Grid & Globus Security

Gridforum Nederland en Internet Society Masterclass

2:00pm, July 11, 2005 - Science Park, Amsterdam

Frank Siebenlist

(Globus Alliance / Argonne National Laboratory / University of Chicago)

franks@mcs.anl.gov - http://www.globus.org/

Jul 11, 2005

Grid & Globus Security

10

Intro…

Amsterdam => Hong Kong => New York
=> Silicon Valley => Chicago => Amsterdam

FOM-AMOLF => Citibank => JP Morgan => DASCOM => IBM => Eazel => Argonne National Laboratory

Fusion/Accelerator Physics Research
=> Trade/Trading SW-Applications
=> Distributed Computing Design/Architecture
=> Security SW => Linux Security => Grid Security

Amsterdam is still beautiful!

North Sea Jazz Festival was amazing…
(…but the players are getting old…)

The Globus Alliance
Making Grid computing a reality

Close collaboration with real Grid projects in science and industry

Development and promotion of standard Grid protocols (e.g. OGSA) to enable interoperability and shared infrastructure

Development and promotion of standard Grid software APIs and SDKs to enable portability and code sharing

The Globus Toolkit®: Open source, reference software base for building Grid infrastructure and applications

Global Grid Forum: Development of standard protocols and APIs for Grid computing

Jul 11, 2005

Grid & Globus Security

10

Outline

Part One

Globus Toolkit Introduction

The Big Security Picture

What is Grid Security?

Current Grid/Globus Security

Part Two

2004: The year we lost control of the desktop

Leverage Security Service Implementations

GT’s Authorization Processing Framework

Futures and Conclusion

Discussion

Jul 11, 2005

Grid & Globus Security

10

On April 29, 2005 the
Globus Alliance released
the finest version of the Globus Toolkit to date!

Jul 11, 2005

Grid & Globus Security

10

The Application-Infrastructure Gap

Dynamic
and/or
Distributed
Applications

A

1

B

1

9

9

Shared Distributed Infrastructure

Jul 11, 2005

Grid & Globus Security

10

Provisioning

Bridging the Gap:
Grid Infrastructure

Service-oriented Grid
infrastructure

Provision physical
resources to support
application workloads

Appln
Service

Appln
Service

Users

Workflows

Composition

Invocation

Service-oriented applications

Wrap applications as
services

Compose applications
into workflows

Jul 11, 2005

Grid & Globus Security

10

Globus is Grid Infrastructure

Software for Grid infrastructure

Service enable new & existing resources

E.g., GRAM on computer, GridFTP on storage system, custom application service

Uniform abstractions & mechanisms

Tools to build applications that exploit Grid infrastructure

Registries, security, data management, …

Open source & open standards

Each empowers the other

Enabler of a rich tool & service ecosystem

Jul 11, 2005

Grid & Globus Security

10

A Typical eScience Use of Globus:
Network for Earthquake Eng. Simulation

Links instruments, data,

computers, people

Jul 11, 2005

Grid & Globus Security

10

Globus Toolkit

Core Web services

Infrastructure for building new services

Security

Apply uniform policy across distinct systems

Execution management

Provision, deploy, & manage services

Data management

Discover, transfer, & access large data

Monitoring

Discover & monitor dynamic services

Jul 11, 2005

Grid & Globus Security

10

Data Mgmt

Security

Common
Runtime

Execution Mgmt

Info Services

Non-WS Components

Pre-WS

Authentication

Authorization

GridFTP

C Common

Libraries

Globus Toolkit version 2 (GT2)

Grid Resource

Alloc. Mgmt

(GRAM)

Monitoring

& Discovery

(MDS)

Web Services
Components

Jul 11, 2005

Grid & Globus Security

10

Data Mgmt

Security

Common
Runtime

Execution Mgmt

Info Services

Web Services
Components

Non-WS Components

Pre-WS

Authentication

Authorization

GridFTP

C Common

Libraries

WS

Authentication

Authorization

Reliable

File

Transfer

Data Access

& Integration

Grid Resource

Alloc. Mgmt

(WS GRAM)

MDS3

Java
WS Core

Community
Authorization

Replica

Location

eXtensible

IO (XIO)

Globus Toolkit version 3 (GT3)

Grid Resource

Alloc. Mgmt

(GRAM)

Monitoring

& Discovery

(MDS)

Jul 11, 2005

Grid & Globus Security

10

Data Mgmt

Security

Common
Runtime

Execution Mgmt

Info Services

Web Services
Components

Non-WS Components

Pre-WS

Authentication

Authorization

GridFTP

Pre-WS

Grid Resource

Alloc. & Mgmt

Pre-WS
Monitoring

& Discovery

C Common

Libraries

Authentication

Authorization

Reliable

File

Transfer

Data Access

& Integration

Grid Resource

Allocation &

Management

Index

Java
WS Core

Community
Authorization

Replica

Location

eXtensible

IO (XIO)

Credential

Mgmt

Community

Scheduling

Framework

Delegation

Globus Toolkit version 4 (GT4)

Data

Replication

Trigger

C
WS Core

Python
WS Core

WebMDS

Workspace

Management

Grid
Telecontrol
Protocol

Contrib/
Preview

Core

Depre-
cated

www.globus.org

Jul 11, 2005

Grid & Globus Security

10

Java Services in Apache Axis

Plus GT Libraries and Handlers

Your

Java

Service

Your

Python

Service

Your

Java

Service

RFT

GRAM

Delegation

Index

Trigger

Archiver

pyGlobus

WS Core

Your

C

Service

C WS

Core

RLS

Pre-WS MDS

CAS

Pre-WS GRAM

SimpleCA

MyProxy

OGSA-DAI

GTCP

GridFTP

C Services using GT

Libraries and Handlers

SERVER

CLIENT

Interoperable

WS-I-compliant

SOAP messaging

Your

Java

Client

Your

C

Client

Your

Python

Client

Your

Java

Client

Your

C

Client

Your

Python

Client

Your

Java

Client

Your

C

Client

Your

Python

Client

Your

Java

Client

Your

C

Client

Your

Python

Client

X.509 credentials =

common authentication

Python hosting,

GT Libraries

GT4 Components

Jul 11, 2005

Grid & Globus Security

10

Our Goals for GT4

Usability, reliability, scalability, …

Web service components have quality equal or superior to pre-WS components

Documentation at acceptable quality level

Consistency with latest standards (WS-*, WSRF, WS-N, etc.) and Apache platform

WS-I Basic Profile compliant

WS-I Basic Security Profile compliant

New components, platforms, languages

And links to larger Globus ecosystem

Jul 11, 2005

Grid & Globus Security

10

Contrib/
Preview

Core

Data Mgmt

Security

Execution Mgmt

Info Services

Web Services
Components

Non-WS Components

Pre-WS

Authentication

Authorization

GridFTP

Pre-WS

Grid Resource

Alloc. & Mgmt

Pre-WS
Monitoring

& Discovery

Authentication

Authorization

Reliable

File

Transfer

Data Access

& Integration

Grid Resource

Allocation &

Management

Index

Community
Authorization

Replica

Location

Credential

Mgmt

Community

Scheduling

Framework

Delegation

Data

Replication

Trigger

WebMDS

Workspace

Management

Grid
Telecontrol
Protocol

Depre-
cated

www.globus.org

Common
Runtime

C Common

Libraries

Java
WS Core

eXtensible

IO (XIO)

C
WS Core

Python
WS Core

GT4 Common Runtime

Jul 11, 2005

Grid & Globus Security

10

Custom

Web

Services

WS-Addressing, WSRF,

WS-Notification

Custom

WSRF Web

Services

GT4
WSRF Web

Services

WSDL, SOAP, WS-Security

User Applications

Registry

Administration

GT4 Container

GT4 Web Services Core

Jul 11, 2005

Grid & Globus Security

10

GT4 Web Services Core

Supports both GT (GRAM, RFT, Delegation, etc.) & user-developed services

Redesign to enhance scalability, modularity, performance, usability

Leverages existing WS standards

WS-I Basic Profile: WSDL, SOAP, etc.

