1. DataGrid WP6/CA CA Trust Matrices
Trinity College Dublin (TCD)
Brian Coghlan
Edinburgh JUL-2002

2. EU DataGrid Project Main Partners Industrial Partners
CERN (Switzerland)
ESA/ESRIN (Italy)
CNRS (France)
PPARC (UK)
NIKHEF (Nethelands)
INFN (Italy)
Industrial Partners
Datamat (Italy)
IBM-UK (UK)
CS-SI (France)
One of the initial services the networks intended to offer their clients was access to OMI results. It was envisioned that this should not be passive access, but proactive promotion through which the OMI offering was always proposed to the SME if there was an OMI solution to their problem. Despite multiple attempts to identify and establish an OMI solution for a problem, we were unable to promote OMI beyond the stage of a possible option and to achieve acceptance from an SME to use OMI technology. Multiple reasons exists for this:
the huge difficulties identifying an OMI option if at all available;
poor packaging and immature technology;
low market profile for OMI developments suggesting they are not widely used and far from being a de-facto market standard;
absence of previous experiences of applying the technology;
most of the hardware developed within OMI is available only as chip building blocks (macrocells) not as chip-sets.
In total the OMI option was rejected, as it was perceived to be too risky by the potential user. SMEs are highly risk-sensitive and usually do not operate in volumes justifying development of ASICs that can exploit OMI results, even if the macrocells were licensable with reasonable effort.
The responsibility for marketing the OMI results lies with the companies originally developing the processor core or macrocell. The User Support Networks can, not and should not, take on this marketing effort. For the macrocells to find a market with the SMEs they must be turned into chip-sets easily available with proper documentation like application notes helping the SMEs engineer systems exploiting these chips. Knowledge about the available results is a key problem and there is an imminent need for a catalogue detailing what are available out of OMI, the availability of the products, terms and conditions, and application references.
Research and Academic Institutes
CESNET (Czech Republic)
Commissariat à l'énergie atomique (CEA) – France
Computer and Automation Research Institute,  Hungarian Academy of Sciences (MTA SZTAKI)
Consiglio Nazionale delle Ricerche (Italy)
Helsinki Institute of Physics – Finland
Institut de Fisica d'Altes Energies (IFAE) - Spain
Istituto Trentino di Cultura (IRST) – Italy
Konrad-Zuse-Zentrum für Informationstechnik Berlin - Germany
Royal Netherlands Meteorological Institute (KNMI)
Ruprecht-Karls-Universität Heidelberg - Germany
Stichting Academisch Rekencentrum Amsterdam (SARA) – Netherlands
Swedish Research Council - Sweden

3. EU CrossGrid Project 21 Partners 11 Countries led by Cyfronet (Poland)
Netherlands
Germany
Spain
Italy
Portugal
Greece
Austria
Slovakia
Cyprus
Ireland
One of the initial services the networks intended to offer their clients was access to OMI results. It was envisioned that this should not be passive access, but proactive promotion through which the OMI offering was always proposed to the SME if there was an OMI solution to their problem. Despite multiple attempts to identify and establish an OMI solution for a problem, we were unable to promote OMI beyond the stage of a possible option and to achieve acceptance from an SME to use OMI technology. Multiple reasons exists for this:
the huge difficulties identifying an OMI option if at all available;
poor packaging and immature technology;
low market profile for OMI developments suggesting they are not widely used and far from being a de-facto market standard;
absence of previous experiences of applying the technology;
most of the hardware developed within OMI is available only as chip building blocks (macrocells) not as chip-sets.
In total the OMI option was rejected, as it was perceived to be too risky by the potential user. SMEs are highly risk-sensitive and usually do not operate in volumes justifying development of ASICs that can exploit OMI results, even if the macrocells were licensable with reasonable effort.
The responsibility for marketing the OMI results lies with the companies originally developing the processor core or macrocell. The User Support Networks can, not and should not, take on this marketing effort. For the macrocells to find a market with the SMEs they must be turned into chip-sets easily available with proper documentation like application notes helping the SMEs engineer systems exploiting these chips. Knowledge about the available results is a key problem and there is an imminent need for a catalogue detailing what are available out of OMI, the availability of the products, terms and conditions, and application references.

