Service Virtualization via a Network Appliance…. Enterprise ACS Service Virtualization via a Network Appliance…. Peter Ziu Michael Behrens (R2AD, LLC) GGF18 September 11-14, 2006 Washington DC, USA

OGF IPR Policies Apply I acknowledge that participation in GGF13 is subject to the GGF Intellectual Property Policy. Intellectual Property Notices Note Well: All statements related to the activities of the GGF and addressed to the GGF are subject to all provisions of Section 17 of GFD-C.1 (.pdf), which grants to the GGF and its participants certain licenses and rights in such statements. Such statements include verbal statements in GGF meetings, as well as written and electronic communications made at any time or place, which are addressed to: the GGF plenary session, any GGF working group or portion thereof, the GFSG, or any member thereof on behalf of the GFSG, the GFAC, or any member thereof on behalf of the GFAC, any GGF mailing list, including any working group or research group list, or any other list functioning under GGF auspices, the GFD Editor or the GWD process Statements made outside of a GGF meeting, mailing list or other function, that are clearly not intended to be input to an GGF activity, group or function, are not subject to these provisions. Excerpt from Section 17 of GFD-C.1 Where the GFSG knows of rights, or claimed rights, the GGF secretariat shall attempt to obtain from the claimant of such rights, a written assurance that upon approval by the GFSG of the relevant GGF document(s), any party will be able to obtain the right to implement, use and distribute the technology or works when implementing, using or distributing technology based upon the specific specification(s) under openly specified, reasonable, non-discriminatory terms. The working group or research group proposing the use of the technology with respect to which the proprietary rights are claimed may assist the GGF secretariat in this effort. The results of this procedure shall not affect advancement of document, except that the GFSG may defer approval where a delay may facilitate the obtaining of such assurances. The results will, however, be recorded by the GGF Secretariat, and made available. The GFSG may also direct that a summary of the results be included in any GFD published containing the specification.   GGF Intellectual Property Policies are adapted from the IETF Intellectual Property Policies that support the Internet Standards Process.

Enterprise ACS - Sharing AA’s B Replication contracts C A D Macro View - Distributed services via secure circuits

Enterprise ACS - part of architecture CDDLM, EMS (BES), data specifications and other OGSA standards provide a foundation for dynamic service instantiation These dynamic instantiations (provisioning) provide support for: Service Transparency Not hard-coded end points internal to service calls EPRs are may not be static Service Mobility Potential for a service to move or to exist in multiple places at the same time ACS provides a trusted store from which content (services and data) can be obtained securely Grid Services can be instantiated from ACS when needed, based on SLA needs (monitoring)

Cases where needed Inter-Grid ACS - Disaster Recovery Computers are geographically dispersed Track where what is installed and used Usage Metrics - collected data can be associated with the content as a referenced AA Location Awareness or pedigree of where systems are installed (inventory analysis). Usage Trends over time, etc. Inter-Grid ACS - Disaster Recovery Replication Caching of grid/web service definitions System of services (services and their dependencies) Non-Service applications databases binary data application containers images Provisioning Grid Appliance...

Grid Provisioning Appliance Concept Provides the grid “DNA” or “seed” to create, duplicate, or graft a section of grid environment. It exists at development time. Can be replicated or duplicated from an existing appliance. Can integrate images/packages for OS, ACS repository, common jobs, Identity management services and data storage. Facilities include: Identity Management UI, network boot strapping services, kernel and flash images, Can prepare supported network enabled devices “out of the box” to become operational grid containers WAN

Use Case Actors Customers (multi-domain): Appliance Services: Grid Application Developers Grid Administrators Application / Service Testers Production Hosting Entities Appliance Services: Boot strap delivery SI, IUP Repository Service (ACS) Identity Management UI Cross Domain Security Mgmt. Macro computer Constraints Design Provisioning service (CDDLM) Device authentication service Solution Installation (SI) parser Service Consumers Network Enabled Devices Boot Kernels/Images Data Providers Identity store ACS content OS Binaries/Images / Configuration /Bootable ISOs Core Grid Containers and Services Components, configurations, Solution Installation, Jobs (JSDL), Applications

Auto Provisioning Scenario ACS Provisioning Appliance (logical view) AA Cache/ Storage Detects new network device 1 Network Monitoring Detection Authenticates/Authorizes Registers new H/W 2 Device Auth (who/allowed) Purpose/Need (info mgt) Determines purpose of new node (manual or automatic) main function or generic node 3 ACS Core Grid AA’s ACS Security Component keystore/XACML/etc Provisions core grid engine securely + application binaries based on SLA control events from EMS 4 Provisioning Participates in Dynamic Services - Now a fully functional grid node 5 R2AD New Node (any network device)