WS-Security, WS-Addressing

Adds support for emerging WS standards

WS-Resource Framework, WS-Notification

Java, Python, & C hosting environments

Java is standard Apache

Jul 11, 2005

Grid & Globus Security

10

WSRF & WS-Notification

Naming and bindings (basis for virtualization)

Every resource can be uniquely referenced, and has one or more associated services for interacting with it

Lifecycle (basis for fault resilient state mgmt)

Resources created by services following factory pattern

Resources destroyed immediately or scheduled

Information model (basis for monitoring, discovery)

Resource properties associated with resources

Operations for querying and setting this info

Asynchronous notification of changes to properties

Service groups (basis for registries, collective svcs)

Group membership rules & membership management

Base Fault type

Jul 11, 2005

Grid & Globus Security

10

Contrib/
Preview

Core

Common
Runtime

C Common

Libraries

Java
WS Core

eXtensible

IO (XIO)

C
WS Core

Python
WS Core

Data Mgmt

Execution Mgmt

Info Services

Web Services
Components

Non-WS Components

GridFTP

Pre-WS

Grid Resource

Alloc. & Mgmt

Pre-WS
Monitoring

& Discovery

Reliable

File

Transfer

Data Access

& Integration

Grid Resource

Allocation &

Management

Index

Replica

Location

Community

Scheduling

Framework

Data

Replication

Trigger

WebMDS

Workspace

Management

Grid
Telecontrol
Protocol

Depre-
cated

www.globus.org

GT4 Security

Security

Pre-WS

Authentication

Authorization

Authentication

Authorization

Community
Authorization

Credential

Mgmt

Delegation

Jul 11, 2005

Grid & Globus Security

10

Globus Security

Control access to shared services

Address autonomous management, e.g., different policy in different work-groups

Support multi-user collaborations

Federate through mutually trusted services

Local policy authorities rule

Allow users and application communities to set up dynamic trust domains

Personal/VO collection of resources working together based on trust of user/VO

Jul 11, 2005

Grid & Globus Security

10

GT4 Security

Public-key-based authentication

Extensible authorization framework based on Web services standards

SAML-based authorization callout

As specified in GGF OGSA-Authz WG

Integrated policy decision engine

XACML policy language, per-operation policies, pluggable

Credential management service

MyProxy (One time password support)

Community Authorization Service

Standalone delegation service

Jul 11, 2005

Grid & Globus Security

10

GT4’s Use of Security Standards

Supported, Supported, Fastest,

but slow but insecure so default

Jul 11, 2005

Grid & Globus Security

10

GT-XACML Integration

eXtensible Access Control Markup Language

OASIS standard, open source implementations

XACML: sophisticated policy language

Globus Toolkit ships with XACML runtime

Included in every client and server built on GT

Turned-on through configuration

… that can be called transparently from runtime and/or explicitly from application …

… and we use the XACML-”model” for
our Authz Processing Framework

Jul 11, 2005

Grid & Globus Security

10

GT Authorization Framework

Jul 11, 2005

Grid & Globus Security

10

Other Security Services Include …

MyProxy

Simplified credential management

Web portal integration

Single-sign-on support

KCA & kx.509

Bridging into/out-of Kerberos domains

SimpleCA

Online credential generation

PERMIS

Authorization service callout

Jul 11, 2005

Grid & Globus Security

10

Contrib/
Preview

Core

Security

Pre-WS

Authentication

Authorization

Authentication

Authorization

Community
Authorization

Credential

Mgmt

Delegation

Common
Runtime

C Common

Libraries

Java
WS Core

eXtensible

IO (XIO)

C
WS Core

Python
WS Core

Execution Mgmt

Info Services

Web Services
Components

Non-WS Components

Pre-WS

Grid Resource

Alloc. & Mgmt

Pre-WS
Monitoring

& Discovery

Grid Resource

Allocation &

Management

Index

Community

Scheduling

Framework

Trigger

WebMDS

Workspace

Management

Grid
Telecontrol
Protocol

Depre-
cated

www.globus.org

GT4 Data Management

Data Mgmt

GridFTP

Reliable

File

Transfer

Data Access

& Integration

Replica

Location

Data

Replication

Jul 11, 2005

Grid & Globus Security

10

GT4 Data Management

Stage/move large data to/from nodes

GridFTP, Reliable File Transfer (RFT)

Alone, and integrated with GRAM

Locate data of interest

Replica Location Service (RLS)

Replicate data for performance/reliability

Distributed Replication Service (DRS)

Provide access to diverse data sources

File systems, parallel file systems, hierarchical storage: GridFTP

Databases: OGSA DAI

Jul 11, 2005

Grid & Globus Security

10

GridFTP in GT4

100% Globus code

No licensing issues

Stable, extensible

IPv6 Support

XIO for different transports

Striping  multi-Gb/sec wide area transport

27 Gbit/s on 30 Gbit/s link

Pluggable

Front-end: e.g., future WS control channel

Back-end: e.g., HPSS, cluster file systems

Transfer: e.g., UDP, NetBLT transport

Disk-to-disk on
TeraGrid

Jul 11, 2005

Grid & Globus Security

10

Reliable File Transfer:
Third Party Transfer

RFT Service

RFT Client

SOAP Messages

Notifications
(Optional)

Data
Channel

Protocol Interpreter

Master
DSI

Data
Channel

Slave
DSI

IPC
Receiver

IPC Link

Master
DSI

Protocol Interpreter

Data Channel

IPC
Receiver

Slave
DSI

Data Channel

IPC Link

GridFTP Server

GridFTP Server

Fire-and-forget transfer

Web services interface

Many files & directories

Integrated failure recovery

Has transferred 900K files

Jul 11, 2005

Grid & Globus Security

10

Replica Location Service

Identify location of files via logical to physical name map

Distributed indexing of names, fault tolerant update protocols

GT4 version scalable & stable

Managing ~40 million files across ~10 sites

Index

Index

50 M

175

7

5 M

10 M

24

2

1 M

1 M

2

<1

10K

Bloom filter (bits)

Bloom filter (secs)

Update send (secs)

Local DB

Jul 11, 2005

Grid & Globus Security

10

Cardiff

AEI/Golm

Birmingham•

Reliable Wide Area Data Replication

Replicating >1 Terabyte/day to 8 sites

>30 million replicas so far

MTBF = 1 month

LIGO Gravitational Wave Observatory

www.globus.org/solutions

Jul 11, 2005

Grid & Globus Security

10

Security

Pre-WS

Authentication

Authorization

Authentication

Authorization

Community
Authorization

Credential

Mgmt

Delegation

Contrib/
Preview

Core

Common
Runtime

C Common

Libraries

Java
WS Core

eXtensible

IO (XIO)

C
WS Core

Python
WS Core

Data Mgmt

Info Services

Web Services
Components

Non-WS Components

GridFTP

Pre-WS
Monitoring

& Discovery

Reliable

File

Transfer

Data Access

& Integration

Index

Replica

Location

Data

Replication

Trigger

WebMDS

Depre-
cated

www.globus.org

GT4 Execution Management

Execution Mgmt

Pre-WS

Grid Resource

Alloc. & Mgmt

Grid Resource

Allocation &

Management

Community

Scheduling

Framework

Workspace

Management

Grid
Telecontrol
Protocol

Jul 11, 2005

Grid & Globus Security

10

Execution Management (GRAM)

