Security Services Lifecycle Management
andGEYSERS Service Delivery Framework

Yuri Demchenko, UvA

Cloud Security BOF
26 October 2010
OGF30 25-28 October 2010, Brussels

Outline Cloud Security – New challenges
 On-Demand Infrastructure Services Provisioning
 Background – TMF Service Delivery Framework (SDF) GEYSERS SDF
 Security Services Lifecycle Management

ISoD BoF, OGF30, 25-29 Ocftober 2010, Brussels

Security Services Lifecycle Management

Slide_2

Cloud Security – New challenges
Clouds as infrastructure services provisioning model/environmentSecurity along the whole provisioning process and service/infrastructure
lifecycle
Manageable/user controlled security
Securing remote executing environment
Security context/session management

ISoD BoF, OGF30, 25-29 Ocftober 2010, Brussels

ISOD RG Chapter Discussion

Slide_3

Security Service Lifecycle Managementin On-Demand Resources/Services Provisioning On-Demand Infrastructure Services Provisioning requires definition ofServices Lifecycle Management
 Multidomain multi-provider environment
 Includes standard virtualisation procedures and mechanisms

 Requires dynamic creation of Security/Trust Federations in multi-domainenvironment Access control infrastructure dynamically created and policy/attributes
dynamically configured Access/authorisation session/context management

ISoD BoF, OGF30, 25-29 Ocftober 2010, Brussels

Security Services Lifecycle Management

Slide_4

GEYSERS Service Delivery Framework (SDF) Service provisioning workflow by VIP:
 Creation of the Virtual Infrastructure (VI) May include more engineers support

 Service provisioning workflow by VIO:
 Creation and operation of the Virtual Infrastructure on-demand for specific project,tasks or user groups Should be completely automatic Should also include activities/stages for infrastructure re-planning, restorationand migration Adopted TeleManagement Forum Service Delivery Framework (TMF SDF)
 GEYSERS Project - http://www.geysers.eu/
ISoD BoF, OGF30, 25-29 Ocftober 2010, Brussels

Security Services Lifecycle Management

Slide_5

GEYSERS Reference Model
Service ConsumerRole:
• VIO
• VIP
• PIP

Service Middleware Layer (SML)
Virtual IT Management (VITM)

Virtual Infrastructure
Virtual IT nodecontroller

Virtual Resource Pool

Virtual Network nodecontroller
Virtual IT resource

Logical Infrastructure
Composition Layer (LICL)

IT-aware Network Control Plane (NCP+)

Physical IT
resource

Virtual Network resource
Physical Networkresource

Physical Infrastructure
ISoD BoF, OGF30, 25-29 Ocftober 2010, Brussels

ISOD RG Chapter Discussion

Slide_6

Role of GEYSERS actors
with respect to its architectural layers
ServiceConsumers

ServiceConsumers

Service Middleware Layer (SML)

Virtual IT Manager (VITM)

Virtual IT Manager (VITM)

VIOn

...

VIPi

IT-aware NCP

IT-aware NCP

VI-1

...

Virtual Infrastructure

VI-n

Virtual Infrastructure

PIP

Virtual Resource Pool

Logical Infrastructure
Composition Layer (LICL)

VIO1Service Middleware Layer (SML)

ISoD BoF, OGF30, 25-29 Ocftober 2010, Brussels

Physical Infrastructure

ISOD RG Chapter Discussion

Slide_7

TMF Service Delivery Framework (SDF)
Goal: Automation of the whole service delivery and operation process(TMF SDF, http://www.tmforum.org/ServiceDeliveryFramework/4664/home.html)
End-to-end service management in a multi-service providers environment
End-to-end service management in a composite, hosted and/or syndicatedservice environment
Management functions to support a highly distributed service environment,
for example unified or federated security, user profile management,
charging etc.
Any other scenario that pertains to a given phase of the service lifecycle
challenges, such as on-boarding, provisioning, or service creation

GN3-JRA3-T3 Discussion

Security Services Lifecycle Management

Slide_8

SDF Reference Architecture (refactored from SDF)
Design16
SDF Service DesignManagement (ISS)

DeploySDF Service
Repository (ISS)910
SDF Service
Lifecycle Metadata
Repository (ISS)17

11
SDF Service Lifecycle
Metadata
Coordination (ISS)SDF Service
Deployment
Management (ISS)

2Operate

SDF Service State
Monitor (ISS)6
SDF Service Provisng
Mngnt (MSS)SDF Service
Instance

6
SDF Service Quality/
Problem Mngnt (MSS)

1

3SDF Service Resource
Fulfillment (ISS)SDF Service Resource
Monitor (ISS)7
SDF Service Usage
Mngnt (MSS)SDF MSS

