Grid computing control system

• US 20040139202A1
• Filed: 01/10/2003
• Published: 07/15/2004
• Est. Priority Date: 01/10/2003
• Status: Active Grant

• Current Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: Kumar, Rajendra, Talwar, Vanish, Basu, Sujoy
• Granted Patent: US 7,421,500 B2
• Time in Patent Office: Days
• US Class Current: 709/229
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 67/14 Session management for real-time applications in data packet communications networks H04L65/1066
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

Embodiments of the present invention provide a method for grid computing access control and a system thereof. A command is received from a user. The authorization of the user to execute the command is verified. A system parameter is monitored during execution of the command.

Claims

1. A grid computing access control method comprising:

receiving a command from a user;

verifying an authorization of said user to execute said command; and

monitoring a system parameter during execution of said command.

2. The method according to claim 1, further comprising monitoring a session parameter during execution of said command.

3. The method according to claim 1, further comprising:

receiving a request to execute an application from a user;

verifying said authorization of said user to execute said application; and

monitoring said system parameter during execution of said application.

4. The method according to claim 3, further comprising monitoring a session parameter during execution of said application.

5. The method according to claim 1, further comprising enforcing one or more policies selected from the group comprising a session policy, an application policy, and a user policy.

6. The method according to claim 1, further comprising verifying availability of a system resource prior to allowing said user to execute said application.

7. The method according to claim 1, further comprising authentication of said user.

8. The method according to claim 1, further comprising establishing a session for execution of said application.

9. The method according to claim 8, wherein establishing said session comprises binding a dynamic account to a set of policy files.

10. The method according to claim 9, wherein said set of policy files is configurable according to said user and said session.

11. The method according to claim 1, further comprising terminating said session when a violation of one of the following conditions occurs, said authentication, said authorization, said system parameter, and said session parameter.

12. A grid computing control system comprising:

a grid interactive shell, for receiving a command for execution on a computing resource, wherein said grid interactive shell is coupled to an operating system of a computing resource;

a grid monitoring system coupled to said interactive shell and said operating system of said computing resource;

a plurality of system policy files coupled to said grid interactive shell and said grid monitoring system.

13. The grid computing control system according to claim 12, wherein said grid interactive shell further receives request to execute an application on said computing resource.

14. The grid computing control system according to claim 12, wherein said grid interactive shell comprises:

a command interpreter, for parsing said command; and

an access control subsystem, for verifying a first plurality of system and session parameters.

15. The grid computing control system according to claim 12, wherein said access control subsystem comprises one or more modules selected from the group consisting of an executables and files access control module, a user binaries module, a session access control module, and a quality of service access control module.

16. The grid computing control system according to claim 12, wherein said grid monitoring system comprises:

a plurality of monitoring agents, for monitoring a second plurality of system and session parameters; and

a log file, for recording a plurality of system and session data.

17. The grid computing control system according to claim 12, wherein said plurality of monitoring agents comprises one or more modules selected from the group consisting of a session specific policy module, a quality of service guarantees module, an intrusion detection module, and an intrusion prevention module.

18. A computer readable-medium comprising a plurality of instructions which when executed cause a grid computing resource to execute a resource management process comprising:

verifying a requested command is an allowable executable;

verifying said requested command includes an allowed argument;

verifying said requested command conforms to a session specific policy;

verifying said requested command conforms to a quality of service guarantee;

monitoring compliance with said session specific policy during execution of said requested command; and

monitoring compliance with said quality of service guarantee during execution of said requested command.

19. The process according to claim 18, further comprising:

monitoring to detect an intrusion during execution of said requested command; and

monitoring to prevent said intrusion during execution of said requested command.

20. The process according to claim 19, further comprising verifying said requested command includes a trusted signature, wherein said requested command comprises a user specified binary.