Access Control for Dynamic Virtual Organisations Duncan Russell, Peter Dew & Karim Djemame University of Leeds

Access Control for Dynamic Virtual Organisations DAME Context DAME Virtual Organisation Demonstration Portal & Workflow Management Virtual Organisation Issues

DAME (Distributed Aircraft Maintenance Environment) EPSRC Funded, 3 years. Ends Dec Universities: – University of Leeds - School of Computing and School of Mechanical Engineering – University of Oxford - Dept of Engineering Science – University of Sheffield - Dept of Automatic Control and Systems Engineering – University of York - Dept of Computer Science Industrial Partners: – Rolls-Royce – Data Systems and Solutions

DAME System Aircraft Engine Diagnostics – Expert system & decision support – Predictive maintenance scheduling Distributed Resources – Data sources e.g. aircraft engines – Signal & Case data processing services Distributed Users – Maintenance staff at airport (for Airline) – Engine experts at Rolls Royce and DS&S On-demand Requirements – Diagnostics response within turn-around time

DAME Example Business process for diagnosing engine data Three roles: – Maintenance Engineer – Maintenance Analyst – Domain Expert Forms problem solving team

DAME Virtual Organisation

DAME VO Properties Role based Task oriented – Linked by diagnosis problem to solve Evolves over time – Dynamic membership – Multiples of role instances High availability of services – Dynamic selection of compute resource Access to restricted services & data

DAME Architecture VO Templates VO Instances Controlled access to workflow instances Presentation Tier Business Tier Service Tier Browser Portal Role database Case database Workflow Manager Workflow Credential Feature Visualization Feature Detection CBR Workflow Advisor Engine Data Store Broker White Rose Grid Pattern Matching Resource Tier Engine Model Jump

DAME Portal

DAME Portal Tools

DAME VO Issues Multiple portals, i.e. one per company Multiple workflow engines Multiple organisations defining rights for their: – Users by role – Workflow (task) by role – Services by role privileges – Data by ownership – Resources by usage Service logging

DAME VO Requirements Definition of flexible VO template policy – Administration rights to policy Implement flexible policy control mechanisms – VO members permitted to modify VO policy – Services read/modify VO policy by proxy Distribute VO access control to services and resources Back to Architecture

DAME Access Control Issues Service interface implementation: – Control of service access (using VO policy) – Modifying VO policy (using VO policy) Implementation issues: – Define template policy and translate to dynamic policy – Single entity or separate policy components – Synchronising simultaneous policy changes Current implementation: – VO templates describe static teams – Access control in presentation and business tiers only Single grid certificate in DAME collaborative workflows

Questions? Access Control for Dynamic Virtual Organisations Duncan Russell, Peter Dew & Karim Djemame University of Leeds This research is funded by the Engineering and Physical Science Research Council, e–Science Programme, Contract No. GR/R67668/01