4. DataGrid: security No single work package (security is everywhere!)
3 sub-groups: Authentication, Authorisation, & Co-ordination
Chaired by Dave Kelsey, RAL
Now based on Globus GSI
authentication using PKI (X.509 certificates)
authorization via DataGrid tools
Trying not to mix Authentication and Authorisation
Documents:
Security Requirements and first implementation (D7.5)
Security Design and 2nd implementation (Jan 2003)

5. DataGrid: authentication
Grids involve N-way contexts
Thus each party is worried about all the others
Back at the CA, each CA wants to evaluate the other CA
EITHER that they meet the CA’s minimum standard
OR that they meet an agreed common standard
EDG focus is on common standard
This results in a Trust Matrix

6. DataGrid: authentication
involves cross-domain authentication between Grid projects
now 13 approved National Certificate Authorities
includes Registration Authorities – check identity
CNRS (France) acts as “catch-all” CA with RA mechanism to suit
USA (DOE) is a member of the CA group and trust matrix
CrossGrid CAs are currently joining CA group and trust matrix

7. Matrix of Trust

8. Matrix of trust How to establish the trust ? CP/CPS important
CA Mgrs check each other against agreed list of minimum requirements
currently require inspection of each CA’s CPS by each other CA
software being developed to aid this process
CP/CPS important
audit of CA procedures will help
none done yet
use 3rd party ?
GGF GridCP and CA-Operations WG’s considered important

9. Matrix of trust Scaling problems
how many CA’s can we cope with [soon ~20] ?
the process is very manual
personal contacts are fundamental
WANT TO MAKE EVALUATION MORE AUTOMATIC
software being developed to aid this process
based on evaluation of the CA Feature Matrix

10. DataGrid: CA Feature Matrix

11. Basic Concepts Issues: Grading: Constraint: Aggregation:
postulate: (condition)  (issue)
e.g. (BasicConstraints_value ne ‘CA’)  (major issue)
Grading:
i.e. assign an issue a weight
Constraint:
issues of a certain class should be constrained to that class
e.g. many minor issues do not make a major issue
Aggregation:
aggregate graded issues in a measure of ‘severity’
e.g. major) = (graded major issues)limit=1.0
One of the initial services the networks intended to offer their clients was access to OMI results. It was envisioned that this should not be passive access, but proactive promotion through which the OMI offering was always proposed to the SME if there was an OMI solution to their problem. Despite multiple attempts to identify and establish an OMI solution for a problem, we were unable to promote OMI beyond the stage of a possible option and to achieve acceptance from an SME to use OMI technology. Multiple reasons exists for this:
the huge difficulties identifying an OMI option if at all available;
poor packaging and immature technology;
low market profile for OMI developments suggesting they are not widely used and far from being a de-facto market standard;
absence of previous experiences of applying the technology;
most of the hardware developed within OMI is available only as chip building blocks (macrocells) not as chip-sets.
In total the OMI option was rejected, as it was perceived to be too risky by the potential user. SMEs are highly risk-sensitive and usually do not operate in volumes justifying development of ASICs that can exploit OMI results, even if the macrocells were licensable with reasonable effort.
The responsibility for marketing the OMI results lies with the companies originally developing the processor core or macrocell. The User Support Networks can, not and should not, take on this marketing effort. For the macrocells to find a market with the SMEs they must be turned into chip-sets easily available with proper documentation like application notes helping the SMEs engineer systems exploiting these chips. Knowledge about the available results is a key problem and there is an imminent need for a catalogue detailing what are available out of OMI, the availability of the products, terms and conditions, and application references.

12. Currently [JUL-2002]
per class: class) = (graded class issues)limit=1.0
max_severity: (severity) for most critical class with issues
postulate: acceptance_level = Tacceptance – (max_severity)
where: Tacceptance == (worst-case max_severity)
e.g, assume: Tacceptance = 3.0
therefore: max_severity = [ ]
and: acceptance_level = [ ]
This is the WORKING BASIS for manual evaluation
One of the initial services the networks intended to offer their clients was access to OMI results. It was envisioned that this should not be passive access, but proactive promotion through which the OMI offering was always proposed to the SME if there was an OMI solution to their problem. Despite multiple attempts to identify and establish an OMI solution for a problem, we were unable to promote OMI beyond the stage of a possible option and to achieve acceptance from an SME to use OMI technology. Multiple reasons exists for this:
the huge difficulties identifying an OMI option if at all available;
poor packaging and immature technology;
low market profile for OMI developments suggesting they are not widely used and far from being a de-facto market standard;
absence of previous experiences of applying the technology;
most of the hardware developed within OMI is available only as chip building blocks (macrocells) not as chip-sets.
In total the OMI option was rejected, as it was perceived to be too risky by the potential user. SMEs are highly risk-sensitive and usually do not operate in volumes justifying development of ASICs that can exploit OMI results, even if the macrocells were licensable with reasonable effort.
The responsibility for marketing the OMI results lies with the companies originally developing the processor core or macrocell. The User Support Networks can, not and should not, take on this marketing effort. For the macrocells to find a market with the SMEs they must be turned into chip-sets easily available with proper documentation like application notes helping the SMEs engineer systems exploiting these chips. Knowledge about the available results is a key problem and there is an imminent need for a catalogue detailing what are available out of OMI, the availability of the products, terms and conditions, and application references.

