E-science grid facility for Europe and Latin America Using Secure Storage Service inside the EELA-2 Infrastructure Diego Scardaci INFN (Italy) EELA-2 Second Conference Choroni, Venezuela,

Choroni (Venezuela), EELA-2 Conference, The Secure Storage Service for the gLite Middleware; Deployment in the EELA-2 Infrastructure; Use Secure Storage in the EELA-2 Infrastructure; The E2GRIS2 experience. Outline

Choroni (Venezuela), EELA-2 Conference, Provides gLite users with suitable and simple tools to store confidential data in storage elements in a transparent and secure way. The service is composed by the following components: Command Line Applications: commands integrated in the gLite User Interface to encrypt/upload and decrypt/ download files. Application Program Interface: allows the developer to write programs able to manage confidential data. Keystore: a new grid element used to store and retrieve the users’ keys. It is identified by an host X.509 digital certificate and all its Grid transactions are mutually authenticated and encrypted according to GSI model. The Secure Storage service

Choroni (Venezuela), EELA-2 Conference, lcg-scr: Encryption and Storage GSI AUTHENTICATED CHANNEL OWNER DN DN1 DN2 FQAN1 FQAN2 … ACL Access authorized to: DN1, DN2, FQAN1, FQAN2, … A FQAN AUTHORIZED TO ACCESS THE FILE CAN REPRESENT A WHOLE VO OR A VO GROUP ETC.

Choroni (Venezuela), EELA-2 Conference, lcg-scp: Retrieval and Decryption OWNER DN DN1 DN2 FQAN1 FQAN2 … ACL THE KEYSTORE PROVIDES USERS WITH THE KEY ONLY IF USER’S DN OR ONE OF THE VOMS ATTRIBUTES INCLUDED IN HIS PROXY MATCHES ONE ENTRY OF THE ACL GSI AUTHENTICATED CHANNEL

Choroni (Venezuela), EELA-2 Conference, Deployment in the EELA-2 infrastructure The deployment of the Secure Storage service consists on the setup of one or more keystores in the infrastructure and the installation of the client library on the infrastructure resource centres; We installed an instance of the keystore in the INFN Catania resource centre (securestorage-01.ct.infn.it) and the client library in several other EELA-2 nodes. The Secure Storage client library has been deployed in the infrastructure using a special installation job. This job has been designed to copy the Secure Storage software in a special folder of the Computing Element (CE) of the resource centre selected to support the service (VO_PROD_VO_EU_EELA_EU_SW_DIR, shared by all the site WNs). Computing ElementLocation ce.eela.cesga.esSantiago De Compostela (Spain) gridgate.cs.tcd.ieDublin (Ireland) ce.labmc.inf.utfsm.clValparaiso (Chile) ce01.eela.if.ufrj.brRio De Janeiro (Brazil) ce01.macc.unican.esSantander (Spain) ce-eela.ciemat.esMadrid (Spain)

Choroni (Venezuela), EELA-2 Conference, Integrate Secure Storage in a EELA-2 application Set the following environment variables in the UI or in the WN: SS_GRID_KEYSTORE_HOST= :25406 SS_GRID_KEYSTORE_DN= In the main script of the application, set the following environment variables to be able to use Secure Storage in a WN: PATH=${VO_PROD_VO_EU_EELA_EU_SW_DIR}/securestorage- client/bin/:${PATH} LD_LIBRARY_PATH=${VO_PROD_VO_EU_EELA_EU_SW_DIR}/securestorage- client/lib/:${LD_LIBRARY_PATH} [ Type = "Job"; JobType = "Normal"; Executable = "/bin/sh"; Arguments = "MySSApplication.sh"; StdOutput = "MySSApplication.out"; StdError = "MySSApplication.err"; InputSandbox = {“MySSApplication.sh”,…}; OutputSandbox = {"MySSApplication.err"," MySSApplication.out"}; ] MY JOB #!/bin/sh … export SS_GRID_KEYSTORE_HOST= :25406 export SS_GRID_KEYSTORE_DN= export LCG_CATALOG_TYPE=lfc export LFC_HOST=lfc.eela.ufrj.br export LCG_RFIO_TYPE=dpm export PATH=${VO_PROD_VO_EU_EELA_EU_SW_DIR}/securest orage-client/bin/:${PATH} export LD_LIBRARY_PATH=${VO_PROD_VO_EU_EELA_EU_SW_ DIR}/securestorage-client/lib/:${LD_LIBRARY_PATH} #run application

Choroni (Venezuela), EELA-2 Conference, An example of Secure Storage Job [ Type = "Job"; JobType = "Normal"; Executable = "/bin/sh"; Arguments = "./securestorage_test.sh"; StdOutput = "out-securestorage_test.out"; StdError = "err-securestorage_test.err"; InputSandbox = {"./securestorage_test.sh"}; OutputSandbox = {"text_file_copy_dec.txt","err- securestorage_test.err","out-securestorage_test.out"}; ] #!/bin/sh export SS_GRID_KEYSTORE_HOST=securestorage-01.ct.infn.it:25406 export SS_GRID_KEYSTORE_DN="/C=IT/O=INFN/OU=Host/L=Catania/CN=securestorage-01.ct.infn.it“ export LCG_CATALOG_TYPE=lfc export LFC_HOST=lfc.eela.ufrj.br export LCG_RFIO_TYPE=dpm export PATH=${VO_PROD_VO_EU_EELA_EU_SW_DIR}/securestorage-client/bin/:${PATH} export LD_LIBRARY_PATH=${VO_PROD_VO_EU_EELA_EU_SW_DIR}/securestorage- client/lib/:${LD_LIBRARY_PATH} echo "SECURE STORAGE TEST" > text_file_5.txt lcg-scr --vo prod.vo.eu-eela.eu -d lnx097.eela.if.ufrj.br --vo_permission /C=IT/O=INFN/OU=Personal\ Certificate/L=Catania/CN=Diego\ Scardaci -l lfn:/grid/prod.vo.eu-eela.eu/text_file_6.enc text_file_5.txt lcg-scp --vo prod.vo.eu-eela.eu lfn:/grid/prod.vo.eu-eela.eu/text_file_6.enc file:$PWD/text_file_copy_dec.txt echo "That's all folks!“ exit $? MY JOB MY SCRIPT

Choroni (Venezuela), EELA-2 Conference, Secure Storage - The E2GRIS2 experience Three applications adopted Secure Storage during the school: HeMoLab (LNCC - Brazil): the main concern of this application is the simulation of the Human Cardiovascular System. Segmentation techniques are used to obtain images of the blood vessels in which the flux will be simulated. It uses Secure Storage to upload input files from the gLite User Interface to a Storage Element and to download the input files from the Storage Element to the Worker Node running the application to preserve the data confidentiality. Seismic Sensor (UNAM – Mexico): manage different signals coming from several institutions that operate networks for seismic observation in Mexico. Application developers decided to adopt Secure Storage to preserve the confidentiality of the “continuous seismic signals and events”. All the file operations are managed using the secure storage command to upload, download and delete file to/from/in storage elements. AeroVANT (UNRC – Argentina): this application allows the simulation of nonlinear and unsteady behavior of joined wings, high altitude, long endurance unmanned aerial vehicles. All application output files are saved on a Storage Elements using Secure Storage to preserve the confidentiality of the results.

Choroni (Venezuela), EELA-2 Conference, Any questions ?