Security Services Lifecycle Management
inOn-Demand Infrastructure Services Provisioning

Yuri Demchenko
System and Network Engineering Group
University of Amsterdam
CPSRT 2010 Workshop @ CloudCom 2010
30 October - 3 December 2010, Indianapolis

Outline Background for this research On-Demand Infrastructure Services Provisioning and Composable
Services Architecture (CSA) CSA Service Delivery Framework and Services Lifecycle Management

 Proposed Security Services Lifecycle Management and related security
mechanisms
 Implementation – GAAA Toolkit and Security sessions management
 Summary and Discussion

CPSRT2010 Workshop, 2 December 2010

Security Services Lifecycle ManagementSlide_2

Background to this research Current projects
 GEANT3 JRA3 Task 3 Composable Services– European NREN infrastructure
 GEYSERS – On-demand Optical + IT infrastructure resources provisioning– Wide participation from large European network (Telefonika, Alcatel-Lucent,Interoute) and application providers (SAP) Past projects
 EGEE Grid Security middleware – gLite pluggable Java Authorisation

Framework Phosphorus project Security architecture for multi-domain Network Resource
Provisioning– GAAA-NRP and XACML-NRP profile– Multidomain Network Resource Provisioning (NRP) model and workflow

CPSRT2010 Workshop, 2 December 2010

Security Services Lifecycle Management

Slide_3

Use Case – e-Science infrastructure
Control &Monitoring

User A

Instrument(Manufactoring)

GridStorage T0

GridCenter

Grid
Storage T1

GridCenter

Grid
Storage T1

Visualisation
User K
User P
Visualisation
Computing
Cloud

Cloud
Storage

Permanent link
High Speed link provisioned on demand
Link provisioned on-demand

On-demand infrastructureservices provisioning
environment
 Security along the wholeprovisioning process andservice/infrastructure
lifecycle
 Manageable/user
controlled security
 Securing remote
executing environment
 Security context/session
management

Components of the typical e-Science infrastructure involving multidomain and multi-tier Grid
and Cloud resources and network infrastructure
CPSRT2010 Workshop, 2 December 2010

Security Services Lifecycle ManagementSlide_4

GEYSERS Reference Modelfor Infrastructure Services Virtualisation
RORA model Roles:

Service Consumer•

Service Middleware Layer (SML)
Virtual IT Management (VITM)•IT-aware Network Control Plane (NCP+)

Virtual Resource Pool

Virtual Network nodecontroller
Virtual IT resource

Logical Infrastructure
Composition Layer (LICL)

Virtual Infrastructure
Virtual IT nodecontroller•

VIO – VirtualInfrastructure
Operator
VIP - VirtualInfrastructure
ProviderPIP - PhysicalInfrastructure
ProviderPhysical IT
resource

Virtual Network resource
Physical Networkresource

Physical Infrastructure
CPSRT2010 Workshop, 2 December 2010

Security Services Lifecycle Management

Slide_5

Security Service Lifecycle Managementin On-Demand Resources/Services Provisioning On-Demand Infrastructure Services Provisioning requires definition ofServices Lifecycle Management
 Multidomain multi-provider environment
 Includes standard virtualisation procedures and mechanisms

 Requires dynamic creation of Security/Trust Federations in multi-domainenvironment Based on available Trust Anchors– Physical Resources (hosting platforms)– SLA or SLA negotiators/contractors– All other security context/credentials/keys should be derived from them

 Access control infrastructure dynamically created and policy/attributes
dynamically configured Access/authorisation session/context management Composable Services Architecture (CSA) as a platform for dynamicallyconfigurable composable services provisioning
CPSRT2010 Workshop, 2 December 2010

Security Services Lifecycle Management

Slide_6

Composable Services Architecture

User
ClientApplications and User Terminals
Virtual Infrastructure/Resources level
Proxy (adaptors/containers) – Composed/Virtualised Services and Resources