Common WS interface to schedulers

Unix, Condor, LSF, PBS, SGE, …

More generally: interface for process execution management

Lay down execution environment

Stage data

Monitor & manage lifecycle

Kill it, clean up

A basis for application-driven provisioning

Jul 11, 2005

Grid & Globus Security

10

GT4 WS GRAM

2nd-generation WS implementation optimized for performance, flexibility, stability, scalability

Streamlined critical path

Use only what you need

Flexible credential management

Credential cache & delegation service

GridFTP & RFT used for data operations

Data staging & streaming output

Jul 11, 2005

Grid & Globus Security

10

GRAM

services

GT4 Java Container

GRAM

services

Delegation

RFT File

Transfer

Transfer

request

GridFTP

Remote

storage

element(s)

Local

scheduler

User

job

Compute element

GridFTP

sudo

GRAM

adapter

FTP

control

Local job control

Delegate

FTP data

Client

Job functions

Delegate

Service host(s) and compute element(s)

GT4 WS GRAM Architecture

SEG

Job events

Jul 11, 2005

Grid & Globus Security

10

GRAM

services

GT4 Java Container

GRAM

services

Delegation

RFT File

Transfer

Transfer

request

GridFTP

Remote

storage

element(s)

Local

scheduler

User

job

Compute element

GridFTP

sudo

GRAM

adapter

FTP

control

Local job control

Delegate

FTP data

Client

Job functions

Delegate

Service host(s) and compute element(s)

GT4 WS GRAM Architecture

SEG

Job events

Delegated credential can be:

Made available to the application

Jul 11, 2005

Grid & Globus Security

10

GRAM

services

GT4 Java Container

GRAM

services

Delegation

RFT File

Transfer

Transfer

request

GridFTP

Remote

storage

element(s)

Local

scheduler

User

job

Compute element

GridFTP

sudo

GRAM

adapter

FTP

control

Local job control

Delegate

FTP data

Client

Job functions

Delegate

Service host(s) and compute element(s)

GT4 WS GRAM Architecture

SEG

Job events

Delegated credential can be:

Used to authenticate with RFT

Jul 11, 2005

Grid & Globus Security

10

GRAM

services

GT4 Java Container

GRAM

services

Delegation

RFT File

Transfer

Transfer

request

GridFTP

Remote

storage

element(s)

Local

scheduler

User

job

Compute element

GridFTP

sudo

GRAM

adapter

FTP

control

Local job control

Delegate

FTP data

Client

Job functions

Delegate

Service host(s) and compute element(s)

GT4 WS GRAM Architecture

SEG

Job events

Delegated credential can be:

Used to authenticate with GridFTP

Jul 11, 2005

Grid & Globus Security

10

Security

Pre-WS

Authentication

Authorization

Authentication

Authorization

Community
Authorization

Credential

Mgmt

Delegation

Contrib/
Preview

Core

Common
Runtime

C Common

Libraries

Java
WS Core

eXtensible

IO (XIO)

C
WS Core

Python
WS Core

Data Mgmt

Execution Mgmt

Web Services
Components

Non-WS Components

GridFTP

Pre-WS

Grid Resource

Alloc. & Mgmt

Reliable

File

Transfer

Data Access

& Integration

Grid Resource

Allocation &

Management

Replica

Location

Community

Scheduling

Framework

Data

Replication

Workspace

Management

Grid
Telecontrol
Protocol

Depre-
cated

www.globus.org

GT4 Information Services

Info Services

Pre-WS
Monitoring

& Discovery

Index

Trigger

WebMDS

Jul 11, 2005

Grid & Globus Security

10

Monitoring and Discovery

“Every service should be monitorable and discoverable using common mechanisms”

WSRF/WSN provides those mechanisms

A common aggregator framework for collecting information from services, thus:

MDS-Index: Xpath queries, with caching

MDS-Trigger: perform action on condition

(MDS-Archiver: Xpath on historical data)

Deep integration with Globus containers & services: every GT4 service is discoverable

GRAM, RFT, GridFTP, CAS, …

Jul 11, 2005

Grid & Globus Security

10

GT4 Container

GT4
Monitoring & Discovery

GRAM

User

MDS-
Index

GT4 Cont.

RFT

MDS-
Index

GT4 Container

MDS-
Index

GridFTP

adapter

Registration &

WSRF/WSN Access

Custom protocols

for non-WSRF entities

Clients

(e.g., WebMDS)

Automated

registration

in container

WS-ServiceGroup

Jul 11, 2005

Grid & Globus Security

10

GT4 Documentation
is
Extensive!

Jul 11, 2005

Grid & Globus Security

10

Working with GT4

Download and use the software, and provide feedback

Join gt4friends@globus.org mail list

Review, critique, add to documentation

Globus Doc Project: http://gdp.globus.org

Tell us about your GT4-related tool, service, or application

Email info@globus.org

Time

Success/Maturity/Acceptance

DCE

CORBA

WebServices

Globus + OGSA + WSRF

+ WebServices

Silver Bullet Hype-Curve…

OGSA: Open Grid Services Architecture

WSRF: WebServices Resource Framework

Jul 11, 2005

Grid & Globus Security

10

Outline

Part One

Globus Toolkit Introduction

The Big Security Picture

What is Grid Security?

Current Grid Security

Part Two

2004: The year we lost control of the desktop

Leverage Security Service Implementations

GT’s Authorization Processing Framework

Futures and Conclusion

Discussion

Jul 11, 2005

Grid & Globus Security

10

Objective:
Enable Cross-Organizational Collaboration

Jul 11, 2005

Grid & Globus Security

10

Security of
Grid Brokering Services

It is expected brokers will handle resource coordination for users

Each Organization enforces its own access policy

User needs to delegate rights to broker which may need to delegate to services

QoS/QoP Negotiation and multi-level delegation

Jul 11, 2005

Grid & Globus Security

10

Security Objective:
Forceful Enforcement (?)

Jul 11, 2005

Grid & Globus Security

10

Security Services Objectives

It’s all about “Policy”

(Virtual) Organization’s Security Policy

Security Services facilitate the enforcement

Security Policy to facilitate “Business Objectives”

Related to higher level “agreement”

Security Policy often delicate balance

More security  Higher costs

Less security  Higher exposure to loss

Risk versus Rewards

Legislation sometimes mandates minimum security

Jul 11, 2005

Grid & Globus Security

10

Security: Risk versus Reward

Jul 11, 2005

Grid & Globus Security

10

Agreement  VO Security Policy

Price

Cost

Obligations

QoS

T&Cs

……………

Security

……………

trust anchors

(initial) members

(initial) resources

(initial) roles

Access rules

Privacy rules

(Business) Agreement

Dynamic

VO Security Policy

members

resources

roles

Attribute mgmt

Authz mgmt

Static Initial

VO Security Policy

Jul 11, 2005

Grid & Globus Security

10

Virtual Organization (VO) Concept

VO for each application/workload/collaboration

Carve out and configure resources for a particular use and set of users

Jul 11, 2005

Grid & Globus Security

10

Effective Policy Governing
Access Within A Collaboration

Jul 11, 2005

Grid & Globus Security

10

Why Grid Security is Hard…(1)

Resources being used may be valuable &
the problems being solved sensitive

Both users and resources need policy enforcement

Dynamic formation and management of
Virtual Organizations (VOs)

Large, dynamic, unpredictable…

VO Resources and Users are often located in distinct administrative domains

Can’t assume cross-organizational trust agreements

Different mechanisms & credentials

X.509 vs Kerberos, SSL vs GSSAPI,
X.509 vs. X.509 (different domains),

X.509 attribute certs vs SAML assertions

Jul 11, 2005

Grid & Globus Security

10

Why Grid Security is Hard…(2)

Interactions are not just client/server,
but service-to-service on behalf of the user

Requires delegation of rights by user to service

Services may be dynamically instantiated

Standardization of interfaces to allow for discovery, negotiation and use of resources/services

Implementation must be broadly available & applicable

Standard, well-tested, well-understood protocols; integrated with wide variety of tools

Policy from sites, VO, users need to be combined

Varying formats

Want to hide as much as possible from applications!

