## DOE/MICS Quarterly Project Report Date: November 15, 2002

Project Title: Security and Policy for Group Collaboration

Project Type: SciDAC

PIs:

Steven Tuecke, tuecke@mcs.anl.gov Carl Kesselman, carl@isi.edu

Institutions:

Argonne National Laboratory

Information Sciences Institute

# 1. Executive Summary

**Principal Sites:**

ANL Argonne National Laboratory

ISI University of Southern California, Information Sciences Institute

UW University of Wisconsin, Madison

During this period, ANL and ISI worked primarily on:

1.  The Community Authorization Service (CAS), including additions to
    the core GSI infrastructure to support CAS.

2.  Standards and outreach particularly in the area of security
    specifications for the Open Grid Service Architecture (OGSA).

During this period, UW-Madison has been working on the following items:

1.  Support for private networks and firewalls

2.  ClassAd matchmaking analyzer

3.  Investigatory work on infrastructure interoperability

4.  Enhancement to Condor's security infrastructure

A project web site with up to date information is maintained at:

http://www-fp.mcs.anl.gov/dsl/scidac/security/

# 2. Current Accomplishments

Accomplishments during this period include:

\* Publications and presentations:

-   November: Published [Fine-Grain Authorization for Resource
    Management in the Grid
    Environment](http://www.globus.org/research/papers.html#gauth02). in
    Grid2002 Workshop based on research with are doing with SciDAC
    National Fusion Collaboratory.

-   August: Presentation of Grid Security at International Workshop on
    Certification and Security in E-Services (CSES 2002), Montreal,
    Canada.

-   July: Authored, in conjunction with IBM, [OGSA Security Roadmap and
    Architecture documents](http://www.globus.org/ogsa/Security/)

-   July: Produced a document containing [Globus Firewall
    Interoperability
    Requirements.](http://www.globus.org/security/v2.0/Globus Firewall Requirements-0.3.pdf)

\* Standards:

-   Presentation of [OGSA Security Roadmap and Architecture
    documents](http://www.globus.org/ogsa/Security/) (in conjunction
    with IBM) to GGF. Formed and participated in OGSA Security WG in GGF
    in Chocago.

-   October: Submitted new Proxy Certificate draft to IETF PKIX working
    group. Started conversations to bring draft up for final
    consideration by group.

-   July: Joined the Oasis organization to participate and drive
    security standards and contribute requirements and perspectives of
    the DoE community.

\* Software:

-   November: Integration of CAS with Striped FTP server for SciDAC
    Earth System Grid SuperComputing demonstration.

-   October: Globus Toolkit v4 technology preview released including
    initial implementations of portions of OGSA security.

-   September: CAS AlphraR2 releases to collaborators. Includes
    modications based on feedback from PPDG, ESG, DOE SG and others.

-   September: Globus Toolkit 2.2 releases with full support for GGF
    GSSAPI extensions.

# Standards

We successfully reached closure on both the Proxy Certificate and GSSAPI
extension drafts in the GGF GSI work group this quarter. We are making a
last attempt to gain acceptance of the Proxy Certificate draft in IETF
in the PKIX working group, but expect both of these drafts to emerge as
standards in one body or the other shortly.

We also undertook a major standards effort in the Open Grid Services
Architecture (OGSA) area. This effort has is ongoing in both the Global
Grid Forum, where we have authored, with IBM, a Security Architecture
and Security Roadmap document for OGSA. We presented these document at
GGF5 in Scotland and formed a OGSA Security working group to guide the
development of security specifications for OGSA. This work draws on the
experience gained during the last year from this SciDAC security
project, and is likely to be the avenue that we take toward
standardization of the approaches developed in this project.

We also have become a member of the OASIS standards body which is
developing a number of the Web Services security specifications. We are
actively participating in working groups in OASIS allowing us represent
requirements for OGSA and the DoE community in these developing
standards.

# Software Development: Community Authorization Service, GSI, GT3

We shipped the second alpha release of the Community Authorization
Service (CAS) software in September. This release included substantial
feedback from the PPDG and ESG security communities -- in particular, to
meet their stated requirements of greater site control.

We integrated the new CAS release into the striped FTP server in order
to demonstrate in conjunction with the ESG community for SuperComputing
\'02 in November.

In September of 2002 we also released Globus Toolkit 2.2 which included
the Grid Security Infrastructure (GSI) software with full support for
the GSSAPI extensions GGF draft.

In October of 2002 we released the 4th technology preview (pre-alpha)
release of the Globus Toolkit version 3. This version is based of the
emerging OGSA standards and includes implementations of GSI
authentication of SOAP.

# Support for private networks and firewalls

We have done extensive work in order to provide support for institutions
with private networks or firewalled clusters. Two systems have been
developed as a result of this work: Dynamic Port Forwarding (DPF) and
Generic Connection Brokering (GCB).

DPF is very efficient and highly scalable, but it only supports
NAT-based private (and firewalled) network since it is tightly coupled
with NAT technology. DPF has been fully tested and the beta version has
been deployed and is currently running well at several sites. For
example, UW-Milwaukee has a Condor pool with 300 nodes inside its
private network and they are running DPF with no problem.

GCB is a little slower and less scalable than DPF, however it is not
restricted by the institutions since it is not coupled with any private
network or firewall technique. This system has been developed this
summer and has been tested fairly extensively.

