Computing Research Center, High Energy Accelerator Organization (KEK) KEK Grid CA Go Iwai The 2 nd APGrid PMA Meeting at Osaka Univ.

2006/10/15The 2nd APGrid PMA Meeting Meeting at Osaka Univ.2 KEK Organization and History High Energy Accelerator Research Organization (KEK)High Energy Accelerator Research Organization (KEK) –Institute of Particle and Nuclear Studies –Institute of Materials Structure Science –Accelerator Laboratory –Applied Research Laboratory Computing Research CenterComputing Research Center Radiation Science CenterRadiation Science Center Cryogenics Science CenterCryogenics Science Center Mechanical engineering CenterMechanical engineering Center HistoryHistory –National Laboratory for High Energy Physics (1971) –High Energy Accelerator Research Organization (1997) Combined with Institute for Nuclear StudyCombined with Institute for Nuclear Study –High Energy Accelerator Research Organization reformed as an Inter-University Research Institute Corporation (2004)reformed as an Inter-University Research Institute Corporation (2004)

2006/10/15The 2nd APGrid PMA Meeting Meeting at Osaka Univ.3 KEK: High Energy Accelerator Organization J-PARC B Factory Photon Factory LC-Test Facility Tokyo Tsukuba Tokai ~60km PacificOcean

2006/10/15The 2nd APGrid PMA Meeting Meeting at Osaka Univ.4 Issued Certificates Host certificatesHost certificates –73 certificates were issued User certificatesUser certificates –26 certificates were issued SSL Server certificatesSSL Server certificates –1 certificate was issued –only for ICEPP (Univ. of Tokyo) and KEK

2006/10/15The 2nd APGrid PMA Meeting Meeting at Osaka Univ.5Experiences / field was troublesome and not available any more/ field was troublesome and not available any more –LCG was OK –SRB-DSI does not work for any certificates including the field Power outage because of the regular inspection of facilities requested by the governmentPower outage because of the regular inspection of facilities requested by the government –Power backup by the generator was done with big efforts –We may stop the operation of CA for 3days in the next year Securing private keys are essential for PKI operationsSecuring private keys are essential for PKI operations –However, sometimes users copy their’s to remote sites via network and store on distributed storage systems, even on NFS servers. –Education is very important for users Regular training should be consideredRegular training should be considered

2006/10/15The 2nd APGrid PMA Meeting Meeting at Osaka Univ.6Plan Change on CP/CPSChange on CP/CPS –Currently, SSL server certificates are issued only for ICEPP and KEK, however, LCG needs the SSL server certificates at each LCG site C=JP, O=KEK, OU=CRC, CN=FQDNC=JP, O=KEK, OU=CRC, CN=FQDN SSL server certificates will be issued for each siteSSL server certificates will be issued for each site General usages are forbidden and only for usage with LCGGeneral usages are forbidden and only for usage with LCG –We assumed that applicants are existing users of KEK Computing research center Contractors in collaborating institutes cannot be a user of usContractors in collaborating institutes cannot be a user of us We will change CP/CPS to allow applications from themWe will change CP/CPS to allow applications from them –Existing users or the persons who are endorsed by the representative of the collaborating institute of KEK We will have the first audit within this year.We will have the first audit within this year. –Yoshio Tanaka will be an auditor Thank him for his effortsThank him for his efforts –November or December?

Computing Research Center, High Energy Accelerator Organization (KEK) End Any comment or suggestion?

Computing Research Center, High Energy Accelerator Organization (KEK) For backups

2006/10/15The 2nd APGrid PMA Meeting Meeting at Osaka Univ.9CP/CPS KEK GRID CA CP/CPSKEK GRID CA CP/CPS –Version: –OID: –Conforms RFC2527 –Strongly inspired by CP/CPS’ of NAREGI CA and AIST CA KEK GRID CP/CPS is managed by the KEK GRID PMA.KEK GRID CP/CPS is managed by the KEK GRID PMA. –Changes in contents need to be approved by the KEK GRID PMA, as described in section 8.

2006/10/15The 2nd APGrid PMA Meeting Meeting at Osaka Univ.10 End Entities Grid Users, Servers and Services:Grid Users, Servers and Services: –Members at KEK and it’s collaborating institutes –Computing Facility at KEK and it’s collaborating institutes

2006/10/15The 2nd APGrid PMA Meeting Meeting at Osaka Univ.11 Certificate Types User Certificate:User Certificate: –C=JP, O=KEK, OU=CRC, CN=Takashi Sasaki Globus Servers:Globus Servers: –host C=JP, O=KEK, OU=CRC, CN=host/FQDNC=JP, O=KEK, OU=CRC, CN=host/FQDN –Services C=JP, O=KEK, OU=CRC, CN=ldap/FQDNC=JP, O=KEK, OU=CRC, CN=ldap/FQDN Web Servers (only for LCG at KEK CRC and ICEPP, U. of Tokyo):Web Servers (only for LCG at KEK CRC and ICEPP, U. of Tokyo): –C=JP, O=KEK, OU=CRC, CN=FQDN