Jul 11, 2005

Grid & Globus Security

10

The Grid Trust solution

Instead of setting up trust relationships at the organizational level
(lots of overhead, possible legalities - expensive!)
=> set up trust at the user/resource level

Virtual Organizations (VOs) for multi-user collaborations

Federate through mutually trusted services

Local policy authorities rule

Users able to set up dynamic trust domains

Personal collection of resources working together based on trust of user

Jul 11, 2005

Grid & Globus Security

10

GT4 Security

VO

Users

Compute
Center

Services
(running on user’s behalf)

Rights

Local policy

on VO identity

or attribute

authority

Rights’

CAS or VOMS

issuing SAML

or X.509 ACs

Rights

SSL/WS-Security

with Proxy Certificates

Access

AuthZ Policy

Enforcement

KCA

MyProxy

Jul 11, 2005

Grid & Globus Security

10

Propagation of Requester’s Rights through
Job Scheduling and Submission Process

Dynamically limit the Delegated Rights more as Job specifics become clear

Trust parties downstream to limit rights for you…
or let them come back with job specifics such that you can limit them

Virtualization complicates Least Privilege Delegation of Rights

Jul 11, 2005

Grid & Globus Security

10

Grid Security must address…

Trust between resources without organization support

Bridging differences between mechanisms

Authentication, assertions, policy…

Allow for controlled sharing of resources

Delegation from site to VO

Allow for coordination of shared resources

Delegation from VO to users, users to resources

...all with dynamic, distributed user communities and least privilege.

Jul 11, 2005

Grid & Globus Security

10

Outline

Part One

Globus Toolkit Introduction

The Big Security Picture

What is Grid Security?

Current Grid Security

Part Two

2004: The year we lost control of the desktop

Leverage Security Service Implementations

GT’s Authorization Processing Framework

Futures and Conclusion

Jul 11, 2005

Grid & Globus Security

10

Part 2 Outline

2004: The year we lost control of the desktop

MyProxy/GridLogon, OTP/Smart-Cards, Secure-Password Protocols, Virtual Machines,…

Leverage Security Service Implementations

OpenSSL, OpenSAML, Shibboleth, Permis, Sun’s XACML, CNRI’s Handle System, … XKMS

GT’s Authorization Processing Framework

VOMS/Permis/X509/Shibboleth/SAML/Kerberos
identity/attribute assertions

XACML/SAML/CAS/Permis/ProxyCert/SPKI authorization assertions

Futures and Conclusion

Jul 11, 2005

Grid & Globus Security

10

2004: The Year we lost Control
of the Desktop

Compromised accounts, trojans, sniffers, viruses…

When compromised … not if…

New paradigm:

Try to raise bar … arms race

It’s about “Detection” and “Limit Consequences” of Compromise

New emphasis:

No more long-lived secrets with the user…

MyProxy/GridLogon

One-Time-Password & Secure Password protocols

Virtual Machine Sandboxes

Jul 11, 2005

Grid & Globus Security

10

MyProxy/GridLogon

No long-lived secrets on the user’s workstation
=> move secrets to a secure MyProxy-server

Issue derived short-lived proxy-certificates

=> issue short-lived identity certificates

On-line Certificate Authority (CA)

Need for bootstrap authentication…

Passwords

One-Time-Passwords

Need for “true” secure password protocol

Jul 11, 2005

Grid & Globus Security

10

OTP & Secure Password Protocol

One-Time-Password “issues”

Exchange in the clear - hijacking risk

No mutual authentication

Password authentication “issues”

Off-line dictionary attacks

Clear-text over SSL relies on server trust root on (untrusted) client

Need for “true” secure password protocol

Integrate OTP

Jul 11, 2005

Grid & Globus Security

10

OTP & Trust-Root Provisioning

OTP AuthN Server +

user’s security config

user-workstation

(initially not configured)

Secure mutual OTP-Authentication

and Key-Exchange

Short-Lived Cert +

Provisioning of

CA’s, AuthZ/Attr Authorities

OTP

Enhanced MyProxy/GridLogon Svc

Bootstrap User’s Trust-Root Config

from Secure OTP Authentication

Jul 11, 2005

Grid & Globus Security

10

Virtual Machines to the Rescue

VM’s provide additional insulation

Consequences of VM compromise “limited”

Host compromise “virtually” impossible

“Frozen” VM-Image of stable, tested, uncompromised OS+Services configuration

Distribution of “safe” VM-images

Allows for easy restart/resync after compromise

Interesting open source VM-efforts: Xen

Exciting & promising first results at ANL
(Tim Freeman, Kate Keahey)

Jul 11, 2005

Grid & Globus Security

10

How do Grids and VMs play toghether?

Client

request

VM EPR

inspect and manage

deploy & suspend

use existing VM image

Create

VM image

VM Factory

VM Repository

VM Manager

create new VM image

Resource

VM

start program

Jul 11, 2005

Grid & Globus Security

10

Part 2 Outline

2004: The year we lost control of the desktop

MyProxy/GridLogon, OTP/Smart-Cards, Secure-Password Protocols, Virtual Machines,…

Leverage Security Service Implementations

OpenSSL, OpenSAML, Shibboleth, Sun’s XACML, Handle System, … Permis, XKMS

GT’s Authorization Processing Framework

VOMS/Permis/X509/Shibboleth/SAML/Kerberos
identity/attribute assertions

XACML/SAML/CAS/Permis/ProxyCert/SPKI
authorization assertions

Futures and Conclusion

Jul 11, 2005

Grid & Globus Security

10

Leverage (Open Source)
Security Service Implementations

OpenSSL

“native” Proxy Certificate support coming…
(thanks to OpenSSL hacker Richard Levitte and KTH!)

Internet2’s OpenSAML

Part of GT - used by CAS/GridShib/AuthzCallout/…

Internet2’s Shibboleth

NSF funded GridShib project to “Grid-enable” Shibboleth

Sun’s open source XACML effort

Integrate sophisticated policy decision engine in the GT

CNRI’s Handle System

Leverage robust, secure, global naming system for resource/subject attribute bindings

Futures: XKMS, XrML, Permis, …

Jul 11, 2005

Grid & Globus Security

10

GT - Shibboleth Integration

NSF-funded “GridShib” Project

http://grid.ncsa.uiuc.edu/GridShib/

Leverage Shibboleth implementations and deployments

Sophisticated, policy controlled attribute service

Client-server interactions through WS-protocols

(optionally) preserve pseudonymity of client

GridShib code will become part of GT

Transparent use of Shib servers in GT-runtime

Jul 11, 2005

Grid & Globus Security

10

GridShib: Grid-Shibboleth Integration
(Identity Federation and Grids)

NSF NMI project to allow the use of Shibboleth-issued attributes for authorization in NMI Grids built on the Globus Toolkit

Funded under NSF award SCI-0438424

Goal: GT 4.2 & Shibboleth 1.3

GridShib team: NCSA, U. Chicago, ANL

Tom Barton, David Champion, Tim Freeman,
Kate Keahey, Tom Scavo, Frank Siebenlist, Von Welch

Working in collaboration with Steven Carmody, Scott Cantor, Bob Morgan and the rest of the Internet2 Shibboleth Design team

Jul 11, 2005

Grid & Globus Security

10

Why?

