leave out a crucial aspect in user management and resource allocation: privilege levels. Shibboleth-based authentication mechanisms facilitate the secure communication of such user attributes within a trust federation. This paper describes a role-based access control framework that exploits Shibboleth attribute handling and CAS (Community Authorization Services) within a Grid environment. Users are able obtain appropriate access levels to resources outside of their domain on the basis of their native privileges and resource policies. This paper describes our framework and discusses issues of security and manageability.

REMUS: A Rerouting and Multiplexing System for Grid Connectivity Across Firewalls

The Grid provides unique opportunities for high-performance computing through distributed applications that execute over multiple remote resources. Participating institutions can form a virtual organization to maximize the utilization of collective resources as well as to facilitate collaborative projects. However, there are two design aspects in distributed environments like the Grid that can easily clash: security and resource sharing. It may be that resources are secure but are not entirely conducive to resource sharing, or networks are wide open for resource sharing but sacrifice security as a result. We developed REMUS, a rerouting and multiplexing system that provides a compromise through connection rerouting and wrappers. REMUS reroutes connections using proxies, ports and protocols that are already authorized across firewalls, avoiding the need to make new openings through the firewalls. We also encapsulate applications within wrappers, transparently rerouting the connections among Grid applications without modifying their programs. In this paper, we describe REMUS and the tests we conducted across firewalls using two Grid middleware case studies: Globus Toolkit 2.4 and Nimrod/G 3.0.

Meta object approach to database schema integration

Database schema integration is significant not only in building multidatabase systems but also in data warehousing. Meta data, which define schemas, are normally involved in the surrounding issues. And while many of these issues have been addressed in the past, unresolved issues remain. The authors present an approach that not only uses metadata but also uses meta-meta information to make schema integration more possible. Our solution requires a meta object facility that serves not only as a repository but also as a more feasible means of managing meta data. We also advocate the use of such a facility as part of an object oriented middleware environment that provides an open interface standard and several useful services in distributed object management.

A Virtual Connectivity Layer for Grids

Computational grids are now mainstream facilities for e-research worldwide. While enterprise grids exist within organizations, national grids have become common, usually consisting of government as well as academic facilities. Such facilities are not uncommonly lenient with blanket policies to allow inbound and outbound grid traffic. This is far from ideal, from a security perspective, but given the dynamic nature of grid use, it is impractical to keep restrictive firewalls and manually keep up with on-demand firewall reconfiguration. Other solutions are necessary, where security is not sacrificed. Apart from first generation solutions that were mostly not sufficiently generic, standardization work is now ongoing, but exclusively aimed at firewall virtualization. We argue for an architectural solution that encompasses firewall virtualization as well as other methods that can be more appropriate in many environments. This paper describes our notion of the missing layer between grid and fabric, which we refer to as the virtual connectivity layer. We have developed two implementations within this layer and discuss how they fit into a complete and well-defined architectural solution.

Fault-tolerant execution of large parameter sweep applications across multiple VOs with storage constraints

Applications that span multiple virtual organizations (VOs) are of great interest to the e‐science community. However, our recent attempts to execute large‐scale parameter sweep applications (PSAs) for real‐world climate studies with the Nimrod/G tool have exposed problems in the areas of fault tolerance, data storage and trust management. In response, we have implemented a task‐splitting approach that facilitates breaking up large PSAs into a sequence of dependent subtasks, improving fault tolerance; provides a garbage collection technique that deletes unnecessary data; and employs a trust delegation technique that facilitates flexible third party data transfers across different VOs. Copyright

Cost-efficient load distribution using multicasting

Multicasting is a cost-efficient method to send one message to members of a group of hosts with only one transmission. This paper suggests that the multicast address may be used in load balancing or load sharing to carry information about the capability of nodes and what capability migrating tasks require. This can make it unnecessary to gather state information about other nodes, which is required by many load sharing or load balancing algorithms. Simulation experiments are ongoing using coloured Petri nets, and prototyping should eventually be attempted, but results are not yet available. However, since possible benefits can be imagined using single-transmission, multicast messages as against probing for or gathering state information, this paper describes the approach with load sharing and load balancing algorithms and lightly touches on other possible applications. (Note that without adequate data, the paper does not include comparisons with existing solutions).