Thebes

Connecting the various players in any inter-process communications require that the processes be able to:

• Discover each other
• Authenticate themselves
• Evaluate authentication to make authorization decisions based upon policies.

This is the glue that connects resources; authentication, authorization, and discovery. Solving these problems in a scalable manner allows the creation of broadly distributed trustworthy systems capable of sharing any sort of resources.

However, scalability has been lacking to date. The Thebes project was created initially to solve these problems in the grid and high performance computing arena. Grid computing died primarily because no one was able to accomplish scalable solutions to these problems. Now the magic word is cloud computing. Unfortunately, the use cases that brought about interest in grids still remain unsolved, and carry over to cloud computing.

Thebes has expanded in scope to include any problem where security and discovery middleware is relevant. Project completion will facilitate the eventual construction a global general-purpose infrastructure by enabling connections between existing diverse users and critical resources. New middleware eases the burden on resource owners by divesting them of knowledge of specific user organization memberships, thus improving grid security and particularly scalability, encouraging resource contributions.

Widespread adoption will ease access to a vast aggregate of diverse resources for users with widely differing levels of expertise. Decentralizing databases will ease the burden on system owners, encouraging them to make resources available while maintaining the highest degree of data accuracy. By connecting users to and across existing grids and to new installations, regardless of the underlying technology or size this middleware should benefit existing projects. A

Philosophically, the Thebes Consortium believes the following statements are true and must be considered when designing a new grid infrastructure:

• With some exceptions, resource owners generally do not care about the identities of the user.
• Resource owners should not require advanced, or pre-negotiated knowledge of remote users.
• Every resource must be able to enforce policy.
• Resource owners must be protected from execution of dangerous applications.
• Every resource must be able to track usage.
• Users prefer there be no distinction between local and grid resources in their ease of use.
• Users seldom care where their job is executing.
• Users should have automatic access to all resources whose policies they satisfy.

Membership gives you the option to post comments and add content.

Arnie Miles

Thebes requires SAML2 assertions. Because Rampart doesn't support SAML2 out of the box some code modification were required.

Please rename rahas-1.4-thebes.zip to rahas-1.4-thebes.mar

This document reports the status of the Thebes project as of October 2009, as well as describing the short term development and deployment roadmap.

The Thebes project is on the verge of releasing it's first set of beta software that can provide a complete secure attribute-based infrastructure. This includes the security token service, resource tools and client tools.

This first release is aimed at distributed high performance computing, but the security token service is a huge advance towards the creation of a general purpose security infrastructure. Look at some of my most recent blog posts or in the "Use Case" section of this site for some generic examples of ways this can be used.

Now is the time to join the mailing list and get your membership to the Thebes portal, so you can track and more importantly comment on events as they unfold. We need all the input we can get from our members, so the products we publish are valuable to you.

Arnie Miles

When working from home on personal computers doing personal business, many persons will use their Internet service provider as the repository of basic attributes. When a person has logged into their Internet account, they will receive a fresh attribute assertion that they will bring with them to use as they need and dictate. If they visit a site that requires registration, with the user’s permission much of the work will be automated. The user will reap the benefits of single sign-on, and no additional usernames and passwords will be generated. Subsequent visits to the site will be authorized transparently and effortlessly, as a freshly obtained attribute assertion will be passed to the web site. Imagine a “Log In” button with no fields attached to it, clicking it will allow a user’s computer to pass the assertion to the remote site.

Sensor networks can be as simple as temperature sensors on a building’s air ducts to control the air conditioning to the multitude of sensors on a satellite in space. Aircraft, automobiles, weather, climate changes, seismic instruments; the list is endless. Any sensor that is programmable and network aware can be connected to this infrastructure. Suddenly the owner of a sensor resource has ultimate control over who can and who cannot access that sensor, making sweeping changes quickly and easily. As mentioned before, this system will allow for accounting of usage, so funding agencies can understand who is using the sensors they paid for, and private industry can bill for usage of the sensors.