In Vivo Imaging Middleware — Phase 6 Ashish Sharma, Tony Pan, Y. Nadir Saghar.

Slides:

Advertisements

Similar presentations

Lousy Introduction into SWITCHaai

Advertisements

PASSPrivacy, Security and Access Services Don Jorgenson Introduction to Security and Privacy Educational Session HL7 WG Meeting- Sept

GT 4 Security Goals & Plans Sam Meder

TNC 2008 / Short Lived Credential Service Implementation Based on National AAI Short Lived Credential Service Implementation Based on National AAI Emir.

Policy Based Dynamic Negotiation for Grid Services Authorization Infolunch, L3S Research Center Hannover, 29 th Jun Ionut Constandache Daniel Olmedilla.

CS 5511 Introduction to WS Authorization Brian P. Barrett.

Authentication solutions for Outlook and Office 365 Multi-factor authentication for Office 365 Outlook client futures.

WSO2 Identity Server Road Map

Access Control Patterns & Practices with WSO2 Middleware Prabath Siriwardena.

Dorian Grid Identity Management and Federation Dialogue Workshop II Edinburgh, Scotland February 9-10, 2006 Stephen Langella Department.

© 2009 The MITRE Corporation. All rights Reserved. April 28, 2009 MITRE Public Release Statement Case Number Norman F. Brickman, Roger.

An Introduction to Information Card Barry Dorrans Charteris plc

Prabath Siriwardena Senior Software Architect. An open source Identity & Entitlement management server.

Web Application Authentication with PKI & Other Functions Bill Weems & Mark B. Jones Academic Technology University of Texas Health Science Center at Houston.

18 th TF-EMC2. WebEx, June 2011 Diego R. Lopez, RedIRIS On the Many Ways to Identity Exchange (Again) Digital identities are more valuable as they are.

Cardea Requirements, Authorization Model, Standards and Approach Globus World Security Workshop January 23, 2004 Rebekah Lepro Metz

Distributed Web Security for Science Gateways Jim Basney In collaboration with: Rion Dooley Jeff Gaynor

Survey of Identity Repository Security Models JSR 351, Sep 2012.

1 Multi Cloud Navid Pustchi April 25, 2014 World-Leading Research with Real-World Impact!

Enterprise Identity Steve Plank – Microsoft Ivor Bright – Charteris Dave Nesbitt – Oxford Computer Group.

Cross-Enterprise User Assertion IHE Educational Workshop 2007 Cross-Enterprise User Assertion IHE Educational Workshop 2007 John F. Moehrke GE Healthcare.

Web Services Security Standards Overview for the Non-Specialist Hal Lockhart Office of the CTO BEA Systems.

ArcGIS Server and Portal for ArcGIS An Introduction to Security

Module 5 Configuring Authentication. Module Overview Lesson 1: Understanding Classic SharePoint Authentication Providers Lesson 2: Understanding Federated.

WS-Trust Joseph Calandrino Vincent Noël Department of Computer Science University of Virginia February 9, 2004.

Nadir Saghar, Tony Pan, Ashish Sharma REST for Data Services.

17 March 2008 © 2008 The University of Edinburgh, European Microsoft Innovation Center and University of Southampton IT Innovation Centre 1 NextGRID Security.

Ashish Sharma, Tony Pan, Barla Cambazoglu, Joel Saltz Ohio State University, Columbus, OH (ashish, tpan, October 10, 2007 caBIG In Vivo.

Shibboleth Akylbek Zhumabayev September Agenda Introduction Related Standards: SAML, WS-Trust, WS-Federation Overview: Shibboleth, GSI, GridShib.

WS-Trust “From each,according to his ability;to each, according to his need. “ Karl marx Ahmet Emre Naza Selçuk Durna

AAI WG EMI Christoph Witzig on behalf of EMI AAI WG.

1 caGrid Security Overview Mark Grand Senior Engineer caGrid Knowledge Center February 7, 2011.

Access Control and Markup Languages Pages 183 – 187 in the CISSP 1.

EGEE-II INFSO-RI Enabling Grids for E-sciencE EGEE and gLite are registered trademarks Security Token Service Valéry Tschopp - SWITCH.

SWEB SWEB Security and Privacy Technologies – Implementation Aspects Venue:SWEB Day in APV, Novi Sad Author(s):Dr. Milan Marković Organisations:MISANU.

SSO Case Study Suchin Rengan Principal Technical Architect Salesforce.com.

Manish Mehta, CS 590L Authentication Services in Open Grid Services by Manish Mehta April 27, 2004.

CaGrid 2.0 Security Prototype 1. Goals Prototype some proposed security solutions – Ensure interoperability across programming models – Ensure interoperability.

Security Token Service (STS) Design & Development Plans Henri Mikkonen / HIP 3 rd EMI All-Hands Meeting , Padova, Italy.

Copyright © 2003 Jorgen Thelin / Cape Clear Software 1 A Web Services Security Framework Jorgen Thelin Chief Scientist Cape Clear Software Inc.

Shibboleth Akylbek Zhumabayev September Agenda Introduction Description WS Standards WS-Federation Picture Grid Security GridShib References 2.