Leverage Shibboleth code base

Someone else is writing and debugging it

Leverage Shibboleth deployments

Someone else is supporting them

Leverage larger issues going on in Identity Federation world

Someone else is helping to write them

Even more someone else’s will be writing and deploying them

SAML standard, profiles

Leverage someone else’s attributes?

Are campus attributes useful to Grids?

Jul 11, 2005

Grid & Globus Security

10

Shibboleth (Simplified)

Attrs

IDs

Shibboleth

Handle

Handle

Attributes

SAML

Jul 11, 2005

Grid & Globus Security

10

GridShib (Simplified)

Attrs

IDs

Shibboleth

DN

Attributes

DN

DN

SAML

SSL/TLS, WS-Security

Jul 11, 2005

Grid & Globus Security

10

GridShib Integration Goals

Use Shibboleth 1.3 out of box

With additional NameMapper module to handle mapping X.509 identities to local names

Work with Shib identity provider metadata

Working with Shib developers to achieve

Don’t require modification to typical grid client applications for simple use cases

Most of work going into Grid services

Jul 11, 2005

Grid & Globus Security

10

DOE Earth System Grid

Goal: address technical obstacles to the sharing & analysis of high-volume data from advanced earth system models

www.earthsystemgrid.org

Jul 11, 2005

Grid & Globus Security

10

Major ESG Components

Grid Services

GRAM resource access

GridFTP

PURSE

MDS (+WebSDV, +Trigger Service, +Archiver)

MyProxy credential repository

SimpleCA

RLS replica location service

MCS metadata catalog service

Other Services

OpenDAPg

HPSS

SRM

LAS

Apache, Tomcat

ESG-specific services

Workflow Manager

Registration Service

Monitoring Service

Jul 11, 2005

Grid & Globus Security

10

Major ESG Components

Jul 11, 2005

Grid & Globus Security

10

ESG Authorization requirements

Access to most data requires that the name of the requesting user be logged.

Access to some private data is restricted to specific users.

Some data is located on mass storage systems to which access is restricted to users with approved PKI credentials.

Some data is located on HPSS storage behind GridFTP server

Some data is located on disk storage behind HTTPS server.

Jul 11, 2005

Grid & Globus Security

10

ESG Authorization Requirements

Access control for data accessed via portal

Group-based control to data and metadata

Variety of data return modalities, e.g.:

From portal as intermediary to servers

Directly from GridFTP server

Credentials of a variety of qualities

Higher quality via formal CA (personal review)

Lower quality via Web (email verification)

Easy to use Web sign on

MyProxy as credential repository

GSI credentials for GridFTP server access

Jul 11, 2005

Grid & Globus Security

10

PURSE: Portal-based
User Registration Service

Portal extensions (CGI scripts) that automate user registration requests.

Solicits basic data from user.

Generates cert request from ESG CA (implemented with “simple CA” from GT).

Admin interface allows CA admin to accept/reject request.

Generates a certificate and stores in MyProxy service.

Gives user ID/password for MyProxy.

Benefits

Users never have to deal with certificates.

Portal can get user cert from MyProxy when needed.

Database is populated with user data.

Users are assigned to one or several user groups (with different data access permissions)

Soon to be released…

ESG first “customer” and provided requirements

Integrated solution released through Grid Center

Jul 11, 2005

Grid & Globus Security

10

PURSe (contd.)

Jul 11, 2005

Grid & Globus Security

10

PURSe (Contd.)

Jul 11, 2005

Grid & Globus Security

10

ESG data access control

Jul 11, 2005

Grid & Globus Security

10

Earth Science Grid’s use of CAS-Assertions

Password | Username

Username | UserDN

LFile | PFile

Group | Operation | LFile

UserDN | Group

MyProxy/GridLogon used for portal authentication

MyProxy/GridLogon used for UserDN mapping

Group membership assignment

Access Policy expressed with groups,
actions and logical file names

Mapping of logical file names
to physical file paths

User with “UserDN” is allowed to invoke

“Operation” on physical file “Pfile”

SAML Authorization Assertion

signed by PortalId

Jul 11, 2005

Grid & Globus Security

10

ESG Portal Access

Portal

MyProxy

User

username

password

username

userDN

userDN

group

Group

Action

LFile

LFile

PFile

FileServer

Pfile*

PFile

login

browse

PFile retrieval

policy enforcement

username/

password

validation

userDN

mapping

PFile access

& integration

Jul 11, 2005

Grid & Globus Security

10

ESG External GridFTP Access

User browses portal to identify file(s)

Portal returns

Physical file location (URL)

SAML assertion in CAS format: “User can invoke requested operation on file(s)”

User:

Obtains proxy-certificate from MyProxy

Embeds SAML-assertion in proxy-cert

Uses GridFTP client to retrieve physical file(s) from CAS-enabled GridFTP server

Jul 11, 2005

Grid & Globus Security

10

Download with DML from any source locations

User downloads DataMover-light
(must contain GridFTP and GSI)

User goes to portal, select files

Portal does not get any file s

Portal sends email to user

Contains a text file of files to be moved

Contains instructions and lifetime

DML contacts source SRMs to get TURL
(for GridFTP it is not necessary)

Disk

Cache

NCAR’s MSS

HRM

ESG Portal

Disk

Cache

User’s

browser

DataPortal

User’s machine

DataMover

Light

DRM

HRM

GridFTP

FTP

ESG

Authorizer

(4) get SAML

(3) Provide TURL

(2) Request file(s)

From NCAR’s

MSS

(2) Request file(s)

Note:

The datamover.txt file

will contain a header with

the end-point of the
ESG Portal Authorizer

(1) Find file(s),

Get SURLs (by email)

(5) transfer file(s)

(5) transfer file(s)

DML Contact “ESG authorizer”, provides it with LFN & TURL

DML gets back SAML with long lifetime (days) for each file

DML invokes GridFTP

DML automatically releases files after it moves them

Jul 11, 2005

Grid & Globus Security

10

ESG External GridFTP Retrieval

Portal

MyProxy

User

username

password

username

userDN

userDN

group

Group

Action

LFile

LFile

PFile

GridFTP Server

PFile

login

browse

policy enforcement

Login

Proxycert Issuance

PFile URL

+ authz assertion

gridftp access

GSI-creds

Portal authz assertion

“CAS” policy enforcement

Jul 11, 2005

Grid & Globus Security

10

Reuse of Fabric & Plumbing from Community Auth. Service (CAS)

ESG-Portal uses no CAS server but generates its own authorization statements

Statements are domain specific

Same assertion format as CAS

Standard “SAML” assertion signed by PortalId

User deploys CAS-enabled GridFTP client

Deploys identical GSI creds and proxy-certs

Site uses CAS-enabled GridFTP server

Remote site trusts Portal (instead of CAS)

Portal makes access control decisions

Usage Pattern applicable to many more projects…

Jul 11, 2005

Grid & Globus Security

10

Part 2 Outline

2004: The year we lost control of the desktop

MyProxy/GridLogon, OTP/Smart-Cards, Secure-Password Protocols, Virtual Machines,…

Leverage Security Service Implementations

OpenSSL, OpenSAML, Shibboleth, Permis, Sun’s XACML, CNRI’s Handle System, … XKMS

GT’s Authorization Processing Framework

VOMS/Permis/X509/Shibboleth/SAML/Kerberos
identity/attribute assertions

XACML/SAML/CAS/Permis/ProxyCert/SPKI
authorization assertions

Futures and Conclusion

Jul 11, 2005

Grid & Globus Security

10

Security Services with VO

Jul 11, 2005

Grid & Globus Security

10

GT’s GGF’s Authorization Call-Out Support

GGF’s OGSA-Authz WG:
“Use of SAML for OGSA Authorization”

Authorization service specification

Extends SAML spec for use in WS-Grid

Recently standardized by GGF

Conformant call-out integrated in GT

Transparently called through configuration

Permis interoperability

Ready for GT4!

