Enabling Grids for E-sciencE

Policy Obligations Bridging two fundamental security
concepts

JRA1 All-Hands, NIKHEF, 20-22 February 2008
Yuri Demchenko
SNE Group, University of Amsterdam
www.eu-egee.org
www.glite.org
INFSO-RI-508833

Obligations for Interoperability in Grid
Enabling Grids for E-sciencE• Part of the site centric SCAS based AuthZ
infrastructure• One of the main focuses of the AUTHZ-INTEROP
initiative between OSG-EGEE-GT– List of Obligations and their semantics– SAML-XACML Extension Library for OpenSAML2.0• Other components– Obligations Handling Reference Model (OHRM)– Obligation Handler API and SAML-XACML design document– to be finalised– XACML Conformance test for typical and registered Obligations– still to be done

• Another outcome– IMHO, indicated a need for Grid security architecture and model
re-thinking
INFSO-RI-508833

Policy Obligations and Security Models

2Obligations and Pilot job use cases
Enabling Grids for E-sciencE

PilotJob
UserAuthN

AuthZ

SCAS

•UserJob
glexecLCAS/
LCMAPS

GWglexec

WN

LCAS/
LCMAPS

Introducing SCAS as external AuthZ service called from protected environmentchanges simple security model– AuthN-AuthZ-glexec flow needs analysis– Behind each (SCAS) policy should be clear operational model•

SCAS is verified to be compatible with the XACML policy and PDP– XACML uses pluggable security service model (i.e. called from major Service)– glexec is a kind of gateway/border device

INFSO-RI-508833

Policy Obligations and Security Models

3Obligations in Access Control andManagement

Enabling Grids for E-sciencE• Access control in Grid and Policy Obligations– Account mapping– Quota assignment– Environment setup/configuration• General Complex Resource provisioning– Fixed, Time-flexible, Malleable/”Elastic” Scheduling– Usable Resource• Other/general– Accounting, Logging, Delegation• Obligations in access control and policy basedmanagement– Obligated policy decision– Provisional policy decision
INFSO-RI-508833

Policy Obligations and Security Models

4

OSI-Security vs TCB Security
Enabling Grids for E-sciencEOpen Systems and Internet

Trusted Computing Base (TCB)••

Open Systems Interconnection(OSI) Security Architecture– ISO7498-2/X.800••••

Independently managedinterconnected system
Trust established mutually or via 3rdparty
PKI and PKI based AuthN and key
exchange
Concept of the Security Context
CA

Trust relations••

Reference Monitor (RM) byJ.P.Anderson “Computer Security
Planning Study” (1972)
Models Bell-LaPadula and Biba
Certification criteria
TCSEC/Common Criteria (1984)– A1, B1, B2, B3, C1, C2, D
Audit file

Subjects

Objects
ReferenceMonitor(RM)

Security kernel OS
database

INFSO-RI-508833

Policy Obligations and Security Models

5X.800/OSI Security –Layers vs Services vs Mechanisms

Enabling Grids for E-sciencE••

INFSO-RI-508833

Similar model should be probably
proposed for WS SOAP based
security services and mechanismsLayers model for above
Application layer are uncertain

Policy Obligations and Security Models

6From OSI/Internet to SOA/WSA
Security Model

Enabling Grids for E-sciencE•X.800 Security Architecture for Open Systems Interconnection for CCITT
applications. ITU-T (CCITT) Recommendation, 1991
– ISO 7498-2:1989 Information processing systems -- Open Systems
Interconnection -- Basic Reference Model -- Part 2: Security Architecture•Web Services Security Roadmap (2002)– http://www.ibm.com/developerworks/library/specification/ws-secmap/•OGSA Security Model Components (2002-2006)– GFD.80 - OGSA version 1.5,
Section 3.7 Security Services– Re-states Web Services
Security roadmap•WS-Security stds specify
using SOAP header for
security related issues– Considered as orthogonal
to major service

