Ákos FROHNER – DataGrid Security - 2002-05-17 - n° 1 Security Group D7.6 Design Ideas

Slides:

Advertisements

Similar presentations

1 WP2: Data Management Paul Millar eScience All Hands Meeting September

Advertisements

DataGrid is a project funded by the European Union CHEP 2003 – March 2003 – Grid-based access control – n° 1 Grid-based access control for Unix environments,

5-Dec-02D.P.Kelsey, GridPP Security1 GridPP Security UK Security Workshop 5-6 Dec 2002, NeSC David Kelsey CLRC/RAL, UK

Data Management Expert Panel - WP2. WP2 Overview.

Policy Based Dynamic Negotiation for Grid Services Authorization Infolunch, L3S Research Center Hannover, 29 th Jun Ionut Constandache Daniel Olmedilla.

Andrew McNab - Manchester HEP - 2 May 2002 Testbed and Authorisation EU DataGrid Testbed 1 Job Lifecycle Software releases Authorisation at your site Grid/Web.

OSG AuthZ Architecture AuthZ Components Legend VO Management Services Grid Site GUMS Site Services SAZ CE Gatekeeper Prima Is Auth? Yes / No SE SRM gPlazma.

Andrew McNab - EDG Access Control - 14 Jan 2003 EU DataGrid security with GSI and Globus Andrew McNab University of Manchester

Grid Security. Typical Grid Scenario Users Resources.

E-science grid facility for Europe and Latin America A Data Access Policy based on VOMS attributes in the Secure Storage Service Diego Scardaci.

The Community Authorisation Service – CAS Dr Steven Newhouse Technical Director London e-Science Centre Department of Computing, Imperial College London.

5-Sep-02D.P.Kelsey, Security Summary, Budapest1 WP6/7 Security Summary Budapest 5 Sep 2002 David Kelsey CLRC/RAL, UK

DGC Paris Community Authorization Service (CAS) and EDG Presentation by the Globus CAS team & Peter Kunszt, WP2.

Open Science Grid Use of PKI: Wishing it was easy A brief and incomplete introduction. Doug Olson, LBNL PKI Workshop, NIST 5 April 2006.

Copyright B. Wilkinson, This material is the property of Professor Barry Wilkinson (UNC-Charlotte) and is for the sole and exclusive use of the students.

Security Mechanisms The European DataGrid Project Team

Active Directory Administration Lesson 5. Skills Matrix Technology SkillObjective DomainObjective # Creating Users, Computers, and Groups Automate creation.

OSG End User Tools Overview OSG Grid school – March 19, 2009 Marco Mambelli - University of Chicago A brief summary about the system.

Chapter 7: WORKING WITH GROUPS

Configuring and Troubleshooting Identity and Access Solutions with Windows Server® 2008 Active Directory®

Ákos FROHNER – DataGrid Security Requirements n° 1 Security Group D7.5 Document and Open Issues

Grid Security 1. Grid security is a crucial component Need for secure communication between grid elements  Authenticated ( verify entities are who they.

© Wiley Inc All Rights Reserved. MCSE: Windows Server 2003 Active Directory Planning, Implementation, and Maintenance Study Guide, Second Edition.

National Computational Science National Center for Supercomputing Applications National Computational Science NCSA-IPG Collaboration Projects Overview.

E-science grid facility for Europe and Latin America E2GRIS1 Raúl Priego Martínez – CETA-CIEMAT (Spain)‏ Itacuruça (Brazil), 2-15 November.

Military Technical Academy Bucharest, 2004 GETTING ACCESS TO THE GRID Authentication, Authorization and Delegation ADINA RIPOSAN Applied Information Technology.

Planning a Microsoft Windows 2000 Administrative Structure Designing default administrative group membership Designing custom administrative groups local.

Author - Title- Date - n° 1 Partner Logo EU DataGrid, Work Package 5 The Storage Element.

Author - Title- Date - n° 1 Partner Logo WP5 Summary Paris John Gordon WP5 6th March 2002.

23-Oct-03D.P.Kelsey, LCG Security Update, HEPiX1 LCG Security Update HEPiX-HEPNT, TRIUMF, 23 October 2003 David Kelsey CCLRC/RAL, UK

EDG Security European DataGrid Project Security Coordination Group

June 24-25, 2008 Regional Grid Training, University of Belgrade, Serbia Introduction to gLite gLite Basic Services Antun Balaž SCL, Institute of Physics.

