# Presentation: 507254

## caGrid Security Architecture Version 0.5OverviewcaBIG Architecture Workspace Face to FaceGeorgetown UniversityAugust 16, 2005Stephen LangellaOhio State Universitylangella@bmi.osu.edu

## Agenda

**Basic Security Usecase**
**caBIG Security Requirements**
**Security Architecture**
**Security Architecture Workflow Example**

## Security Usecase

**Grid User John**

**Legacy**
**Database**

## Security Usecase

**John, wishes to utilize Grid Service A to perform some action.**

**Legacy**
**Database**

**John’s **
**Credentials**

## Security Usecase

- John, wishes to utilize Grid Service A to perform some action.

**Legacy**
**Database**

**John’s **
**Credentials**

**In order to fulfill John’s request, Grid Service A requires data from Grid Service B**

## Security Usecase

- John, wishes to utilize Grid Service A to perform some action.

**Legacy**
**Database**

**John’s**
**Credentials**

- In order to fulfill John’s request, Grid Service A requires data from Grid Service B

**Grid Service B, does not trust Grid Service A but does trust John**

## Security Usecase

- John, wishes to utilize Grid Service A to perform some action.

**Legacy**
**Database**

**John’s**
**Credentials**

**Grid Service A connects to Grid Service B on behalf of John**

- Grid Service B, does not trust Grid Service A but does trust John

**John’s**
**Credentials**

## Security Usecase

- John, wishes to utilize Grid Service A to perform some action.

**Legacy**
**Database**

**John’s**
**Credentials**

- Grid Service A connects to Grid Service B on behalf of John

**In order to service Grid Service A’s request, Grid Service B must gather information from a relational database.**

**John’s**
**Credentials**

## Security Usecase

- John, wishes to utilize Grid Service A to perform some action.

**Legacy**
**Database**

**John’s**
**Credentials**

- Grid Service A connects to Grid Service B on behalf of John

- In order to service Grid Service A’s request, Grid Service B must gather information from a relational database.

**John’s**
**Credentials**

**In order to service request the relational database requires John’s local username and password.**

## Security Usecase

- John, wishes to utilize Grid Service A to perform some action.

**Legacy**
**Database**

**John’s**
**Credentials**

- Grid Service A connects to Grid Service B on behalf of John

**Grid Service B determines John’s local username and password for the relational database and uses them to connect to the database and extract information.**

**John’s**
**Credentials**

- In order to service request the relational database requires John’s local username and password.

**John’s username **
**and password**

## Security Usecase

- John, wishes to utilize Grid Service A to perform some action.

**Legacy**
**Database**

**John’s**
**Credentials**

- Grid Service A connects to Grid Service B on behalf of John

**Grid Service B services Grid Service A’s request.**

**John’s**
**Credentials**

- In order to service request the relational database requires John’s local username and password.

**John’s username **
**and password**

## Security Usecase

- John, wishes to utilize Grid Service A to perform some action.

**Legacy**
**Database**

**John’s**
**Credentials**

**Grid Service A finishes servicing John’s request.**

- Grid Service B services Grid Service A’s request.

**John’s**
**Credentials**

- In order to service request the relational database requires John’s local username and password.

**John’s username **
**and password**

## Security Usecase

- Question
- What is needed in terms of security to fulfill the described usecase?
- Answer
- All Grid Communication should be secure.
- Application Users need to be able to authenticate with a Grid Service.  (Single Sign On)
- Grid Services need to be able to determine if a user is authorized (access control)
- Grid Service should be able to integrate with existing authorization system
- Grid Services will need to be able to access user attributes.  (ex. Relational database login).
- Grid Services need a method of delegating a user’s credentials such that supporting grid services may act on the users behalf.

## caBIG Security Requirements

***Secure Communication***
*Authentication - *Parties involved can be assured of one another identity
*Message Integrity* –Message sent by either party is guaranteed to same message when it is received.
*Privacy *– Communication between the two parties can only be interpreted by the two parties
***Single Sign On***
- Users and Grid Services should have one method of authenticating themselves to the grid, all service in the grid should accept this method.
***Access Control on caBIG Services ***
- caBIG services should be able to determine, which users or services may access them.

## caBIG Security Requirements

**Method for integrating with existing security systems**
***User/Organizational Attribute Management***
- Services should have a method for determining the attributes of a requesting party.  Such attributes may be needed to service the request, for example are they a PI on the project? What cancer center are they from? What is there local database username and password?
***Delegation***
- caBIG services, should be able to interact with other caBIG services on a user’s behalf.
***Virtual Organization Management ***
*Not in scope for caGrid 0.5*

## Proposing an Architecture

- Goals
- Satisfy caBIG security requirements
- Leverage existing technologies wherever applicable
- Where do we start?
- Look at the proposed caGrid Architecture
- Determine how to satisfy security requirements within the existing caGrid architecture.
- Givens
- caGrid 0.5 is built upon Globus 3.2.1

## Evaluating Globus 3.2.1 Security

***Globus Toolkit’s Grid Security Infrastructure (GSI)***
- Overview
- Method of establishing secure communication between grid services.
- Single Sign On via public key cryptography and certificates.
- Service level access control via grid map files
- Evaluation in terms of Requirements
- Credential Delegation via certificate proxies
- Secure Communication is sufficient.
- Access Control via Grid Map is not sufficient, a management nightmare, also no support for access control above the service layer.
- Single Sign On via certificates is sufficient, however no efficient way for managing certificates.
- Credential Delegation is sufficient.
- Little or no support for Attribute Management

## Security Architecture Components

- Core Components
- GSI
- Authorization Manager
- Grid User Management Service (GUMS)
- Attribute Management Service (CAMS)
- External Components
- Local Authentication/Authorization Systems
- General Authorization Systems (ie PERMIS)
- Grid Authorization Services

## Authorization Manager

- Authorization Manager Overview
- Extends the Globus Toolkit to provide more dynamic authorization
- Abstracts away some globus related details.
- A general interface in which a caGrid service calls to determine if a user is authorized to perform operation X on resource Y.
- A caGrid service is configurable to use a specific implementation of the AuthorizationManager interface.
- Authorization Managers can be used to integrate grid security with external authentication/authorization systems.
-  Local/Legacy systems
- Other authorization systems.
- Authorization Managers enable authorization in a diverse ever changing dynamic environment.
**ie.** Allow this user access from his work computer during work hours and from his home computer during non work hours.