INFSO-RI-508833

Policy Obligations and Security Models

7Reference Monitor (RM) Concept
Enabling Grids for E-sciencE

Audit file

Subjects

Objects
ReferenceMonitor(policy)

Proposed by J.P. Anderson in the report“Computer Security Planning Study”(1972)
RM property provides a basis for Multi-Level
Security (MLS)––Security kernel,
database–•

INFSO-RI-508833

Complete mediation: The security rules
are enforced on every access, not just, forexample, when a file is opened.
Isolation: The reference monitor anddatabases must be protected fromunauthorized modification.
Verifiability: The reference monitor’scorrectness must be provable. That is, it
must be possible to demonstrate
mathematically that the reference monitor
enforces the security rules and provides
complete mediation and isolation.

RM concept is a basis for TCB
certification

Policy Obligations and Security Models

8Multi-Level Security Models
Enabling Grids for E-sciencE••

Bell–LaPadula (BLP) model– No write down
– No read up
Focus – Confidentiality– Mandatory Access Control••

Applicability – Data
Known flaw – not protectedagainst insider “worm” virus•

TCSEC Common Criteria–––––•••

Biba model– No write up– No read down
Focus – Integrity
Applicability – (Open) Data
and Control/Mngnt

A1 – B3 + formally/mathematically verified design
B1-B3 – Multilevel security, Formal security model, Mandatory AC
C1-C2 – Discretionary access control model, auditable user activity
D – minimal protection
Currently replaced by ISO 15408 Evaluation Assurance Level (EAL)INFSO-RI-508833

Policy Obligations and Security Models

9TCSEC/ISO Common Criteria
Enabling Grids for E-sciencE•TCSEC Certification Criteria– A1 – B3 + formally/mathematically verified design– B3 – Clear security model and layered design, Security functions tamperproof,
Auditing mandatory– B2 – Least-privilege access control model, Certifiable security design
implementation, Covert channels analysis– B1 – Labelled security protection, MAC-BLP + DAC– C2 – Discretionary access control model, auditable user activity– D – minimal protection•Currently replaced by ISO 15408 Evaluation Assurance Level (EAL)–––––––•

EAL1: Functionally Tested
EAL2: Structurally Tested
EAL3: Methodically Tested and Checked
EAL4: Methodically Designed, Tested and Reviewed
EAL5: Semiformally Designed and Tested
EAL6: Semiformally Verified Design and Tested
EAL7: Formally Verified Design and Tested

EAL1-4 – commercial systems, EAL5-7 - special systems (EAL4 circa C2)– Windows NT (EAL4+) and many routing and Unix systems certified for EAL4INFSO-RI-508833

Policy Obligations and Security Models

10Clark – Wilson Integrity Policy
Enabling Grids for E-sciencE

Criteria for achieving data integrity (primary target for reliable business operation)••••

Authentication of all user accessing system
Audit – all modifications should be logged
Well-formed transactions
Separation of duties

Enforcement Rules E1 (Enforcement of Validity) - Only certified TPs can operate on CDIs
 E2 (Enforcement of Separation of Duty) - Users must only access CDIs through TPs forwhich they are authorized.
 E3 (User Identity) - The system must authenticate the identity of each user attempting toexecute a TP
 E4 (Initiation) - Only administrator can specify TP authorizations
Certification Rules C1 (IVP Certification) - The system will have an IVP for validating the integrity of any CDI.
 C2 (Validity) - The application of a TP to any CDI must maintain the integrity of that CDI.
CDIs must be certified to ensure that they result in a valid CDI
 C3 - A CDI can only be changed by a TP. TPs must be certified to ensure they implement
the principles of separation of duties & least privilege
 C4 (Journal Certification) - TPs must be certified to ensure that their actions are logged C5 - TPs which act on UDIs must be certified to ensure that they result in a valid CDI
TP – transformational procedure; IVP – integrity verification procedure;
CDI – constrained data Item; UDI - unconstrained data Item
INFSO-RI-508833

Policy Obligations and Security Models

11Enabling Grids for E-sciencE

Grid Security Model(s) –Still to be created?

