Grid Computing Security Mechanisms: the state-of-the-art A. Bendahmane, M. Essaaidi, A. El Moussaoui, A.Younes Information and Telecommunication Systems Laboratory Faculty of Sciences Tetouan, Morocco. ICMCS’2009

Outline Introduction Resources Level Solutions Service Level Solutions Authentication & Authorization Level solutions Information Level Solutions Management Level Solutions Co03/05/2018nclusions ICMCS’2009

Introduction (Grid Computing?) A collection of heterogeneous resources distributed over a local or wide area network, and available to an end user as a single large computing system deployment of grid technologies within the context of business and enterprise IT communities large-scale and distributed scientific computing computing power data access storage resources security has been a central issue in grid computing from the outset, and has been regarded as the most significant challenge for grid computing ICMCS’2009

Introduction (Security Mechanisms?) As a result, novel security technologies have been evolving all the time within the grid computing researchers ICMCS’2009

Resources Level Solutions Protecting the grid resources (grid nodes or Host, and communication network) Host Security Network Security Sandboxing Virtualization Hose service model Adaptive Firewall for the Grid Another way to secure the grid resources is through intrusion detection system (IDS) solution. ICMCS’2009

Service Level Solutions DOS attack is one of the most important security threats existing in grid computing. Preventive solutions Reactive solutions Application filtering, location hiding, and the throttling techniques. Link testing, logging, ICMP traceback, and IP traceback. ICMCS’2009

Service Level Solutions (cont) Advantages Disadvantages Preventive Simple implementation Static and cannot detect new attacks has significant effect on performance Reactive Has huge potential, can detect attackers Can be used as a DoS attack tool identification techniques are totally manual, and may span over months DoS attacks cannot be mitigated by one solution alone and multiple solutions should be employed to improve the effectiveness. ICMCS’2009

Authentication & Authorization Level solutions ICMCS’2009

Authentication Authentication deals with verification of the identity of an entity within a network GSI (Grid Security Infrastructure) Kerberos LDAP ICMCS’2009

Authentication (cont) GSI (Grid Security Infrastructure) Based on X.509 certificate Public private key pair Certificate Authority (CA) Requires a Public Key Infrastructure to make it a viable solution Implemented in all versions of Globus ICMCS’2009

Authentication (cont) Kerberos Integration with GSI GSI does not accept Kerberos credentials as an authentication mechanism Gateways or translators which accept Kerberos credentials and convert it to GSI credentials and vice versa SSLK5/PKINIT GSI Kerberos KX.509/KCA ICMCS’2009

Authentication (cont) LDAP is a naming service for the broadcast of system information which can then be used for authentication purpose. Several methods of authentication corresponding to various security levels are available in standard LDAP login/password X.509 certificate (SSL/TLS, SASL) coupled with Access Control Lists Integrating mechanisms of strong authentication like Kerberos or systems of one-time passwords ICMCS’2009

Authorization Authorization deals with the verification of an action that an entity can perform after that an authentication is performed successfully. Centralized Systems Decentralized Systems CAS, VOMS, EALS Akenti, PERMIS, Grid-MAP ICMCS’2009

Decentralized Systems Authorization (cont) authoz Sys Parameters Centralized Systems Decentralized Systems CAS VOMS EALS Akenti PERMIS Grid-MAP Scalability High Medium Security GSI Passwords/ Certificates Inter-operability Use SAML Can use SAML SAML/ XACML May be complex in some cases minimal Revocation No Fast Can be Fast Have to be updated ICMCS’2009

Information Level Solutions Information Level includes those security concerns that arise during the communication between two entities. Confidentiality Integrity Single Sign On ICMCS’2009

Information Level Solutions (cont) GSI (in Globus Toolkit 4.0 or GT4) provide secure communication at two levels. Message Level Security Transport Level Security Encrypts the complete communication. Encrypts only the content of the SOAP message. Both are based on public-key cryptography ICMCS’2009

Information Level Solutions (cont) Message Level Transport Level Technology WS-Security WS-SecureConversation SSL/TLS Confidentiality Yes Integrity Single Sign On No Performance Good if sending many messages Good if sending few messages Best ICMCS’2009

Management Level Solutions Credentials are important in grid systems as they are used for accessing the Grid resources Mechanisms to securely store, access, and manage credentials in grid systems. Credential Management (CM) systems Credential repositories Credential federation Storing the credentials securely Generating new credentials on demand Sharing the credentials across different domains. ICMCS’2009

Thank you Conclusions Classification of the different security solutions in grid computing Grid security solutions have some fails and can’t protect against all types of attack. with the growth of the uses of grid computing technology in different domains, new types of attacks will arise. It is then necessary to develop more robust concepts of grid computing security. ICMCS’2009

Thank you ICMCS’2009