Composite Services
provisioned on-demand

412131415SDF Service Resource
Usage Monitor (ISS)SDF ISS

Security Services Lifecycle Management

81 – Service Instance2 - Service Management Interface
3 – Service Functional Interface
4 - Management Support Service (SDFMSS)
8 - Infrastructure Support Service (ISS)
DESIGN stage
9 - Service Repository
10 - Service Lifecycle Metadata
Repository
16 - Service Design Management
DEPLOYMENT stage
10 - Service Lifecycle Metadata
Repository
11 - Service Lifecycle Metadata
Coordinator
17 - Service Deployment Management
OPERATION stage
5 - Service Provisioning Management
6 - Service Quality/Problem Management
7 - Service Usage Monitor
12 - Service State Monitor
13 - Service Resource Fulfillment
14 - Service Resource Monitor
15 - Resource Usage Monitor

Slide_9

GEYSSERS Service Delivery Workflow

Service Request/
SLA Negotiation

Replanning

Services
Provisioning
Workflow
by VIP

Service Request/
SLA Negotiation

Planning(Compos/Reserv)

Planning(Design)

Geysers SDF supports both
Geysers infrastructuredevelopment anddeployments and its
operation for on-demand
Infrastructure services
provisioning by VIO
RePlanning

Deployment
Deployment(Instant&Config&Synchro)
Recovery/
Migration

Operation&Monitoring(by VIO)

Registr&Synchro
Network+ITServices
Provisioning
Workflow
by VIO

Recovery/MigrationOperation(Monitoring)

Decommissioning
Decommissioning

GN3-JRA3-T3 Discussion

Security Services Lifecycle Management

Slide_10

SDF main stages and phases
Main stages/phasesService Request (including SLA negotiation)
Planning (including Composition, Reservation and Design)
Deployment (including Reqistration/Synchronisation)
Operation (including Monitoring)
Decommissioning

Additional stages
 Re-Composition should address incremental infrastructure changes
 Recovery/Migration can use SL-MD to initiate resources re-synchronisation but may require recomposition

The whole workflow should be supported by the Service Lifecycle Metadata Service (SL MD)

ISoD BoF, OGF30, 25-29 Ocftober 2010, Brussels

Security Services Lifecycle ManagementSlide_11

SDF use for defining
Security Services Lifecycle Management Model
Security Service request and generation of the GRI that will serve as a provisioning session identifier
and will bind all other stages and related security context.
Reservation session binding that provides support for complex reservation process including required
access control and policy enforcement.

Deployment stage begins after all component resources have been reserved and includes distributionof the security context and binding the reserved resources or services to GRI as a common
provisioning session ID.
Registration&Synchronisation stage (optional) specifically targets possible scenarios with theprovisioned services migration or failover/interruption. In a simple case, the Registration stage binds
the local resource or hosting platform run-time process ID to the GRI as a provisioning session ID.
Operation stage - security services provide access control to the provisioned services and maintain theservice access or usage session.
Decommissioning stage ensures that all sessions are terminated, data are cleaned up and session
security context is recycled.

ServiceRequest(GRI)

Reserv
SessionBinding

Deployment &RsrBind

Registr
Synchro(Opt)

Security Services Lifecycle Management

Operatn
Access

Decommision
Slide_12

Relation between SSLM and general SLM(a)Services
Lifecycle
StagesServiceRequest(GRI)(b) Security
Services
Lifecycle
StagesDesignDevelopment
Reservation

SecServ
Request(GRI)

Reserv
SessionBinding

Deployment

Deployment &RsrBind

Registr
Synchro(Ext)

OperateMaintain

Decommision

OperatnAccess

Decommision

 Service Request stage may include SLA negotiation
 Security service instantiation may use SLA security context

Security Services Lifecycle Management

Slide_13

Relation between SSLM/SLM stages and supporting general andsecurity mechanisms
SLM
stagesRequestDesign/Reservation
Development

Deployment

Operation

Decomissioning

Process/
Activity

SLA Nego tiation

Service/Resource
Composition Reservation

Composition
Configuration

Orchestration/
SessionManagement

LogoffAccounting

Mechanisms/Methods
SLA

V

Workflow

Metadata

V(V)

V

V

V

V

V

Dynamic
Security
Associatn

(V)

V

V

AuthZ Session
Context

V(V)V

Logging

(V)

(V)

V

Security Services Lifecycle Management

V

Slide_14

SSLM – Existing developments
 GAAA Toolkit Library with tickets/tokens handling functionality forsecurity session context management GAAA-NRP (GAAA profile for Network Resource Provisioning) On-going work in GEYSERS project to develop Security Architecture for
On-Demand Infrastructure Services provisioning Possible Contribution to planned ISOD RG
 Visit ISOD BOF today 15:00-18:30 (no security discussions planned but …)
 http://www.gridforum.org/gf/event_schedule/index.php?id=2099

ISoD BoF, OGF30, 25-29 Ocftober 2010, Brussels

Security Services Lifecycle Management

Slide_15

Additional Information
 TMF SDF Lifecycle Management modelSecurity Services Lifecycle Management

Slide_16

Discussion
 CSA is proposed as a possible deliverable for ISOD RG

 Who is interested to contribute?
 Any interested people to review and verify against other usecases?

ISoD BoF, OGF30, 25-29 Ocftober 2010, Brussels

Security Services Lifecycle Management

Slide_17