Futures…

SAML2.0 compliance … XACML2.0-SAML2.0 profile

Jul 11, 2005

Grid & Globus Security

10

GT-XACML Integration

eXtensible Access Control Markup Language (XACML)

OASIS standard

Open source implementations

XACML: sophisticated policy language

Globus Toolkit ships with XACML runtime

Integrated in every client and server build on GT

Turned-on through configuration

…can be called transparently from runtime and/or explicitly from application…

…and we’re using the XACML-”model” for
our Authz Processing Framework…

Jul 11, 2005

Grid & Globus Security

10

GT’s Assertion Processing “Problem”

VOMS/Permis/X509/Shibboleth/SAML/Kerberos
identity/attribute assertions

XACML/SAML/CAS/XCAP/Permis/ProxyCert
authorization assertions

Assertions can be pushed by client,
pulled from service, or locally available

Policy decision engines can be local and/or remote

Delegation of Rights is required “feature” implemented through many different means

GT-runtime has to mix and match all policy information and decisions in a consistent manner…

Jul 11, 2005

Grid & Globus Security

10

Basic Access Control Policy

Ivan

Mallory

Alice

Can I have glass of lemonade?

Ivan’s policy:

Alice is my friend and I’ll share my lemonade with her

Mallory is not my friend and he can go #$%^&

Sure, here is a glass

Can I have glass of lemonade?

No way, I don’t like you

Jul 11, 2005

Grid & Globus Security

10

Basic Access Control Policy (2)

Mallory

Alice

Can I have glass of lemonade?

Ivan’s policy:

Alice is my friend and I’ll share my lemonade with her

Mallory is not my friend and he can go #$%^&

Sure, here is a glass

Can I have glass of lemonade?

No way, I don’t like you

Ivan

Resource Owner decides!

(ultimate source of authority for access)

Jul 11, 2005

Grid & Globus Security

10

Delegation of Rights (1)

Sure, here is a glass

Can Bob have glass of lemonade?

Sure, Bob is my friend

Ivan

Ivan’s policy:

Carol is my friend and I’ll share my lemonade with her

I’ll share my lemonade with any friend of Carol

I don’t know any Bob…(?)

Can I have glass of lemonade?

Bob

Carol

Carol’s policy:

Bob is my friend and I’ll share my lemonade with him

Jul 11, 2005

Grid & Globus Security

10

Delegation of Rights (2)

Sure, here is a glass

Can Bob have glass of lemonade?

Sure, Bob is my friend

Ivan’s policy:

Carol is my friend and I’ll share my lemonade with her

I’ll share my lemonade with any friend of Carol

I don’t know any Bob…(?)

Can I have glass of lemonade?

Bob

Carol’s policy:

Bob is my friend and I’ll share my lemonade with him

Ivan

Carol

Ivan likes Carol + Carol likes Bob

=> Ivan likes Bob

(non-normative delegation logic ;-) )

Jul 11, 2005

Grid & Globus Security

10

Delegation of Rights (4)

Can Bob have glass of lemonade?

Sure, Bob is my friend

Ivan

Ivan’s policy:

I don’t know any Bob…(?)

I do know John, Mary, Carol, Olivia, …

Can I have glass of lemonade?

Bob

Carol

Carol’s policy:

Bob is my friend and I’ll share my lemonade with him

Olivia’s policy:

If Carol likes Bob, I hate him!

Mary’s policy:

I like Bob a little bit

Lucy’s policy:

I sometimes like Carol

Ann’s policy:

I like Ivan very much!

Jogger’s policy:

I’d like a glass too

John’s policy:

I don’t like girls

Bill’s policy:

Lemonade is bad for you

Frosty’s policy:

Only share lemonade with ice

Aunt’s policy:

Sharing is good

Laura’s policy:

Share if he pays!

David’s policy:

Ask Laura

Accountant’s policy:

Only if he signs here

Rita’s policy:

No lemonade after eight

Neighbor's policy:

Let’s party!

Emma’s policy:

Only on his birthday

Ivan: HELP

(non-normative evaluated decision)

Ivan

Jul 11, 2005

Grid & Globus Security

10

Delegation of Rights (5)

Can Bob have glass of lemonade?

Sure, Bob is my friend

Ivan

Ivan’s policy:

I don’t know any Bob…(?)

I do know John, Mary, Carol, Olivia, …

Can I have glass of lemonade?

Bob

Carol

Carol’s policy:

Bob is my friend and I’ll share my lemonade with him

Olivia’s policy:

If Carol likes Bob, I hate him!

Mary’s policy:

Bob, je t’aime!

Lucy’s policy:

新細明體 Carol

Ann’s policy:

Ivanの言うことは信じるわ!

Jogger’s policy:

Ich mochte auch ein glas

John’s policy:

#헤드라인A

Bill’s policy:

Herregud, ge barnen saft!

Frosty’s policy:



Aunt’s policy:



Laura’s policy:

???????????

David’s policy:

Vraag het Laura maar

Accountant’s policy:

Only if he signs here

Rita’s policy:

geen lemonade na achten

Neighbor's policy:

’!

Emma’s policy:

T’ol gimmers alreet

Jul 11, 2005

Grid & Globus Security

10

Delegation of Rights (6)

Can Bob have glass of lemonade?

Sure, Bob is my friend

Ivan

Ivan’s policy:

I don’t know any Bob…(?)

I do know John, Mary, Carol, Olivia, …

Can I have glass of lemonade?

Bob

Carol

Carol’s policy:

Bob is my friend and I’ll share my lemonade with him

Olivia’s policy:

If Carol likes Bob, I hate him!

Mary’s policy:

Bob, je t’aime!

Lucy’s policy:

新細明體 Carol

Ann’s policy:

Ivanの言うことは信じるわ!

Jogger’s policy:

Ich mochte auch ein glas

John’s policy:

#헤드라인A

Bill’s policy:



Frosty’s policy:



Aunt’s policy:



Laura’s policy:

???????????

David’s policy:

Vraag het Laura maar

Accountant’s policy:

Only if he signs here

Rita’s policy:

geen lemonade na achten

Neighbor's policy:

’!

Emma’s policy:

!@#^^&^%^*

Ivan: HELP

(non-normative evaluated decision)

(…with apologies for butchering any language or unintentionally insulting anyone…)

Ivan

Jul 11, 2005

Grid & Globus Security

10

Ivan

Can I have glass of lemonade?

Bob

Olivia

Mary

Lucy

Ann

Jogger

John

Bill

Frosty

Aunt

Laura

David

Accountant

Rita

Emma

How to solve his AuthZ decision issue? (1)

Carol

Decision Helper

Jul 11, 2005

Grid & Globus Security

10

Ivan

Can I have glass of lemonade?

