Securing the Grid & other Middleware Challenges Ian Foster Mathematics and Computer Science Division Argonne National Laboratory and Department of Computer Science The University of Chicago Presentation at the NSF Workshop on “Grand Challenges in e-Science” December 5, 2001

ARGONNE  CHICAGO The Grid Opportunity l What Grids are about: “Resource sharing & coordinated problem solving in dynamic, multi- institutional virtual organizations” = entirely new tools, with often revolutionary impacts l The opportunity: advance transition to routine use by multiple years

ARGONNE  CHICAGO The Three Big (Interrelated) Grid Challenges l Realize revolutionary applications based on large-scale resource sharing –Part tech innovation, part social engineering l Create the tools that will allow virtual organizations to form—& to share, & apply (& protect), resources & services –Ubiquitous service/resource infrastructure l Deploy (inter)national infrastructure –Tomorrow’s high-speed nets (ideally today) –International/national/campus resources

ARGONNE  CHICAGO Tools: Also Known as Middleware l Middleware, n 1. Software you want other people to write. 2. Software that handles all of that security stuff for you. 3. Software that sits between networks and operating systems (“underwear”) and applications (“outerwear”). 4. Software distributed by NSF GRIDS Center, as part of NSF Middleware Initiative.

ARGONNE  CHICAGO Grid Middleware Architecture Fabric. “Controlling things locally”: instantiation/mgmt of services on resources Connectivity. “Talking to things”: comms & security Resource. “Sharing single resources & services”: negotiate access, control use Collective. “Coordinating resources”: centralized & distributed services Application. “Where the rubber hits the road” Resource mgmt (GRAM) Registration, discovery, monitoring (MDS) Data access & transfer (GridFTP) Evolving rapidly to Grid services framework Hosting environments Databases Workload Managers Archives Catalogs Bandwidth Brokers … Data services: Replica mgmt Replica locn DB federation Community svcs: Membership Discovery Authorization Internet protocols: transport, routing, name resolution, … Grid Security Infrastructure: Single sign on, delegation, authorization, … Prog. svcs: Workflow Co-allocation MPICH-G Events SchedulersFile systems …… … B2BxSP Database Access (GridSQL) …

ARGONNE  CHICAGO Grid Security l Enable VOs to form, share resources, & construct services & computations, while –Respecting site and community policies –Protecting against illicit resource access, denial of service attacks, other intrusions –Enabling high-performance operation –Allowing applications to make appropriate security-functionality tradeoffs l Many traditional assumptions invalid, e.g.: –Client-server, single domain, static config, …

ARGONNE  CHICAGO Grid Security Technologies l State of the art –Grid Security Infrastructure: single sign on, delegation, local authorization –Community Authorization Service: express & implement community policies l Current foci & future challenges –Increasingly dynamic communities –Richness and sophistication of policies –Scalability wrt size, performance, resource diversity, resource sensitivity, reliability

ARGONNE  CHICAGO Data Grid Toolkit Architecture

ARGONNE  CHICAGO Distributed Computing + Visualization Remote Center Generates Tb+ datasets from simulation code LAN/WAN Transfer User-friendly striped GridFTP application tiles the frames and stages tiles onto display nodes Data transferred locally for visualization GridFTP parallelism utilizes high bandwidth (Capable of utilizing >Gb/s WAN links) WAN Transfer Local Cluster Visualization code constructs and stores high-resolution visualization frames for display on many devices ActiveMural Display Displays very high resolution large-screen dataset animations Job Submission Simulation code submitted to remote center for execution on 1000s of nodes FUTURE (1-5 yrs) 10s Gb/s LANs, WANs End-to-end QoS Automated replica management Server-side data reduction & analysis Integrity & privacy