Control &ManagementPlane

Composition
Layer/Serv

Composable Services Middleware(GEMBus)(ReservationSLA
Negotiatn)(Operation,Orchestration)

MD SLC

Registry

Logging

Composable Services
lifecycle/provisioning
stages(1) Request(2) Composition/ Reservation(3) Deployment(4) Operation(5) Decommissioning

Security

Separation of Data
Plane, Control Plane,
Management Plane
Logical Abstraction Layer for Component
Services and Resources

Proxy (adaptors/containers) - Component Services and Resources

StorageResources

ComputeResources

Network Infrastructure

Component Services & Resources – Physical Resources level

CPSRT2010 Workshop, 2 December 2010

Security Services Lifecycle ManagementControl/
Mngnt Links

Data Links

Slide_7

CSA Services Delivery Framework (SDF)
Composable Services Provisioning Workflow
Main stages/phases
Service Request/
SLA NegotiationComposition/
Reservation
Re-Composition

ServiceLifecycle
MetadataService(SL MD)

Deployment

Additional stages
Registr&Synchro
Recovery/
Migration

Operation(Monitoring)

Decommissioning

Service Request (including SLAnegotiation)
Composition/Reservation (akadesign)
Deployment, including
Reqistration/Synchronisation
Operation (including Monitoring)
DecommissioningProvisiong
SessionManagnt

Re-Composition should addressincremental infrastructure changes
Recovery/Migration can use SL-MD
to initiate resources resynchronisation but may require recomposition

The whole workflow is supported by theService Lifecycle Metadata Service(SL MD)
Based on the TMF SDF

CPSRT2010 Workshop, 2 December 2010

Security Services Lifecycle Management

Slide_8

Composable Services Architecture –Lifecycle stages workflow
44Serv

User
ClientServ

Applications and User Terminals

Serv

Proxy (adaptors/containers) – Composed/Virtualised Services and Resources

4313223Control &ManagementPlane

1(Operation,Orchestration)

4(ReservationSLA
Negotiatn)

2MD SLC(1) Request(2) Composition/Reservation(3) Deployment(4) Operation(5) Decommissioning

Composition
Layer /Serv

Composable Services Middleware(GEMBus/GESB)

Registry

Logging

Composable
Services
lifecycle/provisioning
stagesSecurity

3 2

MD SLC – Service
Lifecycle Metadata
Logical Abstraction Layer for Component
Services and Resources

3 2
44
Proxy (adaptors/containers) - Component Services and Resources

StorageResources

ComputeResources

CPSRT2010 Workshop, 2 December 2010

3 2

Network Infrastructure
Component Services & Resources

Security Services Lifecycle Management

GEMBus – GEANT
Multidomain Bus

Control/Mngnt Links

Data Links

Slide_9

Security Services Lifecycle Management Model(compliant to CSA SDF/lifecycle model)
Security Service request and generation of the GRI that will serve as a provisioning session identifier
and will bind all other stages and related security context.
Reservation session binding that provides support for complex reservation process including required
access control and policy enforcement.
Deployment stage begins after all component resources have been reserved and includes distributionof the security context and binding the reserved resources or services to GRI as a common
provisioning session ID.
Registration&Synchronisation stage (optional) specifically targets possible scenarios with theprovisioned services migration or failover/interruption. In a simple case, the Registration stage binds
the local resource or hosting platform run-time process ID to the GRI as a provisioning session ID.
Operation stage - security services provide access control to the provisioned services and maintain theservice access or usage session.
Decommissioning stage ensures that all sessions are terminated, data are cleaned up and session
security context is recycled.