13. Auto-evaluation move to extract issues automatically from what ?
initially from Feature Matrix
later from CA certs & CRLs ?
One of the initial services the networks intended to offer their clients was access to OMI results. It was envisioned that this should not be passive access, but proactive promotion through which the OMI offering was always proposed to the SME if there was an OMI solution to their problem. Despite multiple attempts to identify and establish an OMI solution for a problem, we were unable to promote OMI beyond the stage of a possible option and to achieve acceptance from an SME to use OMI technology. Multiple reasons exists for this:
the huge difficulties identifying an OMI option if at all available;
poor packaging and immature technology;
low market profile for OMI developments suggesting they are not widely used and far from being a de-facto market standard;
absence of previous experiences of applying the technology;
most of the hardware developed within OMI is available only as chip building blocks (macrocells) not as chip-sets.
In total the OMI option was rejected, as it was perceived to be too risky by the potential user. SMEs are highly risk-sensitive and usually do not operate in volumes justifying development of ASICs that can exploit OMI results, even if the macrocells were licensable with reasonable effort.
The responsibility for marketing the OMI results lies with the companies originally developing the processor core or macrocell. The User Support Networks can, not and should not, take on this marketing effort. For the macrocells to find a market with the SMEs they must be turned into chip-sets easily available with proper documentation like application notes helping the SMEs engineer systems exploiting these chips. Knowledge about the available results is a key problem and there is an imminent need for a catalogue detailing what are available out of OMI, the availability of the products, terms and conditions, and application references.

14. Extraction from Feature Matrix
since: (condition)  (graded issue)
then must define condition per feature  {rules}
e.g.: (name eq ‘NIL’)  (graded issue)
thus: if (name eq ‘NIL’) (graded issue) == class)
per class: (severity) == (graded issues)limit=1.0
EDG can define its common rule set
each CA could define its own overrides to the rule set
ultimately each VO could define its own rule set
One of the initial services the networks intended to offer their clients was access to OMI results. It was envisioned that this should not be passive access, but proactive promotion through which the OMI offering was always proposed to the SME if there was an OMI solution to their problem. Despite multiple attempts to identify and establish an OMI solution for a problem, we were unable to promote OMI beyond the stage of a possible option and to achieve acceptance from an SME to use OMI technology. Multiple reasons exists for this:
the huge difficulties identifying an OMI option if at all available;
poor packaging and immature technology;
low market profile for OMI developments suggesting they are not widely used and far from being a de-facto market standard;
absence of previous experiences of applying the technology;
most of the hardware developed within OMI is available only as chip building blocks (macrocells) not as chip-sets.
In total the OMI option was rejected, as it was perceived to be too risky by the potential user. SMEs are highly risk-sensitive and usually do not operate in volumes justifying development of ASICs that can exploit OMI results, even if the macrocells were licensable with reasonable effort.
The responsibility for marketing the OMI results lies with the companies originally developing the processor core or macrocell. The User Support Networks can, not and should not, take on this marketing effort. For the macrocells to find a market with the SMEs they must be turned into chip-sets easily available with proper documentation like application notes helping the SMEs engineer systems exploiting these chips. Knowledge about the available results is a key problem and there is an imminent need for a catalogue detailing what are available out of OMI, the availability of the products, terms and conditions, and application references.

15. Acceptance/Feature Matrices
THE END
One of the initial services the networks intended to offer their clients was access to OMI results. It was envisioned that this should not be passive access, but proactive promotion through which the OMI offering was always proposed to the SME if there was an OMI solution to their problem. Despite multiple attempts to identify and establish an OMI solution for a problem, we were unable to promote OMI beyond the stage of a possible option and to achieve acceptance from an SME to use OMI technology. Multiple reasons exists for this:
the huge difficulties identifying an OMI option if at all available;
poor packaging and immature technology;
low market profile for OMI developments suggesting they are not widely used and far from being a de-facto market standard;
absence of previous experiences of applying the technology;
most of the hardware developed within OMI is available only as chip building blocks (macrocells) not as chip-sets.
In total the OMI option was rejected, as it was perceived to be too risky by the potential user. SMEs are highly risk-sensitive and usually do not operate in volumes justifying development of ASICs that can exploit OMI results, even if the macrocells were licensable with reasonable effort.
The responsibility for marketing the OMI results lies with the companies originally developing the processor core or macrocell. The User Support Networks can, not and should not, take on this marketing effort. For the macrocells to find a market with the SMEs they must be turned into chip-sets easily available with proper documentation like application notes helping the SMEs engineer systems exploiting these chips. Knowledge about the available results is a key problem and there is an imminent need for a catalogue detailing what are available out of OMI, the availability of the products, terms and conditions, and application references.