Security Daniel Mallmann MWSG meeting Amsterdam December 2005

2 Usite B Vsite B2Vsite B1 Usite A Vsite A1 Architecture Overview Gateway Internet Gateway Target System Interface Network Job Supervisor Target System Interface Network Job Supervisor Client

3  Java application  User authentication via X.509 certificates  Global or local list of Unicore sites (Usites)  Connects to Gateway via SSL and Unicore Protocol Layer (UPL)  Job preparation ♦Workflow management ♦File management ♦Abstract Job Object (AJO) generation ♦Job signing  Job monitoring  Job control Job Preparation Job Monitor Workflow Management Usites Vsites

4 Client Internet Gateway Unicore Site list SSL Client

5 Usite B Vsite B2Vsite B1 Usite A Vsite A1 Gateway Internet Gateway Target System Interface Network Job Supervisor Target System Interface Network Job Supervisor Client Gateway

6  Authentication: ♦Connection only with valid certificates from accepted Certification Authorities ♦Forwards client certificate to NJS for authorisation  Single point of entry for all Unicore services of the Usite ♦Only one open port  List of Vsites  Connects to Vsites via UPL (SSL optional)

7 Gateway Internet Client Gateway SSL VSite list Vsite 2 Network Job Supervisor Vsite 1 Network Job Supervisor Vsite 3 Network Job Supervisor Firewall

8 Network Job Supervisor Usite B Vsite B2Vsite B1 Usite A Vsite A1 Gateway Internet Gateway Target System Interface Network Job Supervisor Target System Interface Network Job Supervisor Client Network Job Supervisor

9  Checks integrity of jobs  Authorises the user by Unicore User Data Base (UUDB) ♦Mapping of Unicore user certificate to target system Xlogin  Forwards sub jobs to remote Vsites  Translates abstract job into target system specific tasks based on Incarnation Data Base (IDB)  Transfers files to work directory on the target system via socket connection  Submits jobs to Target System Interface (TSI) via socket connection

10 Network Job Supervisor Target System Interface Network Job Supervisor Gateway Incarnation Data Base Unicore User Data Base Network Job Supervisor Gateway Internet

11 Usite B Vsite B2Vsite B1 Usite A Vsite A1 Target System Interface Gateway Internet Gateway Target System Interface Network Job Supervisor Target System Interface Network Job Supervisor Client Target System Interface

12 Target System Interface  Interfaces between Unicore and the Grid resource  Executes the specific tasks, translated by the NJS, or submits them to the batch sub system  Stores and sends files from/to the Unicore Client or local directories  Contains batch sub system, operating system and installation specific code  Runs as root

13 Target System Interface Network Job Supervisor Shepard Worker Batch Sub System File System Application Operating System

14 Usite B Vsite B2Vsite B1 Usite A Vsite A1 Multiside Job Gateway Internet Target System Interface Network Job Supervisor Target System Interface Network Job Supervisor Client Gateway

15 Secondary Network Job Supervisor Primary Network Job Supervisor SSL Client Multiside Job = User certificate= NJS certificate Job Sub Job  Consigner ♦The entity (user client or NJS) that consigns a job or sub-job ♦Expressed by use in SSL connection  Endorser ♦The entity (user) that authorises the tasks to be performed ♦Expressed by signing of serialized AJO direct acyclic graph

16 Usite B Vsite B2Vsite B1 Usite A Vsite A1 Explicit Trust Delegation Gateway Internet Target System Interface Network Job Supervisor Target System Interface Network Job Supervisor Client Gateway Portal

17 SSL Network Job Supervisor SSL Portal WS- Client (Browser) Explicit Trust Delegation Job User: name = User certificate= Portal certificate  User ♦New role besides consignor and endorser ♦Entity (user) on whose behalf tasks will be performed  Trusted Agents (Portal) ♦Added to the UUDB explicitly ♦Allowed to endorse AJO on behalf of users

18 UniGrids project  All components are being moved to stateful Web Services ♦Based on the Open Grid Services Architecture (OGSA) ♦Compliant with the Web Services Resource Framework  Gateway handles multiple protocols  Web Service implementation of the UUDB

19 References  Unicore ♦Software: ♦Whitepaper: documents/UNICOREPlus-Final-Report.pdf  Unicore Security ♦GGF Document GFD.18 “An Analysis of the UNICORE Security Model”  UniGrids ♦  Explicit Trust Delegation ♦Fujitsu Scientific & Technical Journal, Special Issue: Grid Computing, (Vol.40, No.2) “Explicit Trust Delegation: Security for Dynamic Grids”