View
213
Download
0
Category
Preview:
Citation preview
Overview of Security Standards in the Grid
CSE 225High Performance
andComputational Grids
Spring 2000
Prepared Bykwalsh@ucsd.edu
Objectives:
• Gain familiarity with computer and network security standards.
• Gain understanding of security requirements in Grid environments.
• Gain understanding of some standards based security technologies present in Grid environments.
• Learn about various Grid security models and system approaches to security.
• Learn about some test bed implementations of security enabled Grid projects.
Technology Standards SSH PGP
SSL X.509 PKI Kerberos DCE IPSec VPN
Security Requirements
Authentication
Authorization
Assurance
Accounting
Audit
Integrity
Confidentiality
SD
Sunmicrosystem
Sun E10K
vBns AbileneCommodity
InternetCalren
198.32.248.0
UNIVERSITYUNIVERSITY
UNIVERSITY
UNIVERSITY
Virtual ULegion UCondor Flock U
SD
Sunmicrosystem
Sun E10K
Globus U
UNIVERSITY
SD
Sun SPARCcluster 1
Sun
SPARCclassicSun
Sun
SPARCclassicSun
Sun
SPARCclassicSun
Sun
SPARCclassicSun
Sun
SPARCclassicSun
Sun
SPARCclassicSun
Sun
SPARCclassicSun
Sun
SPARCclassicSun
Sun
SPARCclassicSun
Sun
SPARCclassicSun
Sun
SPARCclassicSun
Sun
SPARCclassicSun
SD
Sun SPARCcluster 1
SD
Sunmicrosystem
Sun E10K
SD
Sunmicrosystem
Sun E10K
Grid U
From Grid U's policy perspective, what are the securityrequirements of Condor, Legion, Globus, and the commodityInternet?
Security Domains
• Intradomain - internal to a given location or single organization. Contained security boundary.
• Interdomain - encompasses two or more locations or organizations. Agreed on security boundaries and protocols between organizations.
Security - The Protection of Assets
• Prevention: take measure that protect your assets from damage
• Detection: take measures that allow you to detect when an asset has been damaged, and who caused the damage.
• Reaction: take measures that allow you to recover your assets or recover from damage to your assets.
Computer Security
• Confidentiality: prevention of unauthorized disclosure of information.
• Integrity: prevention of unauthorized withholding of information.
• Availability: prevention of unauthorized withholding of information or resources.
Network Security (1)
• Trusted Networks• Identification and Authentication• Discretionary Access Control• Labels and Mandatory Access Control• Audit
Technology - Cryptography
• DES (Data Encryption Standard)• DSA (Digital Signature Algorithm)• RSA (Rivest, Shamir, and Adelman)• Blowfish• IDEA (International Data Encryption Algorithm)• AES (Advanced Encryption Standard)
Technology - SSH (1)
• SSH is a packet-based binary protocol that implements a transport layer security mechanism.
• Encompasses authentication, key exchange, encryption, and integrity.
• TCP/IP is used as the transport usually• Basically an end to end encrypted tunnel• SSH logins the most prevalent between domains.
Technology - SSH (2)
Technology - PGP
• Pretty Good Privacy• Public Domain• Popular for email and email of files• PGP user builds key ring of all public keys he has
been given.• When message of file received from contact, can
decrypt if key is on key ring
Shortcomings of PGP in distributed systems
• Reasonable basis for key management among friends, but once it passes the bounds of direct friends, the credibility becomes strained.
• Example– Carol’s key is P1 signed with P2– Alice’s key is P2 signed with P4– Carol’s key is P1 signed with P5
• What is the last certificate said Carol’s key is P3 signed with P5?
Kerberos (1)
• Supports authentication in distributed systems.• Used for authentication between intelligent
processes, client to server tasks or workstation to other hosts.
• Basis of Kerberos is central server that provides authenticated tokens, called tickets.