Bob

Olivia

Mary

Lucy

Ann

Jogger

John

Bill

Frosty

Aunt

Laura

David

Accountant

Rita

Emma

How to solve his AuthZ decision issue? (2)

Carol

Decision Helper

Master PDP

(Decision Orchestrator)

Subject

Invocation request for operation on resource

Policy/Decision Issuers

Resource Owner + Policy Issuer

Jul 11, 2005

Grid & Globus Security

10

Ivan

Can I have glass of lemonade?

Bob

Olivia

Mary

Lucy

Ann

Jogger

John

Bill

Frosty

Aunt

Laura

David

Accountant

Rita

Emma

How to solve his AuthZ decision issue? (3)

Carol

Decision Helper

Resource Owner + Policy Issuer

Subject

Invocation request for operation on resource

Master PDP

All AuthZ Decision Queries are asked

through Standardized Interface

All Decision Results are PERMIT/NotApplicable(/DENY)

All differences in policy, policy language, kind/use of rules

are hidden behind the interface

Standardized AuthZ Query Interface

Jul 11, 2005

Grid & Globus Security

10

Ivan

Can I have glass of lemonade?

Bob

Olivia

Mary

Lucy

Ann

Jogger

John

Bill

Frosty

Aunt

Laura

David

Accountant

Rita

Emma

How to solve his AuthZ decision issue? (4)

Carol

Decision Helper

Policy/Decision Issuers

Resource Owner + Policy Issuer

Subject

Invocation request for operation on resource

Master PDP

Can subject invoke operation on resource?

Resource’s PEP asks Master-PDP for decision

Jul 11, 2005

Grid & Globus Security

10

Ivan

Can I have glass of lemonade?

Bob

Olivia

Mary

Lucy

Ann

Jogger

John

Bill

Frosty

Aunt

Laura

David

Accountant

Rita

Emma

How to solve his AuthZ decision issue? (5)

Carol

Decision Helper

Policy/Decision Issuers

Resource Owner + Policy Issuer

Subject

Invocation request for operation on resource

Master PDP

Can subject invoke operation on resource?

Master-PDP asks Resource Owner for decision

If resource owner permits,

then final decision is PERMIT,

because resource owner decides

else…

Jul 11, 2005

Grid & Globus Security

10

Ivan

Can I have glass of lemonade?

Bob

Olivia

Mary

Lucy

Ann

Jogger

John

Bill

Frosty

Aunt

Laura

David

Accountant

Rita

Emma

How to solve his AuthZ decision issue? (6)

Carol

Decision Helper

Policy/Decision Issuers

Resource Owner + Policy Issuer

Subject

Invocation request for operation on resource

Master PDP

Master-PDP asks all possible policy issuers one-by-one

if they allow the subject to invoke the operation on the resource

Can subject invoke operation on resource?

Jul 11, 2005

Grid & Globus Security

10

Ivan

Can I have glass of lemonade?

Bob

Olivia

Mary

Lucy

Ann

Jogger

John

Bill

Frosty

Aunt

Laura

David

Accountant

Rita

Emma

How to solve his AuthZ decision issue? (7)

Carol

Decision Helper

Policy/Decision Issuers

Resource Owner + Policy Issuer

Subject

Invocation request for operation on resource

Master PDP

Master-PDP asks all possible policy issuers one-by-one

if they allow the subject to invoke the operation on the resource

Can subject invoke operation on resource?

Jul 11, 2005

Grid & Globus Security

10

Ivan

Can I have glass of lemonade?

Bob

Olivia

Mary

Lucy

Ann

Jogger

John

Bill

Frosty

Aunt

Laura

David

Accountant

Rita

Emma

How to solve his AuthZ decision issue? (8)

Carol

Decision Helper

Policy/Decision Issuers

Resource Owner + Policy Issuer

Subject

Invocation request for operation on resource

Master PDP

For each policy issuer that permits the access,

The Master-PDP asks the resource owner

if that policy issuer is allowed

to administer the access to the resource

If so, final decision is PERMIT, else…

Can Carol administer access to resource?

PERMIT!

Jul 11, 2005

Grid & Globus Security

10

Ivan

Can I have glass of lemonade?

Bob

Olivia

Mary

Lucy

Ann

Jogger

John

Bill

Frosty

Aunt

Laura

David

Accountant

Rita

Emma

How to solve his AuthZ decision issue? (9)

Carol

Decision Helper

Policy/Decision Issuers

Resource Owner + Policy Issuer

Subject

Invocation request for operation on resource

Master PDP

For each policy issuer that permits the access,

The Master-PDP asks the other policy issuers

if that policy issuer is allowed

to administer the access to the resource

Carol permits

Bob access

Can Carol administer access to resource?

Jul 11, 2005

Grid & Globus Security

10

Ivan

Can I have glass of lemonade?

Bob

Olivia

Mary

Lucy

Ann

Jogger

John

Bill

Frosty

Aunt

Laura

David

Accountant

Rita

Emma

How to solve his AuthZ decision issue? (10)

Carol

Decision Helper

Policy/Decision Issuers

Resource Owner + Policy Issuer

Subject

Invocation request for operation on resource

Master PDP

Carol permits

Bob access

Laura permits

Carol to administer access

Can Laura administer access to resource?

PERMIT!

For each policy issuer that permits the administration,

The Master-PDP asks the resource owner

if that policy issuer is allowed

to administer the access to the resource

If so, final decision is PERMIT, else…

try next level of delegation… until no more…

Jul 11, 2005

Grid & Globus Security

10

What are the Grid/P2P issues with “distributed authorization”? (1)

Many different parties want to express their opinion about each other’s access rights

Anybody can say anything about anyone else

Expressed in many different languages

Enforcement of single policy language impossible/not-desirable

Some parties can be asked about their opinion

Expose themselves as an AuthZ-oracle (PDP)

Other parties send their opinion as statements

Authenticated policy/decision statements/assertions expressed in their favorite language

Jul 11, 2005

Grid & Globus Security

10

What are the Grid/P2P issues with “distributed authorization”? (2)

Some of that advise is from parties you’ve never met before

So they must be empowered by those you do know…

Some advise does not apply, is mal-formed, malicious, fake, erroneous, ….

…often you do not know that by looking at them…

Different parties will use different names for the same subject

Need identity federation for mapping

Different parties will use different groups/roles in their policy expressions

Only the group/role that is actually used in a relevant policy expression is of interest…

Jul 11, 2005

Grid & Globus Security

10

Ivan

Can I have glass of lemonade?

Bob

Olivia

Mary

Lucy

Ann

Jogger

John

Bill

Frosty

Aunt

Laura

David

Accountant

Rita

Emma

Identity/Attribute Federation Requirements (1)

Carol

Decision Helper

This is Bill

Aunt calls him William

His sister Rita calls him Will

His big brother David calls him Billie

Bill doesn’t want you to know what his girlfriend Olivia calls him…

Each of those policy issuers

express their policy-rules using “their”name for Bill

The policy evaluator needs to map/federate those different names

in order to be able to apply the rules correctly

Jul 11, 2005

Grid & Globus Security

10

Ivan

Can I have glass of lemonade?

Bob

Olivia

Mary

Lucy

Ann

Jogger

John

Bill

Frosty

Aunt

Laura

David

Accountant

Rita

Emma

Identity/Attribute Federation Requirements (2)

Carol

Decision Helper

These are Emma’s “friends”

The attribute/group “friends” is local to the issuer

The policy evaluator needs to maintain issuer info with local attributes

in order to be able to apply the rules correctly

At evaluation time we need to understand what are the “local names”,

“global” names, or “guaranteed unique names within the context”

These are Lucy’s “friends”

Jul 11, 2005

Grid & Globus Security

10

Negative Permissions are Evil!