ServiceRequest(GRI)CPSRT2010 Workshop, 2 December 2010Reserv
SessionBinding

Deployment &RsrBind

Registr
Synchro(Opt)

Security Services Lifecycle Management

Operatn
Access

Decommision
Slide_10

Relation between Security SLM and general SLM(a)Services
Lifecycle
Stages(b) Security
Services
Lifecycle
StagesServiceRequest(GRI)DesignDevelopment
Reservation

SecServ
Request(GRI)

Reserv
SessionBinding

Deployment

Deployment &RsrBind

Registr
Synchro(Ext)

OperateMaintain

Decommision

Operatn
Access

Decommision

Additional SSLM stages and mechanisms to ensure consistency of the security context management
Security Service Request that initiates creation of the dynamic security association and may use SLA
security context.
Reservation Session Binding with GRI (as part of Planning stage) that provides support for complex
reservation process including required access control and policy enforcement.
Registration&Synchronisation stage (as part Deployment stage) specifically targets possible
scenarios with the provisioned services migration or failover/interruption. In a simple case, theRegistration stage binds the local resource or hosting platform run-time process ID to the GRI as aprovisioning session ID.
CPSRT2010 Workshop, 2 December 2010

Security Services Lifecycle Management

Slide_11Relation between SSLM/SLM stages and supporting
general and security mechanisms
SLMstages

RequestDesign/Reservation Development

Deployment

Operation

Decomissioning

Process/
Activity

SLA
tiationService/Resource
Composition
Reservation

Composition
Configuration

Orchestration/
SessionManagement

LogoffAccounting

Nego

Mechanisms/Methods
SLA

V

Workflow

Metadata

V(V)

V

V

V

V

V

Dynamic
Security
Associatn

(V)

V

V

AuthZ
SessionContext

V(V)V

Logging

(V)

(V)

V

CPSRT2010 Workshop, 2 December 2010

Security Services Lifecycle Management

V

Slide_12Implementation suggestions
Extend existing GAAA-Toolkit pluggable Java library to support dynamic
Security/AAI infrastructure creation and integration with provisioned VI Provides GAAA Authorisation API (GAAAPI) functions with extended AuthZ andsession management functionality

Support for SDF workflow and Security Services Lifecycle Management
 Needs general infrastructure services such as Metadata SLM

Define and implement Common Security Service Interface (CSSI) Supports both internal applications calls and Web service integration via Spring
security Implements GSS-API and extends it with GAAAPI functionality

Use standard Messaging, Transport and Network security mechanisms provided
by implementation platform Implementation platform selection – ESB/WS/SOA (Fuse, Apache ServiceMix, etc.)

CPSRT2010 Workshop, 2 December 2010

Security Services Lifecycle Management

Slide_13

Example: Multidomain Security Context Managementin Network Resource Provisioning (NRP) – Provisioning sequences
Agent(AAA)A

R

Provisioning sequences
NSP/AAA

NSP/AAA

NSP/AAA

PAP

PAP

PAP

PDP

PDP
P
User
Client

TVS

PDP
TVS

TVS

PEP

PEP

DC/NRPS

DC/NRPS

DC/NRPSNECPSRT2010 Workshop, 2 December 2010



Agent (A)Polling (P)Relay (R)

Token based policy
enforcementDestHostApplicationNE

NRPS – Network Resource Provisioning System
NSP – Network Service Plain
DC – Domain Controller
IDC – Interdomain Controller

Service(AAA)planeControl
planePEPNE

DC/AAA

GRI – Global Reservation ID
AuthZ tickets for multidomain
context mngnt
T - Token

Networkplane

AAA – AuthN, AuthZ, Accounting Server
PDP – Policy Decision Point
PEP – Policy Enforcement Point
TVS – Token Validation Service
KGS – Key Generation ServiceSecurity Services Lifecycle Management

Slide_14

Multidomain Security Context Management in NRP –Stage 1 – Path building and Advance Reservation
Token based signalling andaccess control
IDC/AAA
PAP

GRI

PAP

GRI

PDP

PDP
TVS
UserClient

IDC/AAA

IDC/AAAPAP GRIPDPTVSTVSPEP

PEP

DC/NRPS

DC/NRPS

DC/NRPSNENE

IDC – Interdomain Controller
DC – Domain Controller
NRPS – Network Resource Provisioning System
NE - Network Element
CPSRT2010 Workshop, 2 December 2010