2006/10/15The 2nd APGrid PMA Meeting Meeting at Osaka Univ.12 Identification and Authentication Prerequisite:Prerequisite: –The person must be an existing user of KEK CRC One referee among KEK employees is requestedOne referee among KEK employees is requested Applicants must be a member of either of the projects at KEKApplicants must be a member of either of the projects at KEK User Certificate:User Certificate: –Subscriber must submit in-person or mail (or FAX) the application to the user administrator.submit in-person or mail (or FAX) the application to the user administrator. attach a copy of his/her personal identification document with a photo.attach a copy of his/her personal identification document with a photo. have an interview in-person or on the video conference by the user administratorhave an interview in-person or on the video conference by the user administrator –User administrator confirms the application with the representative’s signature on it Host and Service CertificateHost and Service Certificate – An application is required to be submitted by an existing certificate user

2006/10/15The 2nd APGrid PMA Meeting Meeting at Osaka Univ.13 Certificate Restrictions Certificate Lifetime:Certificate Lifetime: –5 years for KEK GRID CA certificate –1 year for each end entity certificate User and server certificates should not be shared.User and server certificates should not be shared.

2006/10/15The 2nd APGrid PMA Meeting Meeting at Osaka Univ.14 Certificate Revocation Certificates are to be revoked when …Certificates are to be revoked when … –the RA receives a revocation request from a user. –the user’s key has been compromised or is suspected of being compromised. –the user information on the certificate is suspected of being incorrect. –the user lost the status of KEK CRC user the user leaves the job or etc.the user leaves the job or etc. –the CA private key has been compromised. –a user violates his/her obligations as described in the CP/CPS Section as described in the CP/CPS Section

2006/10/15The 2nd APGrid PMA Meeting Meeting at Osaka Univ.15 Revocation Request Procedure Revocation Request from a userRevocation Request from a user – User can choose between two methods, as follows: Command-line UI and Web-based UI using encrypted communication between the user and the RA.Command-line UI and Web-based UI using encrypted communication between the user and the RA. –The RA confirms a revocation request by using the client certificate, and accepts it. –The RA sends a revocation request to the CA located in an independent network segment. Communications between the RA and the CA are encrypted. Communications between the RA and the CA are encrypted. The CA security officer can execute a revocation request on behalf of the user, if it is necessary.The CA security officer can execute a revocation request on behalf of the user, if it is necessary.

2006/10/15The 2nd APGrid PMA Meeting Meeting at Osaka Univ.16CRL The KEK GRID CA will …The KEK GRID CA will … –revoke the certificate immediately after receipt and acceptance of the revocation request. –publish the CRL on the KEK CA web site immediately. A relying party can verify a certificate by retrieving the newest CRL on the web site. A relying party can verify a certificate by retrieving the newest CRL on the web site. The issued CRL is valid for 30 days.The issued CRL is valid for 30 days. The CRL will be reissued at least seven days before the previous one expires.The CRL will be reissued at least seven days before the previous one expires.

2006/10/15The 2nd APGrid PMA Meeting Meeting at Osaka Univ.17 Physical Security CA Server :CA Server : –dedicated machine in a locked room The room is located in the secure building.The room is located in the secure building. only connected to the RA server via an exclusive network using a private address.only connected to the RA server via an exclusive network using a private address. CA server cannot be reached from the Internet.CA server cannot be reached from the Internet. CA private key :CA private key : –Protected by a FIPS Level 3 compliant HSM. –is copied in a backup device with passphrase in a key- locked shelf.

2006/10/15The 2nd APGrid PMA Meeting Meeting at Osaka Univ.18 Records Archival Types of Archive Data:Types of Archive Data: –All issued certificates and CRLs –All enrollment requests and notifications between the KEK GRID CA and users –Operation history of the CA key Events of Interest, as described in CP/CPS 4.5.1Events of Interest, as described in CP/CPS login, logout, reboot, access and error logs, etc…login, logout, reboot, access and error logs, etc… – Other documents about the KEK GRID CA. The retention period is 3 years. The retention period is 3 years. Archived files are preserved in a key-locked shelf. Archived files are preserved in a key-locked shelf.

2006/10/15The 2nd APGrid PMA Meeting Meeting at Osaka Univ.19 Key Pair The CA private key is generated by the HSM.The CA private key is generated by the HSM. A user’s key pair is generated on users’ PC by using a given license ID.A user’s key pair is generated on users’ PC by using a given license ID. –The user’s private key is not generated by the CA and the RA. Key Length:Key Length: –CA Certificate: 2048 bits –End Entity: 1024 bits License ID:License ID: – 24 characters –is provided from the RA for one-time authentication at the time of enrollment process of the user.