Authorisation, Authentication and Security Guy Warner NeSC Training Team Induction to Grid Computing and the EGEE Project, Vilnius,

Identity Management in DEISA/PRACE Vincent RIBAILLIER, Federated Identity Workshop, CERN, June 9 th, 2011.

The new Secure Retrieve (SeR) profile provides Access Control to the documents in an IHE XDS environment. Refer to the diagram on the next slide to see.

1 Earth System Grid Center for Enabling Technologies ESG-CET Security January 7, 2016 Frank Siebenlist Rachana Ananthakrishnan Neill Miller ESG-CET All-Hands.

Web Services Security Patterns Alex Mackman CM Group Ltd

Connect. Communicate. Collaborate Deploying Authorization Mechanisms for Federated Services in the eduroam architecture (DAMe)* Antonio F. Gómez-Skarmeta.

Andrew J. Hewatt, Gayatri Swamynathan and Michael T. Wen Department of Computer Science, UC-Santa Barbara A Case Study of the WS-Security Framework.

EMI is partially funded by the European Commission under Grant Agreement RI Federated Grid Access Using EMI STS Henri Mikkonen Helsinki Institute.

Creating a European entity Management Architecture for eGovernment Id GUIDE Keiron Salt

EMI is partially funded by the European Commission under Grant Agreement RI Security Token Service (STS) Transforming the Existing User Credentials.

Claims-based security with Windows Identity Foundation.

Using PIV Cards with NIH Login Chris Leggett NIH Login Technical Lead CIT/NIH.

WSO2 Identity Server 4.0 Fall WSO2 Carbon Enterprise Middleware Platform 2.

EMI is partially funded by the European Commission under Grant Agreement RI Security Token Service (STS) Simplified Credential Management Henri.

Prabath Siriwardena, Director of Security, WSO2 Twitter

Authentication methods SharePoint Web Application Windows integrated Membership & Role Providers Web SSO Access control Roles protected Anonymous.

CERN IT Department CH-1211 Geneva 23 Switzerland t OIS Operating Systems & Information Services CERN IT Department CH-1211 Geneva 23 Switzerland.

WSO2 Identity Server. Small company (called company A) had few services deployed on one app server.

Secured Services Best Practices on ArcGIS for Server Patrick Jackson & Thomas Noble.

Security in Research Computing John Sandefur UAB Comprehensive Cancer Center John-Paul Robinson UAB Research Computing.

Identity Federations - Overview

The New Virtual Organization Membership Service (VOMS)

NAAS 2.0 Features and Enhancements

The DAMe’s First Steps: eduroam and NAS-SAML

Example Use Case for Attribute Authorities and Token Translation Services - the case for eduGAIN Andrea Biancini.

Una herramienta para la gestión de identidad, el control de acceso y uso compatible con la regulación de identidad europea eIDAS.

Presentation transcript:

In Vivo Imaging Middleware — Phase 6 Ashish Sharma, Tony Pan, Y. Nadir Saghar

Scope  Operation and Maintenance  caGrid 1.4 compatibility  AIME 4.0  Security  Secure Token Service 1.0  Data Authorization Support 

caGrid 1.4 support  PACSDataService  VirtualPACS  AIME  Integrated with STS

Security Encryption Authentication Method Level Authorization Secure Token Service WS-Security * & WS-Trust * compliant

WS-Security  The client embeds it’s credential in the request  The service validates the credential  The service processes the request if the credentials are valid Problems:  Client and Service must agree to common authentication mechanism (implicit trust)  Federation is hard Client 1. Request + credentials 2. Response Web Service

WS-Trust Security Token Service Client Identity Provider 1. Request Token 2. Auth using user/pas s 3. Token 4. Token + request 5. Validate Token 6. response Service Provider

STS backed by caGrid security Infrastructure Security Token Service Frontend / Client App Service Provider(Web Service) Dorian Permissions/G roup Membership 1. Request Token 2. Auth using user/pass 3. Get permission s bound with the subject 4. Credential + permissions = Token 5. Token + request 6. Validate Token

caGrid clients/services integration Security Token Service Cagrid Client Cagrid service Dorian 1. Request Token 2. Auth using user/pas s 4. Token = Proxy Cert 5. Grid Credentials ( Proxy Certificate ) 3. Proxy Certifica te

Notes  The token contains user credentials and group membership/permissions information.  The user credential present in the token can be used to interact with grid services.  The token itself is independent of caGrid infrastructure and can be used in other applications.  The REST API for the STS provides a simple yet powerful way of interacting with it.  The transactions are based on WS-Trust and WS-Security. The token format is also a standard one : SAML2.  The interactions between the entities involved are IHE’s XUA ( Cross Application User Assertion ) profile compliant.

Generic Use case Security Token Service Frontend / Client App Identity Provider Dorian LDAP OpenID Custom 1. Request Token 2a. Auth using user/pass 3. Token 4. Token + request 5. Validate Token 6. response Service Provider Service Providers Permissions/G roup Membership 2b. Get permissions bound with the subject

Authorization  XACML Support