Grid security

Typical Grid Scenario
Users
Resources

What do we want from security?
 Identity
 Authentication
 Privacy
 Integrity
 Authorization
 Single sign-on
 Delegation

Identity & Authentication
 Each entity should have an identity
 Who are you?
 Example: Unix login name
 Authentication:
 Prove your identity
 Stops masquerading imposters
 Examples:
 Passport
 Username and password

Privacy
Medical Record
Patient no: 3456

Integrity
Run myHome/whoami
Run myHome/rm –f *

Message Protection
 Sending message securely
 Integrity
 Detect whether message has been tampered
 Privacy
 No one other than sender and receiver should be able to
read message

Authorization establishes rights to do
actions
 What can a particular identity do?
Examples:
 Are you allowed to read this file?
 Are you allowed to run a job on this machine?
 Unix read/write/execute permissions
 Must authenticate first
 Authentication != authorization

Single sign on
 Log on once
 Type password once
 Use any grid resource without typing password
again

Delegation
 Resources on the grid can act as you
 Example: Execution jobs can transfer files
 Delegation can be restricted
 For example: Delegation only valid for a short period of
time

Cryptographic Keys, the building block of
cryptography, are collections of bits
 The more bits that you
have, the stronger is the
key
 Public key cryptography
has two keys:
 Public key
 Private key
0 1 0 1 0 0 1 1 1 0
1 0 1 1 1 1 0 1 1 1

Encryption takes data and a key, feeds it
into a function and gets encrypted data out
 Encrypted data is, in
principal, unreadable
unless decrypted
Encryption
Function
<data>

Decryption feeds encrypted data & a key
into a function and gets the original data
 Encryption and
decryption functions are
linked
Decryption
Function
<data>

Digital Signatures let you verify aspects of
the data
 Who created the data
 That the data has not
been tampered with
 Does not stop other
people reading the data
 Combine
encryption+signature

Public Key Infrastructure (PKI) provides
Identity
 X.509 certificate
 Associates an identity with
a public key
 Signed by a Certificate
Authority
Owner

John Doe
755 E. Woodlawn
Urbana IL 61801
BD 08-06-65
Male 6’0” 200lbs
GRN Eyes
State of
Illinois
Seal
Certificates are similar to passports or
identity cards
Name
Issuer
Public Key
Validity
Signature
Valid Till: 01-02-2008

Certification Authorities (CAs) sign
certificates
 CAs are small set of
trusted entities
 CA certificates must be
distributed securely
Issuer?
Name
Validity
Public Key

Each CA has a Certificate Policy (CP)
 The Certificate Policy states:
 To whom the CA will issue certificates
 How the CA identifies people to whom it will issue
certificates
 Lenient CAs don’t pose security threat because
resources determine the CAs they trust.

Grid Security Infrastructure (GSI) allows
users & apps to securely access resources
 Based on PKI
 A set of tools, libraries and protocols used in
Globus
 Uses SSL for authentication and message
protection
 Adds features needed for Single-Sign on
 Proxy Credentials
 Delegation

In GSI, each user has a set of credentials
they use to prove their identity on the grid
 Consists of a X509 certificate and private key
 Long-term private key is kept encrypted with a pass
phrase
 Good for security, inconvenient for repeated usage

GSI Proxy credentials are short-lived
credentials created by user
 Short term binding of user’s identity to alternate
private key
 Same identity as certificate
 Stored unencrypted for easy repeated access
 Short lifetime in case of theft

GSI: Single Sign-on
 Single sign-on
 Uses proxies
 Type in password once, make a proxy with no password
 Features:
 Allow easy repeated access to credentials
 Limit risk of misuse on theft
 Allow process to perform jobs for user

GSI delegation allows another entity to run
using your credentials
 Other entity gets a proxy with your identity
 Other entity can run as you
 only for limited time
 for specific purpose
 For example, a compute job might want to transfer
files on your behalf.

Authorization
 Types
 Server side authorization
 Client side authorization
 Examples
 Self authorization
 Identity authorization

Gridmap is a list of mappings from allowed
DNs to user name
"/C=US/O=Globus/O=ANL/OU=MCS/CN=Ben Clifford” benc
"/C=US/O=Globus/O=ANL/OU=MCS/CN=MikeWilde” wilde
 Commonly used in Globus for server side
 ACL + some attribute
 Controlled by administrator
 Open read access

MyProxy
 Developed at NCSA
 Credential Repository with different access
mechanism (e.g username/pass phrase)
 Can act as a credential translator from
username/pass phrase to GSI
 Online CA
 Supports various authentication schemes
 Passphrase, Certificate, Kerberos

MyProxy: Use Cases
 Credential need not be stored in every machine
 Used by services that can only handle username
and pass phrases to authenticate to Grid. E.g. web
portals
 Handles credential renewal for long-running tasks
 Can delegate to other services

Grid security

More Related Content

What's hot (20)

Similar to Grid security (20)

Recently uploaded (20)

Grid security

Editor's Notes