# Presentation: 735339

## Security and Policy for Group Collaboration

- PI: Steve Tuecke
- Argonne National LaboratoryUSC Information Sciences InstituteUniversity of Wisconsin, Madison
- http://www.mcs.anl.gov/dsl/scidac/security/

## A Quick GSI Introduction

- Security and Policy for Group Collaboration

- January 16, 2002

## Grid Security Infrastructure (GSI)

- Extensions to standard PKI protocols & APIs
- Standards: X.509, SSL/TLS, GSS-API
- Extensions for single sign-on and delegation
- Globus ToolkitTM reference implementation of GSI
- SSLeay/OpenSSL + GSS-API + SSO/delegation
- Tools and services to interface to local security
- Simple ACLs; SSLK5/PKINIT for access to K5, AFS; ...
- Tools for credential management
- Login, logout, etc.
- Smartcards
- MyProxy: Web portal login and delegation
- K5cert: Automatic X.509 certificate creation from K5 ticket

- Security and Policy for Group Collaboration

- January 16, 2002

## GSI in Action“Create Processes at A and B that Communicate & Access Files at C”

- (Kerberos)

-                Site B
-                (Unix)

- Site C
- (Kerberos)

- Computer

- User

- Computer

- Storage
- system

- GSI in Action“Create Processes at A and B that Communicate & Access Files at C”

- Security and Policy for Group Collaboration

- January 16, 2002

## X.509 Proxy Certificate

- Defines how a short term, restricted credential can be created from a normal, long-term X.509 credential
- A “proxy certificate” is a special type of X.509 certificate that is signed by the normal end entity cert, or by another proxy
- Single sign-on & delegation thru “impersonation”
- Embedded policy allows for restrictions of rights associated with a delegated proxy
- Delegation tracing
- IETF PKIX draft-ietf-pkix-proxy-01.txt

- Security and Policy for Group Collaboration

- January 16, 2002

## API

- Generic Security Service (GSS) API
- IETF standard
- Provides functions for authentication, delegation, message protection
- Decoupled from any particular communication method
- 4 years of GSS-API experience, while on the whole quite positive, has shed light on various deficiencies of GSS-API
- “GSS-API Extensions” draft in GGF

- Security and Policy for Group Collaboration

- January 16, 2002

## SciDAC Project

- Security and Policy for Group Collaboration

- January 16, 2002

## SciDAC Project Overview

- Enable collaborative work, with common security tools that address:
- Large, geographically & organization distributed membership
- Membership with diverse expertise, comprising different roles
- Community resources with associated community policies

- Security and Policy for Group Collaboration

- January 16, 2002

## SciDAC Project Focus

- Extend GSI-based security to better address “communities”
- Membership management
- Ease credential management, group administration
- Resource participation
- Low cost of participation, Integration w/ local security
- Rights assignment
- Community Authorization Service, restricted delegation
- Application support
- Feature-rich libraries, standards based
- Use high level services to drive infrastructure and standards

- Security and Policy for Group Collaboration

- January 16, 2002

## Community Authorization Service

- Question: How does a large community grant its users access to a large set of resources?
- Should minimize burden on both the users and resource providers
- Community Authorization Service (CAS)
- Community negotiates access to resources
- Resource outsources fine-grain authorization to CAS
- Resource only knows about “CAS user” credential
- CAS handles user registration, group membership...
- User who wants access to resource asks CAS for a capability credential
- Restricted proxy of the “CAS user” cred., checked by resource

- Security and Policy for Group Collaboration

- January 16, 2002

## Community Authorization(Prototype shown August 2001)

- Community Authorization(Prototype shown August 2001)

** **

**User**

- Security and Policy for Group Collaboration

- January 16, 2002

## Online Cert Authority & Repository

- Requiring users to manage their own certs and keys is annoying and error prone
- A solution: Leverage other local or global authentication to obtain a proxy credential
- Kerberos (local), Passport (global), etc.
- Example: Passport provides
- Globally unique user name (email address);
- Method of verifying ownership of the name (authentication)
- Re-issuance (e.g. forgotten password)
- Passport (or other) credentials can be presented to an online CA or credential repository
- Issues (restricted) proxy cert to the user on demand

- Security and Policy for Group Collaboration

- January 16, 2002

## Infrastructure & Standards

- X.509 Proxy Certificates (IETF PKIX)
- High level services are driving restricted proxy and delegation tracing aspects
- Restricted Proxy Policy Languages
- CAS will require evolution of policy languages
- GSS-API Extension (GGF GSI)
- High level services driving most of this
- Numerous small features to GSI implementation to support real applications

- Security and Policy for Group Collaboration

- January 16, 2002

## Impact

- We expect this project to result in:
- Standardization of new PKI-based approaches to credential management, restricted delegation, policy management
- Development of security tools and services for collaboration
- Widespread deployment and adoption of approaches and tools

- Security and Policy for Group Collaboration

- January 16, 2002

## Milestones

-  Demonstrate CAS prototype @ SC’01	November 2001
-  Complete X.509 & GSS standards drafts	February 2002
-  Deliver draft standard conforming GSS	April 2002
-  Deliver CAS w/ simple policies		May 2002
-  Demonstrate Online CA & CR		September 2002
-  Complete Online CA & CR standards drafts	December 2002
-  Finalize X.509 & GSS standards 		February 2003
-  Deliver Online CA & CR			March 2003
-  Deliver CAS w/ rich policy & app support	May 2003
-  Finalize Online CA & CR standards		December 2003
-  Deliver standards-based Online CA & CR	March 2004
-  Deliver CAS w/ accounting support		May 2004

- Security and Policy for Group Collaboration

- January 16, 2002

## Relation To Other Projects

- DOE Certificate Authority
- Issuing certificates that can be used with GSI
- Secure Group Communication
- Focused on group key negotiation
- We supply authentication certs & authorization
- Akenti
- GSI (proxy) certs can be used with Akenti
- In one sense, CAS and Akenti are exploring alternative distributed authorization approaches
- Capabilities vs Access Control models
- But Akenti could also be used by CAS for auth

- Security and Policy for Group Collaboration

- January 16, 2002