General advise: don’t use “Deny”

“clarity” issues with understanding consequences of individual “deny” policy rules

Policy becomes too complex too soon

Pushing of Deny-assertions + DoS
=> Security Exposure

…but, but, but, …. we need/want “deny”!

No you don’t ;-)

You want black-lists!

Jul 11, 2005

Grid & Globus Security

10

Black List Services

BL-PDPs return Deny or Not-Applicable

Master-DPD treats “Permit” as Not-Applicable

Only interested whether the black-list services deny access to the subject

They are not to be used for rendering of general purpose policy decisions

Query the configured black-list services before the general purpose PDPs

Pushing of black-list assertions or EPRs not allowed

“Deny-Override” rules for the black-list services

…pragmatic way to address deny-requirements…

note that you are still allowed to shoot yourself in the foot with deny-policies “behind” the PDP interface…

Jul 11, 2005

Grid & Globus Security

10

Ivan

Can I have glass of lemonade?

Bob

Olivia

Mary

Lucy

Ann

John

Laura

David

Rita

Emma

Black-List PDPs/Services

Carol

Decision Helper

Resource Owner + Policy Issuer

Subject

Master PDP

For each decision query,

Master-PDP consults Black-List PDPs

before querying General PDPs

Black-List

PDPs

mother

father

teacher

administrator

General

PDPs

Jul 11, 2005

Grid & Globus Security

10

Can Bob have glass of lemonade?

Sure, Bob is my friend

Ivan

Ivan’s policy:

I don’t know any Bob…(?)

I do know John, Mary, Carol, Olivia, …

Can I have glass of lemonade?

Bob

Carol

Carol’s policy:

Bob is my friend and I’ll share my lemonade with him

Olivia’s policy:

If Carol likes Bob, I hate him!

Mary’s policy:

Bob, je t’aime!

Lucy’s policy:

新細明體 Carol

Ann’s policy:

ヒラギノ角ゴ Ivan ラギノ!

Jogger’s policy:

Ich mochte auch ein glas

John’s policy:

#헤드라인A

Bill’s policy:



Frosty’s policy:



Aunt’s policy:



Laura’s policy:

???????????

David’s policy:

Vraag het Laura maar

Accountant’s policy:

Only if he signs here

Rita’s policy:

geen lemonade na achten

Neighbor's policy:

’!

Emma’s policy:

!@#^^&^%^*

Different Policy Languages Issue

Jul 11, 2005

Grid & Globus Security

10

Requirement for an
Policy Evaluation Service (“PES”)

Like a PDP, but in addition, you also supply the policy rules/statements to evaluate

PES is an (external) service that the relying party “trusts” to evaluate an AuthZ decision

Solves the issue that not all runtimes have the evaluation engines available to determine whether received policy decisions/statements/assertions apply

One PES implementation for each policy language flavor

…the PDP interface could be extended to accommodate policy statements as an input parameter

Jul 11, 2005

Grid & Globus Security

10

Attribute/Authorization Processing

Jul 11, 2005

Grid & Globus Security

10

Authz Processing Assumptions (1)

All Policy Statements, PDPs and Authz-Decisions have Issuer associated with them

“someone” has to take responsibility for statements and associated decisions

Resource Owner is the Ultimate Authority

Any statement/decision that can not be directly traced back to the owner is NotApplicable

“traced back”: delegation chain that starts with owner

Two different Policy Statements and Queries

Admin Policy Statements

Issuer states that certain admin-subject are allowed to administer the rights of certain access-subjects to invoke certain operations on certain resources.

Access Policy Statements

Issuer states that certain access-subject are allowed to invoke certain operations on certain resources.

Jul 11, 2005

Grid & Globus Security

10

Authz Processing Assumptions (2)

“Push-Pull” Equivalence

Pushing authz-assertion and evaluating it locally renders same decision as evaluating the same policy statements remotely behind an external PDP

Authz-Decisions are Policy Statements

Folded over the request context

Could optimize by only considering the attributes used to render a decision…

If attributes don’t specify a “invocation context”, then only the invoker’s identity would suffice…

Conservative: mandate that all request context’s attributes values are equal to the ones that rendered the decision.

Jul 11, 2005

Grid & Globus Security

10

Attribute Collection Framework

Jul 11, 2005

Grid & Globus Security

10

GT’s Authorization Processing Model (1)

Use of a Policy Decision Point (PDP) abstraction that conceptually resembles the one defined for XACML.

Normalized request context and decision format

Modeled PDP as black box authorization decision oracle

After validation, map all attribute assertions to XACML Request Context Attribute format

Create mechanism-specific PDP instances for each authorization assertion and call-out service

The end result is a set of PDP instances where the different mechanisms are abstracted behind the common PDP interface.

Jul 11, 2005

Grid & Globus Security

10

GT’s Authorization Processing Model (2)

The Master-PDP orchestrates the querying of each applicable PDP instance for authorization decisions.

Pre-defined combination rules determine how the different results from the PDP instances are to be combined to yield a single decision.

The Master-PDP is to find delegation decision chains by asking the individual PDP instances whether the issuer has delegated administrative rights to other subjects.

the Master-PDP can determine authorization decisions based on delegated rights without explicit support from the native policy language evaluators.

Jul 11, 2005

Grid & Globus Security

10

GT Authorization Framework (1)

Jul 11, 2005

Grid & Globus Security

10

GT Authorization Framework (2)

AAA/PERMIS/XACML

PDP

AAA

token

AAA

PDP

Jul 11, 2005

Grid & Globus Security

10

GT Authorization Framework (3)

Jul 11, 2005

Grid & Globus Security

10

GT Authorization Framework (3)

Master-PDP accessed all mechanism-specific PDPs through same Authz Query Interface

SAML-XACML-2 profile

Master PDP acts like XACML “Combinator”

“Permit-Overrides” rules

Negative permissions are evil…

Delegation-chains found through exhaustive search

…with optimization to evaluate cheap decisions first…

“Blacklist-PDPs” are consulted separately

Statically configured, call-out only PDPs

Deny-Overrides only for the blacklist-PDPs…

Pragmatic compromise to keep admin simple

Jul 11, 2005

Grid & Globus Security

10

Big Picture & Conclusion

GT4 is security buzzword compliant!

…probably the most full-featured-security ws-toolkit…

WebServices technologies provide low-level plumbing

following all relevant standards

Portals growing as a user interface

Clients use http-browsers,
… but portals will use WS-protocols!

PURSE, ESG, GridSite, LEAD Portal, …

New Deployment Paradigms (GridLogon, VMs)

Driven by inability to protect…

Authorization still the big focus

“unification framework” needed to support different mechanisms and formats => GT4.2

Required for fine-grained VO-policy

http://www.mcs.anl.gov/~franks/presentations/GT-Security-Jul-11-2005-adam.ppt
(http://tinyurl.com/9b93c)

Jul 11, 2005

Grid & Globus Security

10

Q?

“Provisioning” – reservation to configuration to … … make sure resource will do what I want it to do, with the right qualities of service

Virtualization = separation of concerns between provider & consumer of “content”

Client and service

Service provider and resource provider

Provisioning = assemble & configure resources to meet user needs

Management = sustain desired qualities of service despite dynamic environment

Future: integration of provisioning

E.g., storage reservation

WebMDS: configurable via XSLT style sheets

Tongue-in-cheek slide

But it shows the imminent demise of DCE and CORBA,

and that the current webservices miss a lot of features needed for Grid computing or any distributed computing

ISOC & Gridforum Masterclass: The Globus Security Architecture

Frank Siebenlist

2009-04-22T21:24:48