Operations Management Board 19th Dec. 2013 The eTokenServer (A standard-based solution developed by INFN Catania for central provisioning of robot credentials) Giuseppe LA ROCCA INFN - Catania, Italy giuseppe.larocca@ct.infn.it Operations Management Board 19th Dec. 2013

Outline Introduction to the “light-weight” crypto library Java™ PKCS#11, Bouncy Castle and Java CoG Kits VOMS-Admin APIs v.3.0 Apache Tomcat 7.0.27 as a Web Container JAX-RS 1.2 Java APIs using Jersey implementation The Architecture Accounting feature (with RFC proxies only) Usage Statistics Summary and Conclusions

Introduction to the “light-weight” crypto library: Java™ PKCS#11, Bouncy Castle and Java CoG Kits VOMS-Admin APIs v.3.0 Apache Tomcat 7.0.27 as a Web Container JAX-RS 1.2 Java APIs using Jersey implementation

Some driving considerations … The standard-based crypto library interface has been designed to provide seamless and secure access to computing e-Infrastructures using robot certificates The business logic of the library, deployed on top of an Apache Tomcat Application Server, combines different programming native interfaces and standards such as the: “cryptoki” Java™ Cryptographic Token Standard Interface (PKCS#11) libraries, Open source BouncyCastle libraries, Java CoG Kits APIs, VOMS-Admin APIs, RESTful technology (JSR 311).

SW packages adopted The Cryptographic Token Interface Standard (PKCS#11) is a standard introduced by RSA Data Security Inc; It defines native programming interfaces to access cryptographic tokens, (hardware cryptographic accelerators, smart cards, …) The Bouncy Castle APIs provide support for creating two kinds of X.509 certificates (ver.1 and ver.3) The Java CoG Kits APIs allow users to provide Globus Toolkit functionality within their code without calling scripts, or in some cases without having Globus installed VOMS-Admin APIs (ver. 3.0), developed in the context of the DILIGENT and D4Science projects, were used for interacting the VOMS server and retrieve the list of groups/roles per VO The JAX-RS (Java API for RESTful Web Services) specification presented in JSR 311 defines a standard way to deploy RESTful web services

Application Server Deployed on Tomcat Application Server (v7.0.27) Caching of proxy certificates for each valid requestID (MD5SUM+vo+[fqan]+[options]): If lifetime(requestID)-12h>0  the cached proxy is sent to the Science Gateway Thread-safe access to the list of smart cards Evaluated performance of the server using Apache JMeter™ ~ 6-8 sec. Waiting time for a new proxy 20 msec. If the proxy is cached

Hardware Tokens To reduce the risks to have the robot certificate compromised, different CAs decided to store this new certificate on board of the Aladdin eToken USB smart cards Costs: eToken PRO 64KB € 49,00 eToken PKI Client € 15,90 eToken Shell € 2,00 The Aladdin eToken smart card can support several certificates: 4 certificates per each eToken PRO 64KB PKI Client supports maximum 16 slots! A token PIN is prompted every time the user needs to interact with the smart card

The Architecture The typical working scenario The web interface (protected) Some statistics More info

The five-layer architecture of the “light-weight” standard-based crypto library

The typical working scenario…

The web interface (protected access) Use the VOMS-Admin APIs to get the list of groups/roles

The web interface (protected access)

The web interface (protected access)

An experimental solution to account users of Robot Certificate Adding some user information (CN=…) for accounting aims (no security!) during the robot proxy generation process: /C=IT/O=INFN/OU=Robot/L=Catania/CN=Robot: Catania Science Gateway - Roberto Barbera/CN=Giuseppe La Rocca/CN=1388930209 Only RFC proxies are supported (no legacy) The additional user’s information have to be provided by a portal:  No CN checks are implemented at VOMS level  Users could be known only by the portal Impact on EGI accounting is under evaluation Compliant with standards and security policies [1, 2]

Who is using the library ? The eTokenServer service is currently used by the following different Science Gateways:

Some usage statistics …

Get more info … ?

Summary & Conclusions The eTokenServer is currently used as central service to provision robot proxy credentials to different VRCs  It provides a transparent and secure mechanism to access robot certificates installed on USB smart cards  We are available to offer the eTokenServer features as EGI catch-all service for free The business logic relies on different standards: The Cryptographic Token Interface Standard (PKCS#11) The Open source BouncyCastle Java libraries The Java CoG Kits APIs The VOMS-Admin APIs The JAX-RS 1.2 Java APIs using Jersey implementation By design the eTokenServer is compliant with the policies reported in these two documents: EUGridPMA guidelines, OperationsGuideline With the latest release the eTokenServer is now possible to account users of Robot Certificates (RFC proxies only)

Any questions, comments or remarks are very welcome. Please contact us: giuseppe.larocca@ct.infn.it salvatore.monforte@ct.infn.it diego.scardaci@ct.infn.it