Security Mechanisms The European DataGrid Project Team

User Management: Authentication & Authorization on the NorduGrid Balázs Kónya, AndersWäänänen 3 rd NorduGrid Workshop, 23 May, 2002 Helsinki.

User VOMS Java C CA 2. certificate dn, ca, key 1. request 3. certificate 4. VOMS cred: VO, groups, roles, capabilities Authentication Certificate Authorities.

Legion - A Grid OS. Object Model Everything is object Core objects - processing resource– host object - stable storage - vault object - definition of.

VO management: Progress since Chicago Workshop Vincenzo Ciaschini 23/5/2002 CNAF – Bologna.

Authorisation, Authentication and Security Guy Warner NeSC Training Team Induction to Grid Computing and the EGEE Project, Vilnius,

Glite. Architecture Applications have access both to Higher-level Grid Services and to Foundation Grid Middleware Higher-Level Grid Services are supposed.

Key Management. Authentication Using Public-Key Cryptography  K A +, K B + : public keys Alice Bob K B + (A, R A ) 1 2 K A + (R A, R B,K A,B ) 3 K A,B.

DTI Mission – 29 June LCG Security Ian Neilson LCG Security Officer Grid Deployment Group CERN.

VO Box Issues Summary of concerns expressed following publication of Jeff’s slides Ian Bird GDB, Bologna, 12 Oct 2005 (not necessarily the opinion of)

1 AHM, 2–4 Sept 2003 e-Science Centre GRID Authorization Framework for CCLRC Data Portal Ananta Manandhar.

1 Grid School Module 4: Grid Security. 2 Typical Grid Scenario Users Resources.

WLCG Authentication & Authorisation LHCOPN/LHCONE Rome, 29 April 2014 David Kelsey STFC/RAL.

Ákos FROHNER – DataGrid Security n° 1 Security Group TODO

JSPG Update David Kelsey MWSG, Zurich 31 Mar 2009.

SESEC Storage Element (In)Security hepsysman, RAL 0-1 July 2009 Jens Jensen.

7-May-03D.P.Kelsey, LCG-GDB-Security1 LCG/GDB Security Issues and Planning or Report from the Security Group CERN, 8 May 2003 David Kelsey CCLRC/RAL, UK.

Enabling Grids for E-sciencE gLite security pratical tutorial Dario Russo INFN Catania Catania,

Security, Authentication and Authorization on Grid Computing 1st Chinese-French workshop on LHC Physics and Associated Grid Computing Beijing, December.

DataGrid Security Wrapup Linda Cornwall 4 th March 2004.

Storage Element Security Jens G Jensen, WP5 Barcelona, May 2003.

Overview of the New Security Model Akos Frohner (CERN) WP8 Meeting VI DataGRID Conference Barcelone, May 2003.

EGEE-II INFSO-RI Enabling Grids for E-sciencE Authentication, Authorisation and Security Mike Mineter, National e-Science Centre.

EGEE-II INFSO-RI Enabling Grids for E-sciencE Authentication, Authorisation and Security Emidio Giorgio INFN Catania.

Security Mechanisms The European DataGrid Project Team

(Exchange Programme to advance e-Infrastructure Know-How) The EPIKH Project Hailong Yang

Jean-Philippe Baud, IT-GD, CERN November 2007

AuthN and AuthZ in StoRM A short guide

Classic Storage Element

CRIC ・ Authentication & Authorization

R-GMA Security Principles and Plans

Update on EDG Security (VOMS)

Grid Security M. Jouvin / C. Loomis (LAL-Orsay)

The EU DataGrid Security Services

The EU DataGrid Security Services

Data services in gLite “s” gLite and LCG.

