1. www.eu-eela.eu E-science grid facility for Europe and Latin America A Data Access Policy based on VOMS attributes in the Secure Storage Service Diego Scardaci INFN (Italy) EELA-2 First Conference Bogota, Columbia, 25-27.02.2009

2. www.eu-eela.eu Bogota, EELA-2 Conference, 25-27.02.2009 The Insider Abuse Problem The Secure Storage Service for the gLite Middleware: –Main Functionalities –Data Access Policy based on VOMS attributes Outline

3. www.eu-eela.eu Bogota, EELA-2 Conference, 25-27.02.2009 Insider Abuse: Problem A grid user could store sensitive data in a Storage Elements managed by external organizations. Storage Elements Administrators could access data (but the data are sensitive!). For this reason data MUST be stored in an encrypted format. Data Encryption/Decryption MUST be performed inside user secure environment (for example inside the user’s organization).

4. www.eu-eela.eu Bogota, EELA-2 Conference, 25-27.02.2009 SE Key Repository SE USER (VIRTUAL) ORGANIZATION Key File Encryption /Decryption Encrypted File Insider Abuse: A Solution SECURE ENVIRONMENT

5. www.eu-eela.eu Bogota, EELA-2 Conference, 25-27.02.2009 The Secure Storage service Provides gLite users with suitable and simple tools to store confidential data in storage elements in a transparent and secure way. The service is composed by the following components: Command Line Applications: commands integrated in the gLite User Interface to encrypt/upload and decrypt/ download files. Application Program Interface: allows the developer to write programs able to manage confidential data. Keystore: a new grid element used to store and retrieve the users’ keys. It is identified by an host X.509 digital certificate and all its Grid transactions are mutually authenticated and encrypted according to GSI model.

6. www.eu-eela.eu Bogota, EELA-2 Conference, 25-27.02.2009 Command Line Applications and API Secure Storage provides a new set of commands and API on the gLite User Interface: –Like lcg-utils commands and API, but they work on encrypted data. –Encryption and decryption process are transparent to the user. These commands and API allow to make the main Data Management operations: –lcg-scr: Copy data/file on Storage Elements –lcg-scp: Read data/file from Storage Elements –lcg-sdel: Delete data/file on Storage Elements –…. API like GFAL (encrypt and decrypt block of data): –allows developers to work to encrypted remote file as local files in clear format.

7. www.eu-eela.eu Bogota, EELA-2 Conference, 25-27.02.2009 lcg-scr: Encryption and Storage GSI AUTHENTICATED CHANNEL OWNER DN DN1 DN2 FQAN1 FQAN2 … ACL Access authorized to: DN1, DN2, FQAN1, FQAN2, … A FQAN AUTHORIZED TO ACCESS THE FILE CAN REPRESENT A WHOLE VO OR A VO GROUP ETC.

8. www.eu-eela.eu Bogota, EELA-2 Conference, 25-27.02.2009 lcg-scp: Retrieval and Decryption OWNER DN DN1 DN2 FQAN1 FQAN2 … ACL THE KEYSTORE PROVIDES USERS WITH THE KEY ONLY IF USER’S DN OR ONE OF THE VOMS ATTRIBUTES INCLUDED IN HIS PROXY MATCHES ONE ENTRY OF THE ACL GSI AUTHENTICATED CHANNEL

9. www.eu-eela.eu Bogota, EELA-2 Conference, 25-27.02.2009 The Keystore (1) The Keystore is a new grid element used to store and retrieve the users’ key in a secure way. The Keystore: is identified by an host X.509 digital certificate; all its Grid transactions are mutually authenticated and encrypted as required by the GSI model; should be placed in a trusted domain and should be appropriately protected by undesired connections; is a black box with a single interface towards the external world. This interface accepts only GSI authenticated connections;

10. www.eu-eela.eu Bogota, EELA-2 Conference, 25-27.02.2009 The Keystore (2) Authorization process performed by the Keystore: the user requests a key through a mutually authenticated and encrypted channel (according to GSI infrastructure): the keystore extracts user’s DN and VOMS extension from the user X509 proxy certificate; the keystore checks if the client is a member of a enabled users list only and/or it belongs to an enabled Virtual Organization or to a specific Virtual Organization Group. The request is discarded in any other cases; the keystore checks if user’s DN and VOMS extension matches one of the entry of the ACL associated to the requested key. If the user is authorized, the keystore provides the key otherwise the request is discarded.

11. www.eu-eela.eu Bogota, EELA-2 Conference, 25-27.02.2009 Any questions ?