# Matchmaking analyzer 

We completed the implementation of a framework for detecting why a
ClassAd that represents a

request for a service/resource does not match with a ClassAd that
represents and offer to provide services/resources. The C++
implementation identifies problems in the requirements expression of the
request ClassAd as well as those in the offer ClassAds. In addition
there is support for suggesting fine grained modifications to the
request ClassAd. This functionality has been integrated into one of the
Condor user tools.

# Investigatory work on infrastructure interoperability

We have done some initial investigatory work on how different security
infrastructures can work together in a Grid environment. Specifically,
we have been exploring approaches that X.509 certificates for users and
hosts can be generated and distributed using Kerberos. This is important
since some Grid organizations accept X.509 certificates but are not
Kerberos aware and vice versa. This work involves examining the KCA and
the KX509 work from Argonne National Laboratory and University of
Michigan.

# Enhancement to Condor's security infrastructure

We have made following enhancements to Condor's security infrastructure:

-   **Added support for Diffie-Hellman key exchange** We have
    implemented Diffie-Hellman (DH) key exchange protocol using OpenSSL.
    This allows us to perform a key (i.e. secret) exchange regardless of
    whether we have a secure channel or not. This is a light weight
    solution that enables us to establish a secure channel without
    Kerberos or GSI.

-   **GSI support in Condor** We have made numerous changes to our GSI
    authentication based code in Condor. The new implementation allows
    clients to specify a list of acceptable services so now
    authorization is also mutual (in addition to mutual authentication
    that is already provided by GSI).

-   **New Message Authentication Code (MAC)**We now support allMAC
    implemented in OpenSSL. This includes HMAC, MD2, MD4, MD5, MDC2,
    RIPEMD and SHA.

-   **Condor CA** We have implemented and tested an internal Condor CA
    prototype using OpenSSL and Perl. The prototype has the following
    features - Creating CAs - Generating service certificates as well as
    user certificates - Signing certificates

# 3. Future Accomplishments (next 6 months)

Our planned accomplishments for the upcoming 6 months include:

-   [Continue standards work]{.underline}: We will continue standards
    work in GGF, IETF and OASIS. We expect to bring closure to the X.509
    Proxy Certificate and GSS-API Extensions specifications.

-   [Security Services for Grid Services]{.underline}: In addition to
    the standards work in security for Web Services and Grid Services
    (OGSA), we will continue to evolve GSI to implement these
    specifications as part of the Globus Toolkit v3 release.

-   [Community Authorization Service (CAS)]{.underline}: With the second
    alpha release of CAS we will aggressively pursue integration with
    other SciDAC projects - ESG, PPDG, DOE Science Grid, to gain further
    adoption and feedback.

-   [Finish Development of Proxy Certificate
    implementation]{.underline}: We will complete and release our
    implementation of the Proxy Certificate specification in the Globus
    Toolkit.

-   [Continue condor security development]{.underline}: We plan to
    continue our work on infrastructure interoperability support to make
    Condor's security infrastructure more flexible. In addition, we plan
    to investigate how Community Authorization Service (CAS) can be
    incorporated into Condor. In terms of private networks, we will
    conduct more extensive testing and will include both DPF and GCB in
    a future release of Condor. In terms of ClassAd work, we want to
    improve the stability of the matchmaking system. Also we want to
    extend the ClassAd analysis framework to more complex matchmaking
    models such as gang matching and set matching, as well as developing
    an intuitive user interface.

# 4. Research Interactions

We are being aggressive about our outreach, both with other SciDAC
projects, as well as to other communities.

The following list summarizes our interactions with various other SciDAC
projects:

-   Earth Systems Grid II: This was the initial project that motivated
    CAS, and funded early work on CAS during FY01. We continue to work
    closely with this project, in terms of gathering requirements from
    them, explaining what we are doing to them, and working on
    demonstrations with them. We are working with them to demonstrate
    CAS in conjunction with the Striped FTP server this SuperComputing
    \'02.

-   Particle Physics Data Grid: This project is already using GSI, and
    looks to be the next big collaboratory project that will use CAS. We
    are regularly attending calls of the PPDG Authentication
    Authorization and Accounting group and have done a great deal of
    requirements gathering from this community.

-   DOE Science Grid: The DOE Science Grid is based on GSI, and has set
    up a Certificate Authority that issues GSI-compatible credentials.
    We have been engaged in this process, serving on the Policy
    Management Authority for the CA and will continue to do so to ensure
    that our future is compatible with this resource.

-   CoG Kits: This project has developed a Python interface to the
    Globus Toolkit and the Grid Security Infrastructure, called
    PyGlobus. We use PyGlobus extensively in our prototypes of CAS, and
    have worked closely with the PyGlobus developers at LBNL to ensure
    that it has the capabilities we require.

-   Fusion Collaboratory: We are working with the Fusion Collaboratory
    to meet their requirements for fine-grain authorization of resource
    management. We have done some initial use of CAS and plan to further
    this. A paper describing this work is available at
    http://www.globus.org/research/papers.html#gauth02

Outside of the SciDAC community, GSI is also receiving wide-spread
recognition and adoption. It is the security basis for most major Grid
projects world-wide. Since GSI already enjoys almost universal
recognition as the de-facto security standard for Grids, this gives us
exceptional opportunities to promote adoption of our new work performed
under this SciDAC project.

With the emergence of Web services as a basis for Grid computing, thanks
to our work on the Open Grid Services Architecture (OGSA), we are also
working aggressively to ensure that GSI will work well within the
context of Web services and OGSA.

# 5. Remarks

None.