# US 7,467,303 B2 · Grid mutual authorization through proxy certificate generation > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 7,467,303 B2 - Document ID: US7467303B2 - Status: Granted - Kind: B2 - Application number: 10/809,551 - Filed: 2004-03-25 - Published: 2005-09-29 - Granted: 2008-12-16 - Earliest claimed: 2004-03-25 - Assignees: International Business Machines Corporation - Inventors: Susann Marie Keohane; Gerald Francis McBrearty; Shawn Patrick Mullen; Jessica Kelley Murillo; Johnny Meng-Han Shieh - Web page: https://patentgrep.com/patent/US7467303B2 ## CPC - H04L 63/0869: {for achieving mutual authentication (cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273)} - H04L 9/3263: {involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823)} - H04L 9/3273: {for mutual authentication (network architectures or network communication protocols for achieving mutual authentication in a packet data network H04L63/0869)} - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - H04L 2209/76: Proxy, i.e. using intermediary entity to perform cryptographic operations - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method for mutual authorization of a secondary resource in a grid of resource computers is provided. When a primary resource attempts to offload a grid computing job to a secondary resource, the primary resource sends a proxy certificate request to the user machine. Responsive to a proxy certificate request, the user machine performs authorization with the secondary resource. If authorization with the secondary resource is successful, the user machine generates and returns a valid proxy certificate. The primary resource then performs mutual authentication with the secondary resource. If the authorization with the secondary resource fails, the user machine generates and returns an invalid proxy certificate. Mutual authentication between the primary resource and the secondary resource will fail due to the invalid proxy certificate. The primary resource then selects another secondary resource and repeats the process until a resource is found that passes the mutual authorization with the user machine. ## Claims ### Claim 1 A method for authorizing offloading of a grid job in a grid computing system, the method comprising: submitting a grid job to a primary grid resource, by a user data processing system; responsive to a determination by the primary grid resource to offload the grid job, identifying a secondary grid resource that is to run the grid job; responsive to identifying the secondary grid resource, generating a certificate request; sending the certificate request to the user data processing system; responsive to receiving the certificate request by the user data processing system, performing authorization with the secondary grid resource; and responsive to authorization with the second grid resource failing, generating an invalid proxy certificate and sending the invalid proxy certificate to the primary grid resource. ### Claim 2 (depends on 1) The method of claim 1, further comprising: responsive to authorization with the second grid resource succeeding, generating a valid proxy certificate; and sending the valid proxy certificate to the primary grid resource. ### Claim 3 (depends on 1) The method of claim 1, wherein submitting a grid job to a primary grid resource includes submitting the grid job to a grid scheduler, wherein the grid scheduler selects a primary grid resource and sends the grid job to the primary grid resource. ### Claim 4 (depends on 1) The method of claim 1, wherein identifying a secondary grid resource that is to run the grid job includes submitting a query grid job to the primary grid resource inquiring about an identity of the secondary grid resource. ### Claim 5 (depends on 1) The method of claim 1, wherein identifying a secondary grid resource that is to run the grid job includes detecting an address of the secondary grid resource in the certificate request. ### Claim 6 (depends on 1) The method of claim 1, wherein performing authorization with the secondary grid resource includes submitting an authorization job to the secondary grid resource. ### Claim 7 (depends on 6) The method of claim 6, wherein the authorization job identifies security elements of the secondary grid resource. ### Claim 8 (depends on 6) The method of claim 6, wherein the authorization job determines at least one of an operating system of the secondary grid resource, security updates installed on the secondary grid resource, whether the secondary grid resource has a trusted operating system, whether any conflicting grid jobs are running on the secondary grid resource. ### Claim 9 (depends on 6) The method of claim 6, wherein the authorization job determines whether a given command is disabled on the secondary grid resource. ### Claim 10 (depends on 1) The method of claim 1, wherein performing authorization with the secondary grid resource includes determining whether the secondary grid resource is included in a black list. ### Claim 11 (depends on 1) The method of claim 1, wherein performing authorization with the secondary grid resource includes determining whether the secondary grid resource is included in a white list. ### Claim 12 (depends on 1) The method of claim 1, wherein performing authorization with the secondary grid resource includes performing authorization with the secondary grid resource using one or more rules. ### Claim 13 A method for authorizing offloading of a grid job in a grid computing system, the method comprising: submitting a grid job to a primary grid resource, by a user data processing system; responsive to a determination by the primary grid resource to offload the grid job, identifying a secondary grid resource that is to run the grid job; responsive to identifying the secondary grid resource, generating a certificate request; sending the certificate request to the user data processing system; responsive to receiving the certificate request by the user data processing system, performing authorization with the secondary grid resource; responsive to authorization with the second grid resource failing, generating an invalid proxy certificate, forming a generated certificate; responsive to authorization with the second grid resource succeeding, generating a valid proxy certificate, forming a generated certificate; sending, by the user data processing system, the generated certificate to the primary grid resource; sending the generated certificate by the primary grid resource to the secondary grid resource; responsive to a determination, by the secondary grid resource, that the generated certificate is a valid proxy certificate, performing the grid job by the secondary grid resource; responsive to a determination, by the secondary grid resource, that the generated certificate is an invalid proxy certificate, refusing the grid job by the secondary grid resource; and responsive to the secondary grid resource refusing the grid job, identifying another secondary grid resource that is to run the grid job.