# Presentation: 735338

## Security and CAS Futures

- Steve Tuecke
- Argonne National Laboratory
- Globus Retreat
- August 9, 2001

## A Quick Refresher

- Grid Security Infrastructure (GSI) =
-    X.509 (PKI certificate format)*
- + proxy certificates (single sign-on & delegation)
- + TLS/SSL (authentication & msg protection)*
- + delegation protocol (remote delegation)
- + GSS-API (standard API)*
- + GSS-API Extensions (better Grid support)
- * = Existing IETF standards
- Others are GGF & IETF drafts

## X.509 Proxy Certificates Work

- Defines how a short term, restricted credential can be created from a normal, long-term X.509 credential
- A “proxy certificate” is a special type of X.509 certificate that is signed by the normal end entity cert, or by another proxy
- Supports single sign-on & delegation through “impersonation”
- ANL, ISI, LBNL

## Restricted Proxies

- Q: How to restrict rights of delegated proxy to a subset of those associated with the issuer?
- A: Embed restriction policy in proxy cert
- Policy is evaluated by resource upon proxy use
- Reduces rights available to the proxy to a subset of those held by the user
- But how to avoid policy language wars?
- Proxy cert just contains a container for a policy specification, without defining the language
- Container = OID + blob
- Can evolve policy languages over time

## Delegation Tracing

- Often want to know through what entities a proxy certificate has been delegated
- Audit (retrace footsteps)
- Authorization (deny from bad entities)
- Solved by adding information to the signed proxy certificate about each entity to which a proxy is delegated.
- Does NOT guarantee proper use of proxy
- Just tells you which entities were purposely involved in a delegation

## Proxy Certificate Standards Work

- “Internet Public Key Infrastructure X.509 Proxy Certificate Profile”
- draft-ietf-pkix-proxy-00.txt
- Draft being considered by IETF PKIX working group, and by GGF GSI working group
- Defines proxy certificate format, including restricted rights and delegation tracing
- LBNL student is implementing into OpenSSL
- Demonstrated a prototype of restricted proxies at HPDC as part of CAS demo

## Delegation Protocol Work

- “TLS Delegation Protocol”
- draft-ietf-tls-delegation-01.txt
- Draft being considered by IETF TLS working group, and by GGF GSI working group
- Defines how to remotely delegate an X.509 Proxy Certificate using extensions to the TLS (SSL) protocol

## GSS-API Extensions Work

- 4 years of GSS-API experience, while on the whole quite positive, has shed light on various deficiencies of GSS-API
- “GSS-API Extensions”
- draft-ggf-gss-extensions-02.txt
- Draft being considered by GGF GSI working group.  Not yet submitted to IETF.
- Defines extensions to the GSS-API to better support Grid security

## GSS-API Extensions

- Credential export/import
- Allows delegated credentials to be externalized
- Used for checkpointing a service
- Delegation at any time, in either direction
- More rich options on use of delegation
- Restricted delegation handling
- Add proxy restrictions to delegated cred
- Inspect auth cert for restrictions
- Allow better mapping of GSS to TLS
- Support TLS framing of messages

## Community Authorization Service

- Question: How does a large community grant its users access to a large set of resources?
- Should minimize burden on both the users and resource providers
- Solution: Community Authorization Service (CAS)
- Community negotiates access to resources
- Resource outsources fine-grain authorization to CAS
- Resource only needs to know about “CAS user” credential
- CAS handles user registration, group membership...
- User who wants access to resource asks CAS for a capability credential
- Restricted proxy of the “CAS user” credential, checked by resource

## CAS Operation

- 2.  CAS reply, with

-      and resource CA info

- user/group

- membership

- resource/collective

- membership

- collective policy

- information

**CAS**

** **

*Does the *

*collective policy *

*authorize this *

*request for this *

*user?*

* *

**User**

** **

- 1.  CAS request, with

-      resource names

-      and operations

**Resource**

** **

*Is this request *

*authorized for *

*the CAS?*

* *

*Is this request *

*authorized by *

*the *

*capability?*

* *

- local policy

- information

- 3.  Resource request,

-      authenticated with

- capability

- 4.  Resource reply

- capability

## Community Authorization Service

- CAS provides user community with information needed to authenticate resources
- Sent with capability credential, used on connection with resource
- Resource identity (DN), CA
- This allows new resources/users (and their CAs) to be made available to a community through the CAS without action on the other user’s/resource’s part

## Authorization API

- Service providers need to perform authorization policy evaluation on:
- Local policies
- Policies contained in restricted proxies
- We are working on 2 API layers:
- Low level GAA-API implementation for evaluation of policies
- High level, very simple authorization API that can easily be embedded into services
- Still in early prototyping stage

## Passport Online CA & MyProxy

- Requiring users to manage their own certs and keys is annoying and error prone
- A solution: Leverage Passport global authentication to obtain a proxy credential
- Passport provides
- Globally unique user name (email address)
- Method of verifying ownership of the name (authentication)
- Re-issuance (e.g. forgotten password)
- Passport credentials can be presented to an online CA or credential repository
- Creates and issues new (restricted) proxy certificate to the user on demand

## Other Future Security Work

- Ease-of-use
- Improved error message, online CA, etc.
- Improved online credential repositories
- See MyProxy paper at HPDC
- Support for multiple user credentials
- Multi-factor authentication
- Subordinate certificate authorities for domains
- Ease issuance of host certs for domains
- Independent Data Unit Support

## GSI and MDS-2

- MDS-2.1 will support GSI authentication
- GSI integrated into OpenLDAP v2 via dynamically loaded plug-ins in SASL
- Multiple levels of access control
- Gridmap
- Standard LDAP access control lists on entries

## GSI and GRAM-2

- Restricted proxies require the ability to name the objects to which restrictions are to apply
- An important feature of GRAM-2 is well defined, client driven naming of resource management contexts