Kerberos (2)Initiating Kerberos Session
UserU Ticket
GrantingServer
Session KeySg
Ticket Tg
SessionKey Sg
KerberosServer
Encrypted under password
1
2U's
Idenity
Encrytped Under KS-TGSKey
2
Kerberos (3)Obtaining a ticket to access file
UserU
TicketGrantingServer
Ticket to FileServer to Access
File F +Sf
Request toaccess File F
1
2
Encrypted Under TGS-F Key +Sf
Kerberos (4)Strengths
• No password communicated on the network.• Cryptographic protection against spoofing.• Limited period of validity• Time stamps to prevent replay attacks• Mutual authentication
Kerberos (5)Shortcomings in distributed systems
• Requires continuous availability of a trusted ticket granting service.
• Authenticity of servers requires a trusted relationship between the ticket granting server and every server.
• Requires timely transactions.• Subverted workstation can save and later replay user
passwords.• Does not scale well.
Public Key Infrastructure (1)
• PKI: consists of software and procedures put in place by an organization
• Supports the use of Public Keys for authentication and identifying users, services, and confirming digital signatures.
• Public keys usually conform to the X.509 standard for certificates, and usually are based on the RSA public/private key encryption algorithm
Public Key Infrastructure (2)Goals
• Application enabler • Secure Sign-On
– Secure “Single” Sign Security• End-User Transparency• Comprehensive Security
Public Key Infrastructure (3)Components and Services
• Certification Authority
• Certificate repository
• Certificate Revocation
• Key backup and recovery
• Automatic key update
• Key history management
• Cross-certification
• Support for non-repudiation
• Time stamping
• Client software
Public Key Infrastructure (4)Current Standards Activities
• X.509• PKIX• X.500• LDAP• S/MIME• IPsec• TLS
Section Break
• Security in Legion and Globus
Security in Legion (1)Design Principals
• 1- As in the Hippocratic Oath, do no harm!
• 2- Caveat emptor - let the buyer beware.
• 3- Small is beautiful.
Security in LegionStandards
• X.509 ?
• Keberos ?
Security in LegionLegion Security Model
Security in Legion (2)Basic Concepts
• Every object provides certain known member functions - MayI, CanI, Iam, and Delegate. (Can be defaulted to NIL.)
• Two objects associated with each operation: a responsible agent (RA) and a calling agent (CA)
• Every invocation of member function is performed in the context of a certificate which contains the Legion Object ID. Certificate digitally signed by maker
Security in Legion
Security in Legion
• Legion users responsible for own security.• Object might trust that the CA is correct.• Policies defined by objects themselves.• Every class defines a special member function, MayI. • MayI defines the security objects for a class.• Every member function invocation permitted only if
MayI sanctions it.
Security in LegionAutomatic invocation of outgoing calls
Security in Legion
• Authentication aided by use of Legion certificates - based on public-key cryptography by default. Must know private key to authenticate.
• MayI functions can code their own authentication protocols
• Every Legion object required to supply special member function Iam for authentication purposes.
Security in Legion
• Login establishes user identity and creates responsibility agent for user.
• Login is building block for authentication and delegation.
• Object can delegate new certificate to delegate rights.
• Delegation policy defined by object.
Security in LegionFuture Work
• Legion does not specify any particular encryption. Future standardization?
