1. Service Virtualization via a Network Appliance….
Enterprise ACS
Service Virtualization via a Network Appliance….
Peter Ziu
Michael Behrens (R2AD, LLC)
GGF18 September 11-14, 2006
Washington DC, USA

2. OGF IPR Policies Apply
I acknowledge that participation in GGF13 is subject to the GGF Intellectual Property Policy.
Intellectual Property Notices Note Well: All statements related to the activities of the GGF and addressed to the GGF are subject to all provisions of Section 17 of GFD-C.1 (.pdf), which grants to the GGF and its participants certain licenses and rights in such statements. Such statements include verbal statements in GGF meetings, as well as written and electronic communications made at any time or place, which are addressed to: the GGF plenary session,
any GGF working group or portion thereof,
the GFSG, or any member thereof on behalf of the GFSG,
the GFAC, or any member thereof on behalf of the GFAC,
any GGF mailing list, including any working group or research group list, or any other list functioning under GGF auspices,
the GFD Editor or the GWD process
Statements made outside of a GGF meeting, mailing list or other function, that are clearly not intended to be input to an GGF activity, group or function, are not subject to these provisions.
Excerpt from Section 17 of GFD-C.1 Where the GFSG knows of rights, or claimed rights, the GGF secretariat shall attempt to obtain from the claimant of such rights, a written assurance that upon approval by the GFSG of the relevant GGF document(s), any party will be able to obtain the right to implement, use and distribute the technology or works when implementing, using or distributing technology based upon the specific specification(s) under openly specified, reasonable, non-discriminatory terms. The working group or research group proposing the use of the technology with respect to which the proprietary rights are claimed may assist the GGF secretariat in this effort. The results of this procedure shall not affect advancement of document, except that the GFSG may defer approval where a delay may facilitate the obtaining of such assurances. The results will, however, be recorded by the GGF Secretariat, and made available. The GFSG may also direct that a summary of the results be included in any GFD published containing the specification.   GGF Intellectual Property Policies are adapted from the IETF Intellectual Property Policies that support the Internet Standards Process.

3. Enterprise ACS - Sharing AA’sB
Replication contracts C A D
Macro View - Distributed services via secure circuits

4. Enterprise ACS - part of architecture
CDDLM, EMS (BES), data specifications and other OGSA standards provide a foundation for dynamic service instantiation
These dynamic instantiations (provisioning) provide support for:
Service Transparency
Not hard-coded end points internal to service calls
EPRs are may not be static
Service Mobility
Potential for a service to move or to exist in multiple places at the same time
ACS provides a trusted store from which content (services and data) can be obtained securely
Grid Services can be instantiated from ACS when needed, based on SLA needs (monitoring)

5. Cases where needed Inter-Grid ACS - Disaster Recovery
Computers are geographically dispersed
Track where what is installed and used
Usage Metrics - collected data can be associated with the content as a referenced AA
Location Awareness or pedigree of where systems are installed (inventory analysis). Usage Trends over time, etc.
Inter-Grid ACS - Disaster Recovery
Replication
Caching of grid/web service definitions
System of services (services and their dependencies)
Non-Service applications
databases
binary data
application containers
images
Provisioning Grid Appliance...

6. Grid Provisioning Appliance Concept
Provides the grid “DNA” or “seed” to create, duplicate, or graft a section of grid environment. It exists at development time.
Can be replicated or duplicated from an existing appliance.
Can integrate images/packages for OS, ACS repository, common jobs, Identity management services and data storage.
Facilities include: Identity Management UI, network boot strapping services, kernel and flash images,
Can prepare supported network enabled devices “out of the box” to become operational grid containers
WAN

7. Use Case Actors Customers (multi-domain): Appliance Services:
Grid Application Developers
Grid Administrators
Application / Service Testers
Production Hosting Entities
Appliance Services:
Boot strap delivery
SI, IUP Repository Service (ACS)
Identity Management UI
Cross Domain Security Mgmt.
Macro computer Constraints Design
Provisioning service (CDDLM)
Device authentication service
Solution Installation (SI) parser
Service Consumers
Network Enabled Devices
Boot Kernels/Images
Data Providers
Identity store
ACS content
OS Binaries/Images / Configuration /Bootable ISOs
Core Grid Containers and Services
Components, configurations, Solution Installation, Jobs (JSDL), Applications

8. Auto Provisioning Scenario
ACS Provisioning Appliance (logical view)
AA Cache/
Storage
Detects new network device 1
Network Monitoring Detection
Authenticates/Authorizes
Registers new H/W 2
Device Auth (who/allowed)
Purpose/Need (info mgt)
Determines purpose of new node (manual or automatic) main function or generic node 3
ACS Core Grid AA’s
ACS
Security Component
keystore/XACML/etc
Provisions core grid engine securely + application binaries based on SLA control events from EMS 4
Provisioning
Participates in Dynamic Services - Now a fully functional grid node 5
R2AD
New Node (any network device)