A Concept for Grid Credential Lifecycle Management and Heuristic Credential Abuse Detection

In modern grids, authentication is usually implemented via an X.509 PKI (public key infrastructure). Proxy certificates are employed to facilitate interaction with the grid, especially for purposes of delegation and single sign-on. We propose modifications to the grid security infrastructure that allow reporting of proxy usage information to a database, giving the end user an opportunity to review by whom and for which purpose his credentials were used. By means of a standardized protocol for certificate revocation, they can then revoke affected proxies and stop abuse.