• Legion eschews distinguished trusted objects - centralized key management server
• Composition of a security policy
Security in Globus (1)Standards
• Standards subscribed to:– Generic Security Services (GSS) RFC 2078– Secure Socket Layer (SSL)
• [SSleay]
– Public Key Cryptography based on X.509 certificates
– Kerberos
Security in Globus (2)
Security in Globus (3)Security Requirements
• Single sign-on• Protection of credentials• Interoperability with local security solutions• Exportability• Uniform credentials/certification infrastructure• Support for secure group communication• Support for multiple implementations
Layered Architecture
Applications
Core ServicesMetacomputing
Directory Service
GRAMGlobus
Security Interface
Heartbeat Monitor
Nexus
Gloperf
Local Services
LSF
Condor MPI
NQEEasy
TCP
SolarisIrixAIX
UDP
High-level Services and Tools
DUROC globusrunMPI Nimrod/GMPI-IO CC++
GlobusView Testbed Status
GASS
Security in Globus (4)
• assumes grid consists of multiple trust domains • assumes resource pool and user population are large
and dynamic • interoperate with local security solutions - local
security policies differ • authentication exportable - cannot directly or
indirectly require use of bulk privacy
Security in Globus (5)
• uniform credentials/certification - a user will be associated differently with site it has access to single logon - number of processes used in a computation will be dynamic access control
Security in Globus (8)
Security in Globus (6)Grid Security Infrastructure
• GSI provides authentication and data integrity (data signing, not encryption) services for Unix and Windows client/server programs
• Can utilize an X.509 PKI• GSI library is layered on top of the SSLeay• Performs the X.509 certificate handling and SSL
protocol.
Single sign-onvia “grid-id”
User
User Proxy
GlobusGlobusCredentialCredential
Site 1
Kerberos
GRAM Process
Process
ProcessGSI
TicketTicket
Site 2
Public Key
GRAM
GSI
CertificateCertificate
Process
Process
Process
Authenticatedinterprocess
communication
CREDENTIAL
GSSAPI:multiplelow-level
mechanisms
Mutualuser-resourceauthentication
Mappingto local ids
Assignment of credentials to“user proxies”
Security in Globus (7)
Technology Standards SSH PGP
SSL X.509 PKI Kerberos DCE IPSec VPN
Security Requirements
Authentication x x x x x x
Authorization x x x x x x x
Assurance x x x x x x
Accounting x x
Audit x x
Integrity x x x x x x
Confidentiality x x x x x x x
Summary
• Computer security is machine access centric• Network security is network access centric• Grid security is application centric• Inter-domain communications based upon common
security standards such as PKI.• Metacomputing approach that embrace security
standards will be more widely adopted.
Sources:
Clifford NeumanSecurity, Accounting, AssuranceChapter 16The Grid: Blueprint for a Future Computing Infrastructure
R. Butler, D. Engert, I. Foster, C. Kesselman, S. Tuecke, J . Volmer, V. WelchDesign and Deployment of a National-Scale Authentication Infrastructurehttp://www.globus.org/documentation/incoming/gsi-deploy.pdf
PKI/GSI: NPACI's Public Key Infrastructure/Grid Security InfrastructureAn interview with SDSC's Wayne SchroederNPACI OnlineVolume IV Issue 5 - March 8, 2000http://www.npaci.edu/online/v4.5/pki-gsi.html
I. Foster, C. Kesselman, G. Tsudik, S. TueckeA Security Architecture for Computational Grids1) ftp://ftp.globus.org/pub/globus/papers/security.pdf
Computer Security BasicsDeborah Russell and G.T Gangemi Sr.
Security in ComputingCharles P. Pfleeger
Network SecurityCharlie Kaufman, Radia Perlman, Mike Speciner
Computer SecurityDieter Gollmann
Understanding Public-Key InfrastructureConcepts, Standards, and Deployment ConsiderationsCarlisle AdamsSteve Lloyd
Globus Security Infrastructure (GSI)http://www.globus.org/security/
A Security Architecture for Computational GridsI. Foster, C. Kesselman, G. Tsudik, S. Tuecke, Proc. 5th ACM Conference onComputer and Communications Security Conferenceftp://ftp.globus.org/pub/globus/papers/security.pdf
GSSAPI SSLEAY for Globus SecurityPresentation by Douglas Engerthttp://www.globus.org/presentations/gssapi/sld001.htm
A New Model for Security for MetasystemsSteve J . Chapin, Chenxi Wang, William A. Wulf, Fritz Knabe, and AndrewGrimshaw
Legion System Administrator Manual 1.61) http://www.cs.virginia.edu/~legion/documentation/sysadmin_1.6.pdf
Recommended