• Strong&consistent AthN is a good principle, BUT– Can be considered as sufficient only if a subject logs in thetrusted environment (like server/UNIX)– There other security aspects• Use TCB (Secure OS) design principles– Layered design
 Hardware, kernel, OS, user
 Most sensitive operations in the (resource) innermost circle• Introduce security zones model– AuthN, (Delegation,) AuthZ, (AuthZ Session,) glexec/Unix– Keep security context– Use AuthZ session management concept and security
mechanisms

INFSO-RI-508833

Policy Obligations and Security Models

12Other Grid Security specifics Open list

Enabling Grids for E-sciencE•Re-factoring policy-based access control to policy-based objectmanagement– Many use cases in Grid job processing workflow fit better into genericpolicy based object management than to access control
 Policy (and access conditions) are attached to the object (i.e. job) at its
invocation and checked locally by glexec or RM••

Virtualisation– Provides specific operational and security environment for securityservicesTrusted Computing Platform Architecture (TCPA)– Provides a basis for inter-connecting trusted computing
hosts/environments– Defines Trusted Network Connect framework (TNC)– Allows combination with the Virtualisation platform to extend usertrusted environment to remote hosts

INFSO-RI-508833

Policy Obligations and Security Models

13

PKI vs IBC
Enabling Grids for E-sciencE

Identity Based Cryptography (IBC)• Uses publicly known remote entity’s identity as apublic key to send encrypted message or initiate
security session– Initially proposed by Shamir in 1984 as an alternative to PKI
 Shamir is one of the RSA inventors in 1977 (Rivest, Shamir, Adleman)– Identity can be email, domain name, IP address– Allows conditional private key generation• Requires infrastructure different from PKI but domain
based (doesn’t require trusted 3rd party outside ofdomain)– Private key generation service (KGS) Generates private key to registered/authenticated users/entities– Exchange inter-domain trust management problem to intradomain trust
INFSO-RI-508833

Policy Obligations and Security Models

14

Using IBC for key distribution inmultidomain NRP

Enabling Grids for E-sciencE

AgentAR

IDC/AAA

IDC/AAA

IDC/AAA

PAP

PAP

PAP

PDP

PDP
P
User
ClientTVS

Provisioning
sequences

IBC
KGS

IBC
KGS

IBC
KGS

AAA
Service(AAA)
plane

PDP
TVS

TVS

PEP

PEP

PEP

DC/NRPS

DC/NRPS

DC/NRPS

Dest
Host

Control
plane•••

Token based policy
enforcement••

NE

NRPS – Network Resource
Provisioning System
DC – Domain Controller
IDC – Interdomain Controller
INFSO-RI-508833

NENE

Application

Networkplane

Agent (A)Polling (P)Relay (R)GRI – Global
Reservation ID
AuthZ tickets for
multidomain
context mngnt

AAA – AuthN, AuthZ, Accounting Server
PDP – Policy Decision Point
PEP – Policy Enforcement Point
TVS – Token Validation Service
KGS – Key Generation Service
Policy Obligations and Security Models

15

Identity Based Cryptography (IBC)
Enabling Grids for E-sciencE

Available implementations• Voltage Identity-Based Encryption (C based)– Used in Microsoft Exchange Server• Eyebee by Univ Ireland (Java)– Tested by us and will be implementedin IDC• Strong motivation for privacy
concerned applications– E.g. patient-doctorcommunication

INFSO-RI-508833

Policy Obligations and Security Models

16Discussion and Future
Enabling Grids for E-sciencE••••

It was fun working for EGEE
New security area with lot of unsolved problems– Some of them are becoming visible– Not resolving them or ignoring will result in non-consistent design orexcessive work to address emerging problems
Hope to meet you in other projects and at different meetings– Will be interested in future offers for partnership in research andprojects
Our research at SNEG/UvA will continue in the area ofmultidomain Complex Resource Provisioning (Grid enabled)– AuthZ and Security– Research on the Grid security model(s)INFSO-RI-508833

Policy Obligations and Security Models

17