The GENIUS Security Services

Presentation transcript:

Ákos FROHNER – DataGrid Security n° 1 Security Group D7.6 Design Ideas

Ákos FROHNER – DataGrid Security n° 2 Mutual Authentication GSI – certificate based authentication u challenge = random data u key(data) = encoding with key u validation: decode(public key, encode(private key, data)) = data Short-time certificates! -> no CRL

Ákos FROHNER – DataGrid Security n° 3 Delegation u proxy certificate is generated on the server side u private key not crosses the net u rights of the proxy are subset of the original rights

Ákos FROHNER – DataGrid Security n° 4 Membership (dataflow) Authenticate a user at a service Gather additional information associated to the user or the actual session (e.g. group membership, role, time) Gather additional information associated to the protected service or object (e.g. file permissions) Get local policy applicable to the situation (e.g. temporarily disabled user) u Make an authorization information based on the identity and the additional information VO policy site policy file ACL VO membership, group, role read a file virtual organisation organisation

Ákos FROHNER – DataGrid Security n° 5 Membership (sequence)

Ákos FROHNER – DataGrid Security n° 6 Access Control List u user – list of capabilities u operation u protected object – access control list u (policy: pattern + ACL) -> yes/no decision capability: u DN u VO DN u group/role/... file ACL +cap.1:read +cap.2:write,read -cap.3:read … +cap.m:op1,op2 read user DN, VO cap.1 cap.2 … cap.n decision yes/no policy /cms/**:+cms:read *:-Bob:read,write,delete *.bak:+cleanup-role:delete

Ákos FROHNER – DataGrid Security n° 7 New File or Directory in an SE u the original owner (creator) is marked for accounting not user for authorization! u creator have admin (getacl, setacl) permissions u additional permissions from the enclosing object (default ACL), site and VO policy u delete is a file attribute u mark group/VO for accounting? File u creator: Alice u ACL n +Alice:getacl,setacl, read,write,delete Directory u creator:Alice u ACL n +Alice:getacl,setacl,create,list,delete u default ACL n dir:+Alice:getacl,setacl,create,list,delete n file:+Alice:getacl,setacl,read,write,delete

Ákos FROHNER – DataGrid Security n° 8 File Replication (sequence)

Ákos FROHNER – DataGrid Security n° 9 File Replication 1. SE.getACL(+Alice:read,write,admin) 2. RM.preRegister -> RM-role 3. SE.setACL(+Alice:read,write,admin; RM- role:admin) 4. Alice: RM.register 5. RM: MC.register 6. SE.getACL, MC.setACL (+Alice:read,write,admin; RM-role:admin) 7. SE.setACL(+Alice:read; RM-role:admin) RM MC user SE f1 SE 1. +Alice:read,write,admin Alice:read,write,admin 6.2. f1 * +Alice:read +RM-role:admin +Alice:read,write,admin +RM-role:admin 3. +Alice:read +RM-role:admin 7.

Ákos FROHNER – DataGrid Security n° 10 Normal File Access 1. RM.getBestFile(LFN) -> SE, FN 2. SE.read(FN) RM MC user SE f1 SE f1 +Alice:read +RM-role:admin +Alice:read +RM-role:admin 1. 2.

Ákos FROHNER – DataGrid Security n° 11 Medical Image Access 1. RM.getBestFile(LFN) -> SE, FN 2. RM.getAppMetaData -> restricted-cert, key 3. SE.read(FN, restricted-cert) 4. decode(key, FN) RM MC Alice SE f1 SE f1 +RM-role:admin,read 1., image patient +Alice:read key

Ákos FROHNER – DataGrid Security n° 12 RM-role 1. CAS.getMembership -> RM-role 2. CAS.getMembership -> RM-role 3. user 4. metadata catalog 5. storage element 6. file ACL entry RM-2 CAS RM-1 RM-role 1. RM-role 2. user 3. MC 4. SE 5. f1 +Alice:read +RM-role:admin f1 +Alice:read +RM-role:admin 6.

Ákos FROHNER – DataGrid Security n° 13 Administrator Roles Certificate Authorities CA it CA ch CA fr VO LHC RM RB CAS VO EDG RM RB CAS SE CE INFN SE CE CERN SE CE CNRS file job Virtual Organisation administrators u CAS admin u RM admin u RB admin Site administrators u SE admin u CE admin

Ákos FROHNER – DataGrid Security n° 14 Other issues u initial credential: userid/password (PAM), kx509,... u renewable, forwardable certificates u CAS: does more, then necessary u encoding of capabilities (structure vs. DN) u mapping CAS: composition of (Virtual) Organisations u mutual authorization: use only VO-role playing service u ACLs for jobs: monitor, stop, resume, kill u using multiple vs. single VO (multiple vs. one cas-certificate)...