Policy-driven Negotiation for Authorization in the Grid 8 th IEEE POLICY Bologna, Italy, 15 th June 2007 Ionut ConstandacheDuke University Daniel OlmedillaL3S Research Center Frank SiebenListArgonne National Laboratory

Daniel Olmedilla June 15th, 20078th IEEE POLICY2 Outline Introduction Motivation Policy-driven Negotiations Negotiations in the Grid Implementation Conclusions and Further Work

Daniel Olmedilla June 15th, 20078th IEEE POLICY3 Introduction Virtual Organization Policy Org 1 Org 2 Org 3

Daniel Olmedilla June 15th, 20078th IEEE POLICY4 Introduction Why Grid Security is Hard? Resources being used may be valuable & the problems being solved sensitive Both users and resources need to be careful Dynamic formation and management of virtual organizations (VOs) Large, dynamic, unpredictable… VO Resources and users are often located in distinct administrative domains Can’t assume cross-organizational trust agreements Different mechanisms & credentials Interactions are not just client/server, but service-to-service on behalf of the user Requires delegation of rights by user to service Services may be dynamically instantiated

Daniel Olmedilla June 15th, 20078th IEEE POLICY5 Motivation Local Administrative Domain Ivan Mallory Alice Can I have glass of lemonade? Ivan’s policy: Alice is my friend and I ’ ll share my lemonade with her Mallory is not my friend and he can go #$%^& Sure, here is a glass Can I have glass of lemonade? No way, I don ’ t like you Resource Owner decides! (ultimate source of authority for access)

Daniel Olmedilla June 15th, 20078th IEEE POLICY6 Motivation Distinct Administrative Domains ? Ivan Ivan’s policy: Carol is my friend and I ’ ll share my lemonade with her I ’ ll share my lemonade with any friend of Carol I don ’ t know any Bob … (?) Can I have glass of lemonade? Bob

Daniel Olmedilla June 15th, 20078th IEEE POLICY7 Motivation Distinct Administrative Domains – Pull (I) Sure, here is a glass Can Bob have glass of lemonade? Sure, Bob is my friend Ivan Ivan’s policy: Carol is my friend and I ’ ll share my lemonade with her I ’ ll share my lemonade with any friend of Carol I don ’ t know any Bob … (?) Can I have glass of lemonade? Bob Carol Carol’s policy: Bob is my friend and I ’ ll share my lemonade with him

Daniel Olmedilla June 15th, 20078th IEEE POLICY8 Motivation Distinct Administrative Domains – Pull (& II) Can Bob have glass of lemonade? Sure, Bob is my friend Ivan Ivan’s policy: I don ’ t know any Bob … (?) I do know John, Mary, Carol, Olivia, … Can I have glass of lemonade? Bob Carol Carol’s policy: Bob is my friend and I ’ ll share my lemonade with him Olivia’s policy: If Carol likes Bob, I hate him! Mary’s policy: I like Bob a little bit Lucy’s policy: I sometimes like Carol Ann’s policy: I like Ivan very much! Jogger’s policy: I ’ d like a glass too John’s policy: I don ’ t like girls Bill’s policy: Lemonade is bad for you Frosty’s policy: Only share lemonade with ice Aunt’s policy: Sharing is good Laura’s policy: Share if he pays! David’s policy: Ask Laura Accountant’s policy: Only if he signs here Rita’s policy: No lemonade after eight Neighbor's policy: Let ’ s party! Emma’s policy: Only on his birthday Ivan: HELP Ivan

Daniel Olmedilla June 15th, 20078th IEEE POLICY9 Motivation Distinct Administrative Domains – Push approach Sure, here is a glass Ivan Ivan’s policy: Carol is my friend and I ’ ll share my lemonade with her I ’ ll share my lemonade with any friend of Carol I don ’ t know any Bob … (?) Can I have glass of lemonade? And BTW, Carol is my friend Bob either Bob provides a list of all his friends or  Privacy problems, superfluous disclosure Bob knows in advance the friends from Ivan  static  service instances to be used may be selected at run-time

Daniel Olmedilla June 15th, 20078th IEEE POLICY10 Motivation Example Scenario – Grid Limitations

Daniel Olmedilla June 15th, 20078th IEEE POLICY11 Policy-Driven Negotiations Example: Security & Privacy Step 1: Alice requests a service from Bob Step 5: Alice discloses her VISA card credential Step 4: Bob discloses his BBB credential Step 6: Bob grants access to the service Service BobAlice Step 2: Bob discloses his policy for the serviceStep 3: Alice discloses her policy for VISA

Daniel Olmedilla June 15th, 20078th IEEE POLICY12 Negotiations in the Grid Revisiting the example scenario With only one certificate to access the online repository The delegated certificate is used to retrieve the requested certificates Server informs the client about its access control policy

Daniel Olmedilla June 15th, 20078th IEEE POLICY13 Policy-Driven Negotiations Characteristics Both client and servers are semantically annotated with policies Annotations specify constraints and capabilities – access control requirements  which certificates must be presented to gain access to it  who is responsible for obtaining and presenting these certificates are used during a negotiation  to reason about and to communicate the requirements  to determine whether credentials can be obtained and revealed. User involvement is drastically reduced – automated interactions If required, for sensitive resources, negotiation can be longer To obtain (access to) a certificate, I must satisfy its access control policy, which specifies … --and so on, recursively—

Daniel Olmedilla June 15th, 20078th IEEE POLICY14 Implementation Current GT4’s new authZ framework

