Usecases and Requirements for OGSA-Security Dec. 17th, 2003 Takuya Mori <moritaku@bx.jp.nec.com> NEC Corporation.

Usecase: Resource Sharing across Data Centers Chalie, is a service provider and also a Gold Member of DC_Alice, is going to host his services on a data center operated by DC_Alice. DCA manages resource sharing among the affiliated data centers User_Charlie Grid_DCA (Data Center Affiliation) Contract Data Center Alice Data Center Bob a Gold Member may use XYZ GB of storage, etc... SLAs or contracts are managed by the VO SLA (Contract) a prior bidirectional contract such as, "a Gold Member of DC_Alice can use resources of DC_Bob upto PQR GB of storage, ...", etc...

Configuration of a VO Data Center Alice Data Center Bob Users and all these resources are added to the VO Authentication Service VO Management Service is created on some Grid Environment by a VO Manager VO Factory Service User_Charlie Grid_DCA (Data Center Affiliation) Trust relationship between the VO and the RO registered... Trust Service Data Center Alice Data Center Bob SLAs, Resource allocation policies, etc... are added to the VO Policy Service SLA (Contract)

Job submission & Resource Allocation Chalie is a Gold Member of DC_Alice Authentication Service User_Charlie job DC_Alice grants its Gold Member to submit a job Grid_DCA (Data Center Affiliation) Policy Service Data Center Alice Data Center Bob sub- job sub- job sub- job sub- job sub- job sub- job Server_1 Server_2 SLA (Contract) Resource allocation policy to a Gold Member to be enforced Policy Service Server_3 Server_4 Storage_1 Storage_2

Allocation of Shared Resources (1) Chalie is a Gold Member of DC_Alice Authentication Service User_Charlie DC_Alice is a member Grid_DCA Attribute Service Grid_DCA (Data Center Affiliation) DC_Bob grants a Gold Member of DC_Alice to use their resources Data Center Alice Data Center Bob Authorization Service job job Policy Service sub- job sub- job sub- job sub- job Server_1 sub- job Heavy workload!! Server_2 SLA (Contract) sub- job sub- job sub- job Storage_1 sub- job

Allocation of Shared Resources (2) Chalie is a Bronze User of Grid_DCA Attribute Service Chalie, is a service provider, a Gold Member of DC_Alice and also a Bronze User of Grid_DCA, is going to host his services on a data center operated by DC_Alice. DC_Bob grants a Bronze User of Grid_DCA to use their resources User_Charlie Grid_DCA (Data Center Affiliation) Policy Service Data Center Alice Data Center Bob job job sub- job sub- job sub- job sub- job Server_1 sub- job Heavy workload!! Server_2 SLA (Contract) sub- job sub- job sub- job Storage_1 sub- job

Requirements a VO to manage its memberships Possible members are: users and resources, etc... a VO and a RO is also a kind of resources... a VO to manage attributes of its members Possible attributes are: groups, roles, etc... a VO to manage policies or agreements related to the VO possible polices or agreements are: resource allocation policies, authorization policies, etc... these policies and agreements can be associaated to requests as a VO context Trust Relationships No dynamic establishment of trust relationships is required in this usecase a manually configurable trust management mechanism is needed

Security Services Virtual Organization ? ? Real Organization 1 a VO and a RO Management are very similar services Virtual Organization Policy and Agreement Services (Authorization) ? VO Management Services Attribute Service VO Policy Service ? Authentication Service (Id Authority) VO Membership Service Authorization Service Authorization Service Policy and Agreement Services (Authorization) Policy and Agreement Services (Authorization) RO Management Attribute Service Attribute Service Authentication Service (Id Authority) Authentication Service (Id Authority) Real Organization 1 Real Organization 2 Underlying Security Layers: Security Policy (QoP) Exchange & Expression Described in OGSA Discussed in OGSA-AuthZ-WG Missing in OGSA or OGSA-AuthZ Session Security (based on WS-SecureConversation) Message Security (based on WS-Security) Naming Stuff

Security Services VO Management Services Policy and Agreement Referred in the subsection 6.2 of OGSA document VO Factory Service VO Membership Service Manages VO membership (users, resources ...) Issues membership attribute assertions It means VO Membership Service is a kind of attribute service. VO Policy Service VO-wide policy service (possible policies include authorization policy, trust policy, and privacy policy) Policy and Agreement Described in the subsection 6.16 of OGSA document

Security Services (Contd.) Authorization Service Discussed in OGSA-AuthZ-WG, but not in OGSA document Attribute Service (Will be) discussed in OGSA-AuthZ-WG Not described in OGSA document now Issues an attribute assertion that is used for various policy decisions Authentication Service (Credential Validation) Not described in OGSA document Validates a credential and identifies a requestor Support for PKI and Kerberos is mandatory Trust Management Service a manually configurable trust management mechanism