WP4 Security and AA(A) issues For WP4: David Groep

David Groep – WP4 security and AAA issues – WP4 self-organization (1) u Configuration management n What should a system look like, what is installed u Systems Installation n Bootstrapping and installing software packages on nodes u Resource Management n Queuing system, task scheduling, quotas ’n budget

David Groep – WP4 security and AAA issues – WP4 self-organization (2) u Monitoring n Performance and functional monitoring u Fault Tolerance & Exception Recovery n Detect exceptions using monitoring information and schedule recovery actions, make self-healing nodes u Gridification n Job authorization, credential mapping, information abstraction and network accessibility

David Groep – WP4 security and AAA issues – Internal and external AAA u External AAA: interaction of a compute centre with “global” grid → through WP1 (ComputeElement) and WP2 (StorageElement) u Internal AAA: n recognizing trusted components and operators n authorization for jobs and files n access to information services n Protecting jobs and files whilst in the fabric (uid issues)

David Groep – WP4 security and AAA issues – A use case for job submission u Accept a job from ComputeElement (the Grid) u Check authorization w.r.t. extra local policies u Assign necessary local credentials u Have the job run on the local fabric

David Groep – WP4 security and AAA issues – Gridification of a Compute Centre ComputeElmt GridJob Mediating Serv LRMS Farms Local Credential Mapping Serv User Rep. Job Rep. LCAS AuthZ plugins: QuotaCheck Policy list Fabric-local ID-service Local to the fabric Externally visible Grid Info Serv (WP3) GriFIS GridGATE protocol gateway

David Groep – WP4 security and AAA issues – Job life cycle in a fabric u GjMS – Grid-job Mediating Service n Accept jobs from ComputeElement and shuffle them through the AAA chain u LCAS – Local Community Authorization Service n Authorize a job or store request to run on this fabric n Based on community-wide CAS (VO’s) add extra constrains like: budgets, ban lists, wall clock limitations u LCMAPS – Local Credential Mapping Service n Obtain the `usual’ credentials for running (uid/gid) n Issues: additional credentials for AFS, K5, ….

David Groep – WP4 security and AAA issues – Gridification of a Compute Centre Grid Info Serv (WP3) GriFIS ComputeElmt GridJob Mediating Serv Fabric-local ID-service Local Credential Mapping Serv LRMS Farms LCAS AuthZ plugins: QuotaCheck Policy list User Rep. Job Rep. Local to the fabric Externally visible GridGATE protocol gateway

David Groep – WP4 security and AAA issues – FLIDS (Fabric-local ID service) u within a fabric only a local certifying entity will be sufficiently trusted n Signing authority for LCAS accepted (job) requests n Identify trusted operators for installation of new systems n Identify and certify hosts within a fabric u FLIDS is (a tree of) certification authorities u Some of those “automated” CA ’s n Sign certificates when request is singed by trusted operator

David Groep – WP4 security and AAA issues – Information and Configuration u A configuration database exists containing the desired state of the local fabric n Contains sensitive information n Prevent unauthorized read access n Prevent snooping information sent to other hosts n PM9 (and possibly beyond?): web-server XML over HTTPS n Write access limited to special operator interface only

David Groep – WP4 security and AAA issues – Another FLIDS application u Adding a new host to a fabric u Possibly in a `hostile’ environment u We have a trusted operator with an install disk u Need to get initial configuration information u Which includes,e.g., a ssh host key Next slide is for your reference only (don’t be baffled by it)

David Groep – WP4 security and AAA issues – New host to be installed CFG Configuration Database Secured http server LCA root cert Operator install disk: -kernel and init -CFG https agent -Signed cert of operator -Protected private key of operator -LCA root certificate CFG data ACLs LCA cert and privkey FLIDS engine Automated CA, Will sign when request Approved by `operator’ 1:Operator boots system 2:agent makes https request using operator credentials 3:https server checks CFG data ACL (operator has all rights), can verify ID of operator using LCA root cert 4: sens config data encrypted using session key 5: host generates key pair (but without a passphrase to protecting private part) 6: request sent to FLIDS engine, signed by operator key (in cleartext) (FLIDS hostname known from CFG data) 7: FLIDS checks signature of operator, and signs request with LCA key. Request DN namespace limited. 8: signed host cert back to host (in clear) 9: host checks signature on cert using the LCA root cert on the boot disk 10: https requests to CFG authenticated with new signed host certificate 11: CFG web server can check hostname in cert against requesting IP address and check ACLs

David Groep – WP4 security and AAA issues – Issues not (yet) addressed u Information services n Use whatever security framework WP3 chooses n Will likely not publish list of authorized users u Networking issues n WP4 does not envision using network-layer security n IPv6 is being studied, but only for address space issues n GridGATE is not a VPN router and is not doing IPsec

David Groep – WP4 security and AAA issues – Gridification of a Compute Centre Grid Info Serv (WP3) GriFIS ComputeElmt GridJob Mediating Serv Fabric-local ID-service Local Credential Mapping Serv LRMS Farms LCAS AuthZ plugins: QuotaCheck Policy list User Rep. Job Rep. Local to the fabric Externally visible GridGATE protocol gateway