1 Authorization for Metacomputing Applications G. Gheorghiu, T. Ryutov and B. C. Neuman University of Southern California Information Sciences Institute July, 1998

2 Outline of Presentation u The Prospero Resource Manager (PRM) u Motivation u Overall security model - Extended Access Control List framework - Generic Authorization and Access control API u Applying the model to PRM u Status u Summary

3 The Prospero Resource Manager (PRM) u The System Manager (SM) - allocates resources to jobs u The Job Manager (JM) - requests necessary resources u The Node Manager (NM) - loads and executes tasks

4 Running a job with PRM JM JM requests resources 2. SM allocates resources to the JM, notifies the NMs 3. SM informs the JM of the assigned resources 4. JM requests task initiation 5. NMs create tasks SM NM % appl

5 Motivation u Need for user Authentication u Security policies: - authorized principals - type of granted access - restrictions on granted access and resources u Customization of the policies u Enforcement of the policies Domain ADomain B Request to load an application Security Policy Data Base

6 EACL framework EACL for host kot.isi.edu Prospero Directory Service Principals Access Rights Conditions EACL entry Default EACL for domain isi.edu...

7 EACL Management u Goal: enable easy sharing of a default authorization policy among NMs while allowing customization at host level u The Prospero Directory Service API is used to create virtual links to the EACL files and to specify attributes for the links u Example of attributes for the default EACL file: –SYSTEM_MANAGER darkstar.isi.edu –EACL_DEFAULT True u Example of attributes for a local EACL file: –NODE_MANAGER kot.isi.edu –EXTEND_DEFAULT Append

8 EACL entry structure : Principals TYPE SECURITY MECHANISM ID USER Kerberos.V5 HOST IPaddress APPLICATION Checksum 0x75AA31 GROUP DCE 8 ANYBODY

9 EACL entry structure: Access Rights user-level representation tag value HOST load HOST status DEVICE power_up DEVICE power_down

10 EACL entry structure: Conditions TYPE VALUE location DNS_* _island.com time_window 8AM-6PM time_day Monday-Friday payment $20 CPU_load 30 application_name matlab PRM- SPECIFIC GENERIC

11 Generic Authorization and Access control API (GAA API) Object EACL handle Reference to object Upcall function for EACL retrieval... gaa_check_authorization GAA API Security Context [ operations for authorization ]... gaa_get_object_eacl YES / NO / MAYBE [ list of authorized operations and corresponding conditions, if any ]...

12 GAA API Security Context u Identity u Authorization Attributes u Delegated credentials u Evaluation and Retrieval functions for Upcalls

13 Using the GAA API in PRM gaa_get_object_eacl gaa_check_authorization GAA API SM EACL... GAA API security context 5 5a Kerberos Library a 6 6a 6b (1, 2, 3, 4, 4a) request and verification of principal’s identity (5, 5a) call to gaa_get_object_eacl, retrieval of appropriate EACL (6, 6a, 6b) call to gaa_check_authorization Transport Mechanism

14 EACL Evaluation This is Joe, load matlab, on the host kot.isi.edu GROUP kerberos.v5 * USER kerberos.v5 ISI.EDU load time_w: 6AM-8PM cpu_load : 20 Joe 10:07AM host kot.isi.edu Identity: USER kerberos.v5 ISI.EDU Functions for upcall: GAA API security context EACL associated with the host kot.isi.edu REQUEST PRINCIPALS OPERATIONS CONDITIONS

15 Status u Current Prototype The prototype is used within our current PRM testbed to check user authorization based on the policies in the EACL file. - implemented PRM-specific conditions: time window, idle time and CPU load - only the default policy per domain is used u IETF drafts - draft-ietf-cat-acc-cntrl-frmw-00.txt - draft-ietf-cat-gaa-cbind-00.txt u Future work - implementing the local EACL policy mechanism - other PRM-specific conditions - refining the EACL evaluation algorithm - requesting additional credentials and evaluation of acquired ones

16 Summary u Flexible and configurable security policy u Integration of local and distributed policies u Fine-grained access control u Facilitation of authorization decisions u Contact authors at {grig, bcn,