1. Security, Accounting, and Assurance Mahdi N. Bojnordi 2004 mnbojnordi@yahoo.com

2. Overview Requirements Requirements What is expected from grids nowadays? What is expected from grids nowadays? Technologies Technologies Which are developed to provide the security. Which are developed to provide the security. Current Practice Current Practice Existing implementation of security services. Existing implementation of security services. Future Directions Future Directions What is met by existing technologies insufficiently? What is met by existing technologies insufficiently?

3. Requirements Authentication Authentication The process of verifying the identity of a participant. The process of verifying the identity of a participant. A verified entity called principal (e.g. user logged into system). A verified entity called principal (e.g. user logged into system). Authority to use delegation of identity. Authority to use delegation of identity. Authorization Authorization The process determining whether a particular operation is allowed. The process determining whether a particular operation is allowed. Supporting delegation of authority. Supporting delegation of authority.

4. Requirements (cont’d) Assurance Assurance A form of authorization validating the authority of service provider (i.e. accreditation). A form of authorization validating the authority of service provider (i.e. accreditation). Allow the requester to decide whether a system is secure, reliable, etc. Allow the requester to decide whether a system is secure, reliable, etc. Accounting Accounting A means to manage the quotas. A means to manage the quotas.

5. Requirements (cont’d) Audit Audit Records what have been performed by a system on behalf of a principal. Records what have been performed by a system on behalf of a principal. Integrity and Confidentiality Integrity and Confidentiality Correct functioning of applications on the network. Correct functioning of applications on the network. Optional Security Services Optional Security Services Is all the described requirements needed for our system? Is all the described requirements needed for our system?

6. Technologies Cryptography Cryptography The most basic technology for distributed system security. System is conditioned on secrecy of key. The most basic technology for distributed system security. System is conditioned on secrecy of key. Symmetric & Asymmetric methods Symmetric & Asymmetric methods

7. Technologies (cont’d) Authentication Authentication There is several authentication methods including assertion, passwords, encryption-based protocols. There is several authentication methods including assertion, passwords, encryption-based protocols. Certification Certification Provides binding between a particular key and a principal. Provides binding between a particular key and a principal. This binding certified by a Certification Authority. This binding certified by a Certification Authority.

8. Technologies (cont’d) Distributed Authorization & Assurance Distributed Authorization & Assurance Privilege attribute certificates or assurance credentials. Privilege attribute certificates or assurance credentials. Accounting Accounting Distributed database Distributed database Intrusion Detection & Auditing Intrusion Detection & Auditing www.cert.org/archive/pdf/IEEE_IDS.pdf www.cert.org/archive/pdf/IEEE_IDS.pdf www.cert.org/archive/pdf/IEEE_IDS.pdf

9. Current Practice File Encryption, Email, and Public-Key Auth. File Encryption, Email, and Public-Key Auth. Pretty Good Privacy (PGP) Pretty Good Privacy (PGP) http://www.pgp.com http://www.davidyaw.com/crypto/PGP.pdf http://www.davidyaw.com/crypto/PGP.pdf http://www.davidyaw.com/crypto/PGP.pdf http://www.pgpi.org/cgi/download.cgi?filename=p gpsrc658win32.zip http://www.pgpi.org/cgi/download.cgi?filename=p gpsrc658win32.zip http://www.pgpi.org/cgi/download.cgi?filename=p gpsrc658win32.zip http://www.pgpi.org/cgi/download.cgi?filename=p gpsrc658win32.zip Secure Sockets Layer & Transaction-Level Sec. Secure Sockets Layer & Transaction-Level Sec. Embedded in most Web browser Embedded in most Web browser

10. Current Practice (cont’d) Kerberos

11. Current Practice (cont’d) IPSec, IPv6, and Virtual Private Networks IPSec, IPv6, and Virtual Private Networks Disabling sniffers Disabling sniffers Firewalls Firewalls A barrier at the boundary A barrier at the boundary

12. Future Directions Group Communication Group Communication Better ways needed Better ways needed Distributed Accounting Distributed Accounting NetCheque NetCheque

13. Thank you