DataGrid WP6/CA CA Trust Matrices Trinity College Dublin (TCD) Brian Coghlan CERN DEC-2002

DataGrid WP6/CA Matrix of Trust

CERN DEC-2002 DataGrid WP6/CA CA Feature Matrix

CERN DEC-2002 DataGrid WP6/CA CAs in Trust Matrices European EDG CERN CERN France France Italy Italy Netherlands Netherlands UK UK Czech Czech Hungary Hungary NorduGrid NorduGrid Spain Spain Russia Russia Portugal Portugal Ireland Ireland PPDG FusionGRID IVDGL NERSC PNNL ANL LBNL ORNL DOESG ESG North American added Jun’02: added Jun’02: DOE Science Grid DOE Science Grid European X# also in EDG: also in EDG: Portugal Portugal Spain Spain Netherlands Netherlands Italy Italy Ireland Ireland added Jun’02: added Jun’02: Germany Germany added Dec’02: added Dec’02: Poland Poland Greece Greece Slovakia Slovakia to be added: to be added: Cyprus Cyprus Austria ? Austria ?

CERN DEC-2002 DataGrid WP6/CA Autoevaluation little progress since Sep’02 little progress since Sep’02 Compiler works, but ruleset is restricted Compiler works, but ruleset is restricted extra manpower: extra manpower: David O’Callaghan David O’Callaghan next steps: next steps: port compiler port compiler create ruleset create ruleset

CERN DEC-2002 DataGrid WP6/CA Autoevaluation: current compiler

CERN DEC-2002 DataGrid WP6/CA Autoevaluation: current ruleset

CERN DEC-2002 DataGrid WP6/CA THE END Trust Matrices

CERN DEC-2002 DataGrid WP6/CA Matrix of trust How to establish the trust ? How to establish the trust ? CA Mgrs check each other against agreed list of minimum requirements CA Mgrs check each other against agreed list of minimum requirements currently require inspection of each CA’s CPS by each other CA currently require inspection of each CA’s CPS by each other CA software being developed to aid this process software being developed to aid this process CP/CPS important CP/CPS important audit of CA procedures will help audit of CA procedures will help none done yet none done yet use 3 rd party ? use 3 rd party ? GGF GridCP and CA-Operations WG’s considered important GGF GridCP and CA-Operations WG’s considered important

CERN DEC-2002 DataGrid WP6/CA Matrix of trust Scaling problems Scaling problems how many CA’s can we cope with [soon ~20] ? how many CA’s can we cope with [soon ~20] ? the process is very manual the process is very manual personal contacts are fundamental personal contacts are fundamental WANT TO MAKE EVALUATION MORE AUTOMATIC WANT TO MAKE EVALUATION MORE AUTOMATIC software being developed to aid this process software being developed to aid this process based on evaluation of the CA Feature Matrix based on evaluation of the CA Feature Matrix

CERN DEC-2002 DataGrid WP6/CA Basic Concepts Issues: Issues: postulate:(condition)  (issue) postulate:(condition)  (issue) e.g. (BasicConstraints_value ne ‘CA’)  (major issue) e.g. (BasicConstraints_value ne ‘CA’)  (major issue) Grading: Grading: i.e. assign an issue a weight i.e. assign an issue a weight Constraint: Constraint: issues of a certain class should be constrained to that class issues of a certain class should be constrained to that class e.g. many minor issues do not make a major issue e.g. many minor issues do not make a major issue Aggregation: Aggregation: aggregate graded issues in a measure of ‘severity’ aggregate graded issues in a measure of ‘severity’ e.g. major) =  (graded major issues)  limit=1.0 e.g. major) =  (graded major issues)  limit=1.0

CERN DEC-2002 DataGrid WP6/CA Currently [JUL-2002] per class: class) =  (graded class issues)  limit=1.0 per class: class) =  (graded class issues)  limit=1.0 max_severity: (severity) for most critical class with issues max_severity: (severity) for most critical class with issues postulate: acceptance_level = T acceptance – (max_severity) postulate: acceptance_level = T acceptance – (max_severity) where:T acceptance == (worst-case max_severity) where:T acceptance == (worst-case max_severity) e.g, assume: T acceptance = 3.0 e.g, assume: T acceptance = 3.0 therefore:max_severity = [ ] therefore:max_severity = [ ] and:acceptance_level = [ ] and:acceptance_level = [ ] This is the WORKING BASIS for manual evaluation This is the WORKING BASIS for manual evaluation

CERN DEC-2002 DataGrid WP6/CA Auto-evaluation move to extract issues automatically move to extract issues automatically from what ? from what ? initially from Feature Matrix initially from Feature Matrix later from CA certs & CRLs ? later from CA certs & CRLs ?

CERN DEC-2002 DataGrid WP6/CA Extraction from Feature Matrix since: (condition)  (graded issue) since: (condition)  (graded issue) then must define condition per feature  {rules} then must define condition per feature  {rules} e.g.: (name eq ‘NIL’)  (graded issue) e.g.: (name eq ‘NIL’)  (graded issue) thus:if (name eq ‘NIL’) (graded issue) == class) thus:if (name eq ‘NIL’) (graded issue) == class) per class:(severity) ==  (graded issues)  limit=1.0 per class:(severity) ==  (graded issues)  limit=1.0 EDG can define its common rule set EDG can define its common rule set each CA could define its own overrides to the rule set each CA could define its own overrides to the rule set ultimately each VO could define its own rule set ultimately each VO could define its own rule set