Daniel Olmedilla June 15th, 20078th IEEE POLICY15 Implementation Architecture Service wsdl file Service Deployment Descriptor

Daniel Olmedilla June 15th, 20078th IEEE POLICY16 Implementation Integration on Globus Toolkit 4.0 Directed integrated with the grid services paradigm Extension to GSI pluggable to any GT4.0 compliant grid service or client Only requirement: Java based grid services We use:  Custom PDP as part of the Client Call Interceptor -Redirects to a negotiation if required  Asynchronous negotiations are achieved through WS- Base Notification and WS-Topics CAS integration into negotiations API for easy integration within client code

Daniel Olmedilla June 15th, 20078th IEEE POLICY17 Conclusions & Future Work Conclusions Main Features Self-describing resources for access requirements  Based on properties Negotiation for service authorization Dynamic credential fetching  Now possible to use discovery and scheduling services to locate the best available resources  Otherwise, impossible to predict before hand what exact service instances would be used and which certificates required Monitoring and explanation of authorization decision Implementation in Java Extension of GSI in GT4.0 Backwards compatible

Daniel Olmedilla June 15th, 20078th IEEE POLICY18 Conclusions & Future Work Further Work Study performance impact of negotiations And approaches to minimize the extra load  Limit number of iterations -E.g. 2 steps negotiations  Advertise policies before the service is invoked Investigate the use of XACML  Delegation not yet supported but planned

Daniel Olmedilla June 15th, 20078th IEEE POLICY19 Questions? - Thanks!

Daniel Olmedilla June 15th, 20078th IEEE POLICY20 Implementation in GT4 Easy Integration with Current Grid Services Service - include one jar file containing the policy based trust negotiation engine - minor add-ons to the service wsdl file (import one wsdl file and extend one port type) and wsdd file (add one more provider and install a security descriptor) - have a resource (if not available) - re-deploy the service Client - use one jar file containing the policy based trust negotiation engine - invoke the service as usual / or call directly for a trust negotiation process - look for authorization exceptions and if one triggered by trust negotiation failure make simple calls to the negotiation engine

Daniel Olmedilla June 15th, 20078th IEEE POLICY21 Integration into Globus Toolkit 4.0 (I) Grid Service Descriptor Descriptors: - grid service descriptor (wsdl file): TrustNegotiation.wsdl - defines the data types and functions for exchanging trust negotiation messages The grid service should extend the NotificationProducer port type (used for asynchronous communication with the client) and the TrustNegotiation port type(used for exposing the functions used by the client to push proofs/requirements to the grid service).

Daniel Olmedilla June 15th, 20078th IEEE POLICY22 Integration into Globus Toolkit 4.0 (II) Grid Service Deployment Descriptor Descriptors: - grid service deployment descriptor (wsdd file): Rely on GT4.0 providers for notification usage and use a TrustNegotiationProvider implementing the logic for policy based dynamic negotiation Install a security descriptor specifying the use of a PDP for filtering client calls/managing authorization information.

Daniel Olmedilla June 15th, 20078th IEEE POLICY23 Integration into Globus Toolkit 4.0 (& III) Requirements Resource: - the grid service should use a resource implementing TopicListAccessor - a topic would be added by TrustNegotiationProvider for trust negotiation (using this topic the service pushes proofs/requirements on the client side)

Daniel Olmedilla June 15th, 20078th IEEE POLICY24 Client Service

Daniel Olmedilla June 15th, 20078th IEEE POLICY25 Client Factory Service Instance Service Resource Exposes a topic like TrustNegotiationTopic for asynchronous communication with the client. Notify the client when his requests are fulfilled or further requirements are imposed by the service 9. Notify the client about service policies and further requirements PDP specified in the Instance service descriptor that intercepts operation calls. It checks if operation invoked is authorized. Operations getNegotiationTopic() and trustNegotiate() are permitted by default and all the other operations are denied unless a trust negotiation process has succeeded. Have the instance service extend the standard port types Subscribe and GetMessage (used by notifications) and a port type which we provide TrustNegotiationProvider which is going to expose 2 operations getNegotiationTopic() and trustNegotiation(). Receive through them the client requests and proofs with regard to service authorization 5. Catch the exception 10. Operation executed on resource if the trust negotiation process was successful 3. Operation called on the resource 4. Client is not authorized to make the call throw an exception. 8. Client call trustNegotiation() operation for sending client policies and proofs 1. Requests create resource 2. Creates the resource 7. Register with TrustNegotiation Topic for notifications 6. Client call getNegotiationTopic() receive the QName of the negotiation topic.

Daniel Olmedilla June 15th, 20078th IEEE POLICY26 Policy Assertions from Everywhere CAS Shib LDAP Handle VOMS PERMIS XACML SAML SAZ PRIMA Gridmap XACML ???

Daniel Olmedilla June 15th, 20078th IEEE POLICY27 Policy Evaluation Complexity Single Domain & Centralized Policy Database/Service Meta-Data Groups/Roles membership maintained with Rules Only Pull/push of AuthZ-assertions … Challenge is to find right “balance” (driven by use cases…not by fad/fashion ;-) ) … Split Policy & Distribute Everything Separate DBs for meta-data, rules & attribute mappings Deploy MyProxy, LDAP,VOMS, Shib, CAS, PRIMA, XACML, PRIMA, GUMS, PERMIS, ???

Daniel Olmedilla June 15th, 20078th IEEE POLICY28 Ivan Can I have glass of lemonade? Bob Olivia Mary Lucy Ann Jogger John Bill Frosty Aunt Laura David Accountant Rita Emma Carol Decision Helper Master PDP