Service(AAA)planeDest
HostControl
plane

PEPNE

DC/AAA

GRI – Global Reservation ID
AzTicket – AuthZ ticket for
multidomain context mngnt
AT – Access Token
Pilot Token type 3 used at the Stage
1 Reservation for signallingand interdomain contextcommunication* As container for GRI and AzTicket

ApplicationNetwork
plane

Pilot Token type 4 used at the Stage
2 for setup information
communication

AAA – AuthN, AuthZ, Accounting Server
PDP – Policy Decision Point
PEP – Policy Enforcement Point
TVS – Token Validation Service

Security Services Lifecycle Management

Slide_15

Multidomain Security Context Management in NRP –Stage 2 – Deployment (setup and key distribution)
Token based signalling andaccess control
IDC/AAA
PAP

GRI

PAP

GRI

PDP

PDP
TVS
User
Client

IDC/AAA

IDC/AAA

PT4(AzTick)

PAP GRI

PDP
TVS

PT4(AzTick)

TVS

PEP

PEP

DC/NRPS

DC/NRPS

DC/NRPSNENE

IDC – Interdomain Controller
DC – Domain Controller
NRPS – Network Resource Provisioning System
NE - Network Element
CPSRT2010 Workshop, 2 December 2010Service(AAA)planeDest
HostControl
planePEPNE

DC/AAA

GRI – Global Reservation ID
AzTicket – AuthZ ticket for
multidomain context mngnt
AT – Access Token
Pilot Token type 3 used at the Stage
1 Reservation for signallingand interdomain context
communication* As container for GRI and AzTicket

ApplicationNetworkplanePilot Token type 4 used at the Stage
2 for setup information
communication

AAA – AuthN, AuthZ, Accounting Server
PDP – Policy Decision Point
PEP – Policy Enforcement Point
TVS – Token Validation Service

Security Services Lifecycle Management

Slide_16

Multidomain Security Context Management in NRP –Stage 3 – Access Control (using access tokens)
Token based signalling andaccess control
IDC/AAAPAP

IDC/AAA

IDC/AAA
GRI

PAP

GRI

PDP

PDP

PDP
PT4(AzTick)

PT4(AzTick)

AT

User
ClientTVSAT

PAP GRITVS
ATTVS
AT

PEP

PEP

PEP

DC/NRPS

DC/NRPS

DC/NRPS

NE

NE

NE

IDC – Interdomain Controller
DC – Domain Controller
NRPS – Network Resource Provisioning SystemNE - Network Element
CPSRT2010 Workshop, 2 December 2010

DC/A
AA

Service(AAA)planeDest
HostControl
plane

GRI – Global Reservation ID
AzTicket – AuthZ ticket for
multidomain context mngnt
AT – Access Token
Pilot Token type 3 used at theStage 1 Reservation for
signalling and interdomain
context communication* As container for GRI andAzTicket

ApplicationNetwork
plane

Pilot Token type 4 used at theStage 2 for setup
information communication

AAA – AuthN, AuthZ, Accounting Server
PDP – Policy Decision Point
PEP – Policy Enforcement Point
TVS – Token Validation Service

Security Services Lifecycle Management

Slide_17

NRP Stages and Session Types
SLA, WSAgreement

Access Control
PolicyGRI generated
Accounting,Billing

NetworkConfig.
Reservation

Deployment

Access/Use

Decommissioning

AccessToken

PilotToken0-3
PilotToken4
Reservation
SessionAccessSession
Provisioning session

Requires consistent security and session context management
Global Reservation ID (GRI) is created at the beginning of the provisioning session (Reservation stage) andbinds all sessions
CPSRT2010 Workshop, 2 December 2010

