Virtual Workspaces Kate Keahey Argonne National Laboratory

Security Workshop, GGF 12Kate Keahey Why do we need virtual workspaces? l Need a way to configure remote nodes effortlessly, dynamically, flexibly l Need to be able to enforce positive and negative resource usage

Security Workshop, GGF 12Kate Keahey Virtual Workspaces Virtual resource configuration Protection environment Software and file configuration state Execution state Virtual Workspace Grid Middleware Interface Grid client Interface Grid clients Grid middleware interface l Define interfaces and explore a variety of implementations l Virtual machines are a particularly promising technology

Security Workshop, GGF 12Kate Keahey Architecture Client request VW EPR inspect and manage deploy & suspend use existing VW Create VW VW Factory VW Repository VW Manager create new VW Resource VW start program Implemented based on Globus, tested with bioinformatics applications Tim Freeman, Daniel Galron, SC04 poster

Security Workshop, GGF 12Kate Keahey VMs as VWs: the good l Configurability u Allow full stack customization: choose OS, 32 on 64-bit, libraries… l Enhanced security u Primarily better isolation, but also audit forensics, etc. l Managing state u Freezing computation allows migration, suspend and resume operations, etc. l State management/replication tool u Customize once and copy u Potential as distribution tool l Good enforcement potential

Security Workshop, GGF 12Kate Keahey VMs as VWs: the (not so) bad l Overhead from application perspective u Depends on application, VM implementation u In practice very promising l No access to specialized hardware u Simply needs more work l Resource usage overhead u Depends on implementation l Sharing issues and policies u How do we share between VMs l Software maturity

Security Workshop, GGF 12Kate Keahey Networking Issues (wormhole) l What network are the VMs on u Adding a machine to a remote network u Migration problem l Solution u Create a “virtual LAN” hosting the VMs u Redirect traffic to the actual location u Administered by a VO

Security Workshop, GGF 12Kate Keahey VMs and Security: the Good l Protecting users from users u As good as it gets l Protecting resource from a VM u Strong sandboxing u potential for policy-driven resource consumption enforcement l Protecting VM from the resource u Trusted computing: root secure trusted VMMs and attestation: even platform owner cannot break privacy and isolation guarantees u Needs help from hardware u Pretty close to as good as it gets

Security Workshop, GGF 12Kate Keahey VMs and Security: the Challenging l Protecting the VM from the world u VMs are only as secure as the software they run u Who maintains all those VMs? Local administrators would have to maintain too many images… l Protecting the world from the VM u Issue 1: one could use one’s privileges as root on a VM (for example to generate harmful network traffic) u Issue 2: no control over software running on VM means potential vulnerabilities could be exploited (also see above) u Although audit works great by the time the damage is done and it is too late!

Security Workshop, GGF 12Kate Keahey Potential Solutions l VO could do VM certification u Maintenance by the VO makes more sense u Does a VO have enough of a stake in this process? l Ultimately it is the platform owner who is to blame… l Detect when something goes wrong u Hard: traffic of a parallel application can look surprisingly like a denial of service attack! u IDS isolated from the VM: loss of privacy to the user u VO administrator (as well as resource owner) should have the right to stop a suspicious VM l Restricting network traffic u For example: traffic allowed only to VO-owned nodes u Is questionable because the idea is to limit “them”, not us

Security Workshop, GGF 12Kate Keahey Grid Security with VMs l How does a VM authenticate itself? u Can’t put a private key anywhere on the image l Can be compromised l Part of the platform? u Signed and re-signed by a trusted source? l How can we integrate attestation into Grid computing seamlessly? u We need to allow for a mix of technologies

Security Workshop, GGF 12Kate Keahey Conclusions l We need virtual workspaces for Grid computing u Although we need to be able to rely on a mix of technologies VMs are a particularly promising technology to use in Grid computing for security reasons and otherwise l A growing role for the VO u VO might take on additional responsibilities l Administers and maintains VMs, certification authority, could potentially stop suspect VMs, is to blame if something happens… l Should the VO be a legal entity? u Would all this be healthy for a VO? l Do VOs have the resources to do that? u What are the trade-offs and a healthy balance? l Mechanisms for secure, efficient sharing between VOs u Via Grid tools? l Holy Grail u Can we use these new capabilities for Grid computing? Do we need the increased trust?