## Grid User Management Service (GUMS)

- Grid Service for the management and creation of grid users and grid user credentials.
- Features:
- Configurable Registration System
- Manages simpleCA Certificate Authority
- Creates and Manages Accounts including Grid Credentials
- In-depth Administrative System
- Runs as a Secure Grid Service
- Rich client API
- GUMS Portal GUI

## caGrid Attribute Management Service

- Grid Service for the management of user/virtual organization attributes.
- Attributes are well defined XML documents each conforming to and XML schema
- Users/Services may request attributes of a given user or VO.
- Requestor must be authorized to view the requested attributes.
- Authorization Managers can use CAMS for requesting attributes for making dynamic decisions.

## Security Architecture - Workflow

**Grid Service A**

**GUMS**

**Grid Service B**

- Grid

**John, wishes to utilize Grid Service A to perform some action**

- Legacy Database

**CAMS**

## Security Architecture - Workflow

**Grid Service A**

**GUMS**

**Grid Service B**

- Grid

**John, obtains a proxy from GUMS**

**CAMS**

**John’s Grid**
**Proxy**

**John’s**
**Username/**
**Password**

- Legacy Database

## Security Architecture - Workflow

**Grid Service A**

**GUMS**

**Grid Service B**

- Grid

**John, invokes Grid Service A using his GSI Proxy**

**CAMS**

**John’s Grid**
**Proxy**

**Grid Service A, receives John’s request and asks it’s AuthorizationManager if John is authorized.**

- Legacy Database

## Security Architecture - Workflow

**Grid Service A**

**GUMS**

**Grid Service B**

- Grid

- John, invokes Grid Service A using his GSI Proxy

**CAMS**

**John’s Grid**
**Proxy**

**In order to fulfill John’s request, Grid Service A requires data from Grid Service B**

- Legacy Database

**Grid Service B, does not trust Grid Service A but does trust John**

## Security Architecture - Workflow

**Grid Service A**

**GUMS**

**Grid Service B**

- Grid

- John, invokes Grid Service A using its GSI Proxy

**CAMS**

**John’s Grid**
**Proxy**

**Grid Service A connects to Grid Service B on behalf of John (GSI Delegation)**

- Legacy Database

**Grid Service B, does not trust Grid Service A but does trust John**

**John’s Grid**
**Proxy**

## Security Architecture - Workflow

**Grid Service A**

**GUMS**

**Grid Service B**

- Grid

- John, invokes Grid Service A using its GSI Proxy

**CAMS**

**John’s Grid**
**Proxy**

- Grid Service A connects to Grid Service B on behalf of John (GSI Delegation)

- Legacy Database

**John’s Grid**
**Proxy**

**Grid Service B, ask its AuthorizationManager if John is authorized.**

## Security Architecture - Workflow

**Grid Service A**

**GUMS**

**Grid Service B**

- Grid

- John, invokes Grid Service A using its GSI Proxy

**CAMS**

**John’s Grid**
**Proxy**

- Grid Service A connects to Grid Service B on behalf of John (GSI Delegation)

- Legacy Database

**John’s Grid**
**Proxy**

**In order to process A’s request, Grid Service B needs to obtain information from a relational database, which a requires John’s local username and password.**

## Security Architecture - Workflow

**Grid Service A**

**GUMS**

**Grid Service B**

- Grid

- John, invokes Grid Service A using its GSI Proxy

**CAMS**

**John’s Grid**
**Proxy**

- Grid Service A connects to Grid Service B on behalf of John (GSI Delegation)

- Legacy Database

**John’s Grid**
**Proxy**

**Grid Service B obtains John’s local relational database username and password from CAMS.**

**John’s username **
**and password**

**B’s Grid**
**Proxy**

## Security Architecture - Workflow

**Grid Service A**

**GUMS**

**Grid Service B**

- Grid

- John, invokes Grid Service A using its GSI Proxy

**CAMS**

**John’s Grid**
**Proxy**

- Grid Service A connects to Grid Service B on behalf of John (GSI Delegation)

- Legacy Database

**John’s Grid**
**Proxy**

**Grid Service B uses John’s username and password to connect to the relational database and retrieve the required information.**

**John’s username **
**and password**

## Security Architecture - Workflow

**Grid Service A**

**GUMS**

**Grid Service B**

- Grid

- John, invokes Grid Service A using its GSI Proxy

**CAMS**

**John’s Grid**
**Proxy**

- Grid Service A connects to Grid Service B on behalf of John (GSI Delegation)

- Legacy Database

**John’s Grid**
**Proxy**

**Grid Service B finishes servicing A’s Request**

**John’s username **
**and password**

## Security Architecture - Workflow

**Grid Service A**

**GUMS**

**Grid Service B**

- Grid

- John, invokes Grid Service A using its GSI Proxy

**CAMS**

**John’s Grid**
**Proxy**

- Legacy Database

**John’s Grid**
**Proxy**

- Grid Service B finishes servicing A’s Request

**John’s username **
**and password**

**Grid Service A finished servicing John’s request**

## Questions?