Thailand National Grid Project Putchong Uthayopas 1 and Vara Varavithya 2 1 Director High Performance Computing and Networking Center Kasetsart University, Bangkok, Thailand 2 Department of Electrical Engineering Faculty of Engineering King Mongkuts Institute of Technology North Bangkok

TNGP, Thai Grid Current Status Currently in Operation Delivered Grid Monitoring and Management Tools to Communities Government Approve approx. 6M US$ funding the project for 3 years Supports Certification Technical Grid Technology Promotions

TNGP, Agenda Thailand National Grid Project ThaiGrid Status Update Current Development in ThaiGrid

TNGP, TNGP Objectives Promote the use of Grid Technologies Excellence in Grid Technology Human Resource Development Provide Grid Infrastructure Computing Infrastructure Communication Structure Help Establishing Standard and Practices House the ThaiGrid Office

TNGP, National Grid Committee Business Structure Ministry of ICT Grid Technology Excellence Center SIPA Research Institutions Grid Users Gov. Agencies Com Sci. Eng. People Academic Institutions Researchers

TNGP, Computing Infrastructure Tera Flops Machine Satellite Clusters 32-proc. Machine Satellite Clusters 32-proc. Machine Satellite Clusters 32-proc. Machine Satellite Clusters 32-proc. Machine 16 Satellite Sites High Speed Network

TNGP, Participated Organizations KU, CU, KMITNB, KMUTT, KMITL, Mahidol, KKU, SUT, WU, AIT Weather Forecast Services NECTEC

TNGP, Human Resource Housing Dozen of Grid Engineers and Scientists at the excellence center Systematically trains Grid Admins via series of tutorials and workshops Target 2,000 in three years

TNGP, Applications Health Care Data Grid High Performance Computing Applications Drug Design CFD FEM Evolutionary Computing Financial Application Based on Participated Inst. Expertise

TNGP, Targeted Outcomes Robust Grid Enable High Performance Computing Infrastructure A set, 3-4, of Grid Applications Show Cases Social impact to Thais well being Supports sciences and technology 2,000 HR Development Grid Technology Promotion

TNGP, ThaiGrid Project Found Jan 2002 Build up a long term research partnership to explore The construction of Grid testbed and production environment The building of Grid tools and middleware. The deployment of grid technology to support the mission of scientific discovery The development of Grid application

TNGP, ThaiGrid Overall Status 10 Clusters total AMATA – KU GASS – KU MAEKA – KU WARINE – KU CAMETA – SUT OPTIMA - AIT ENQUEUE – KMITNB PALM – KMITNB SPIRIT – CU INCA - KMUTT 110 Hosts (From SCMS) 158 CPUs (From SCMS)

TNGP, ThaiGrid Status Map

TNGP, Software ROCKS (Shasta) with HPC Roll Grid Roll SCE Roll Scheduler Roll Globus Toolkits 2.4 SCMSWeb Monitoring Tool Shared Certificate Authority

TNGP, ThaiGrid Tools TGCheckPort – Checking the firewall between sites TGregister – Grid user management and automatically updated grid- mapfile system

TNGP, TGregister

TNGP, Application Drug Design ThaiGrid Drug Design Portal HIV Drug Design Avian Flu Drug Design

TNGP, Drug Design

TNGP,

Proxy Certificate Delegation X.509 SSL Multi-Level User Implementation on X.509 ThaiGrid User Services Two core concepts: X.509 digital certificates used as identity credentials Proxy Certificate used to delegate identity temporarily to other credentials

Grid Security : Security VO manage Management of VO - Discover VO by Grid participants - Authentication and authorization of participants to join VO - Access control: Participants access shared resources in VO The problem of VO security - Large number of distributed resources - Dynamic and complex relationships among organizations across trust domains - Resource utilization scenarios are complex and changing dynamically

Large and dynamic population Different accounts at different sites Personal and confidential data Heterogeneous privileges (roles) Desire Single Sign-OnUsers Sites Heterogeneous Resources Access Patterns Local policies Membership Group data Access Patterns MembershipGroups Grid Security: VOs Role Grid

Grid Security : Authorization management Community Authorization Service user CA CAS Server Mutual authentication and access resource Request proxy to CAS server Reply restriced proxy to user Delegation restriced proxy from CAS CAS concept: Reduce trust relationship by - Group user to community - Resource authorized community - Community authorized user - Constrain in proxy certificate But CAS cannot support authorization in small communities in VO and support only GridFTP

Grid Security: Small Communities in VO Component of small communities in VO Static users for assign authoritative Temporarily users accept authoritative from static users Users operation same jobs in small communities in VO Multi-level authoritative from user to user Requirement of small communities in VO Mechanism for direct assign authoritative multi-level user management

Authoritative credentials High-level user Low-level user Proxy generator with privilege authoritative Authoritative privilege generator Gatekeeper Check permit for authorization Grid mapfile Run jobs Cannot run jobs GRID RESOURCE Multi-Level assign authoritative architecture Generate assign authoritative Request proxy with privilege authoritative allowdeny Authentication & authorization with proxy privilege authoritative

Multi-Level assign authoritative Concept Use Attribute Certificate concept for assign privilege authoritative Embed Attribute Certificate into X.509 Certificate Subject:O=Grid, O=ThaiGrid, OU=ee.kmitnb.ac.th, CN=suriya Issuer: C=TH, O=Grid, O=ThaiGrid, CN=ThaiGrid CA Expiration date: Aug 22 08:08: GMTSerial number: 625 (0x271) CA Digital signature Attribute Certificate : Issuer : O=Grid, O=ThaiGrid, OU=ee.kmitnb.ac.th, CN=suriya Holder : O=Grid, O=ThaiGrid, OU=ee.kmitnb.ac.th, CN=gridstaff Validity date : Jan 22 08:08: GMTSerial extension : sun.ee.kmitnb.ac.th/allow Issuer Signature : MD5RSAEncryption Public Key Concept :

Transfer multi-level assign authoritative Attribute Certificate: Issuer : user A Holder : user B,C,..X Privilege :host/allow/deny Validity : :18:45 Signature: user A Proxy Certificate with AC Identity : user B Public Key : user B Validity : :18:45 Signature: CA Assign authoritative from user A User B proxy-init with AC User B CA User X Resource User A User A is authoritative privilege User B can access Step access same user B Assign authoritative to user B to user X

Current Development Build tool support multi-level assign authoritative user management for small communities in VO Modify Proxy Certificate by embedded Attribute Certificate for access rights

TNGP, Conclusion The Start of Thailand National Grid Project ThaiGrid Operation has been in operation and strong. Several applications, middleware development Lots more to come in human resource development to foster grid efforts