Security Services Lifecycle Management

Slide_18

Access Token and Pilot Token Types
AType 0 – Simple access token (refers to the reserved resources context)
AType 1 – Access token containing Obligations (e.g. XACML Policy Obligations) collectedfrom previous domains
PType 0 – Container for GRI only
PType 1 – Container for communicating the GRI during the reservation stage
 Contains the mandatory SessionId=GRI attribute and an optional Condition element

PType 2 – Origin/requestor authenticating token
 TokenValue element contains a value that can be used as the authentication value for the token
origin TokenValue may be calculated of the (GRI, IssuerId, TokenId) by applying e.g. HMAC function
with the requestor’s symmetric or private key.

PType 3 – Extends Type 2 with the Domains element that allows collecting domains security
context information when passing multiple domains during the reservation process Domains’ context may include the previous token and the domain’s trust anchor or public key

PType 4 – Used at the deployment stage and can communicate between domains security
context information about all participating in the provisioned lightpath or network
infrastructure resources Can be used for programming/setting up a TVS infrastructure for consistent access control
tokens processing at the resource access stageCPSRT2010 Workshop, 2 December 2010

Security Services Lifecycle Management

Slide_19

Chaining Pilot Tokens in multidomain signalling
Requestor

Domain1“viola”

Domain2“uva”

Domain3“uclp”•Resource•

Pilot Token type 3 issued
by domain UvAContains SecCtx fromprevious Viola domain<AAA:AuthzToken xmlns:AAA="http://www.aaauthreach.org/ns/AAA"
Issuer=http://testbed.ist-phosphorus.eu/uva/AAA/TVS/tokenpilot
SessionId="740b241e711ece3b128c97f990c282adcbf476bb"
TokenId="dc58b505f9690692f7a6312912d0fb4c" type="pilot-type3"><AAA:TokenValue>190a3c1554a500e912ea75a367c822c09eceaa2f </AAA:TokenValue><AAA:Conditions NotBefore="2009-01-30T08:57:40.462Z" NotOnOrAfter="2009-01-30T09:21:40.462Z"/><AAA:DomainsContext><AAA:Domain domainId="http://testbed.ist-phosphorus.eu/viola"><AAA:AuthzToken Issuer="http://testbed.ist-phosphorus.eu/viola/aaa/TVS/token-pilot«
SessionId="2515ab7803a86397f3d60c670d199010aa96cb51"
TokenId="c44a2f5f70346fdc2a2244fecbcdd244"><AAA:TokenValue>dee1c29719b9098b361cab4cfcd086700ca2f414</AAA:TokenValue><AAA:Conditions NotBefore="2009-01-30T07:57:35.227Z"
NotOnOrAfter="2009-01-31T07:57:35.227Z"/></AAA:AuthzToken><AAA:KeyInfo> http://testbed.ist-phosphorus.eu/viola/_public_key_ </AAA:KeyInfo></AAA:Domain></AAA:DomainsContext></AAA:AuthzToken>

CPSRT2010 Workshop, 2 December 2010

Security Services Lifecycle Management

Slide_20

Future work and Discussion
 Definition of and reference implementation of the Common Security
Services Interface (CSSI) As extension to industry adopted GSS-API
 Incorporate GAAA-AuthZ (RFC2904) Authorisation interface
 Extends for Session Security Context Management and dynamic

trust/security association management

 Wide range of formalisation and modeling work
 Implementation in projects GEANT3 and GEYSERS CSA and Security Services Lifecycle Management model is proposed asa possible deliverable for OGF ISOD RG

CPSRT2010 Workshop, 2 December 2010

Security Services Lifecycle Management

Slide_21

Acknowledgement

This work is supported by the FP7 EU funded project GEANT3 (FP7ICT-238875), and the FP7 EU funded Integrated project The
Generalised Architecture for Dynamic Infrastructure Services(GEYSERS, FP7-ICT-248657).

CPSRT2010 Workshop, 2 December 2010

Security Services Lifecycle Management

Slide_22