VN-GRID Security

1. VN-GRID Security Nguyen Cao Dat

2. Outline • Grid Security on EDAGrid • EDAGrid topology • Authentication • Authorization • Message protection • Security Issues • Grid Security on VN-GRID • VN-GRID topology • Authentication • Authorization • To do list

3. Outline • Grid Security on EDAGrid • EDAGrid topology • Authentication • Authorization • Message protection • Security Issues

4. Certification Authority VO Server EDAGrid topology 1 2 GridNodes Site = Virtual Organization

5. Subject Public Key Issuer (CA) Signature of CA How a user is authenticated by a GridNode • Obtaining a Certificate user Private Key (encrypted) • Create a public/private key pair and unsigned • certificate (grid-cert-request command) • Mail unsigned certificate to CA admin by E-mail • Receive a signed certificate

6. Subject Public Key Issuer Signature Issuer How a user is authenticated by a GridNode(2) • By checking the signature, one can determine that a public key belongs to a given user. Hash Hash =? Decrypt Hash Public Key from Issuer

7. Send Cert. encrypted challenge string challenge string PL<OKNIJBN… How a user is authenticated by a GridNode(3) server user User Cert. Subject Public Key Issuer (CA) Digital Signature User Cert. Subject Public Key Issuer (CA) Digital Signature Check Public Key private key (encrypted) QAZWSXEDC… QAZWSXEDC… PublicKey QAZWSXEDC…

8. How a user is authenticated by GridNodes Single Sign on user Grid Node A GridNode B remote process creation requests* Communication* Delegation Remote file access requests* * with mutual authentication

9. How a user is authenticated by GridNodes (2) • Create Proxy Certificate Identity of the user Proxy Certificate Subject/Proxy (new) public key (new) private key (not encrypted) Issuer (user) Digital Signature (user) User Certificate Subject Public Key Issuer (CA) Digital Signature grid-proxy-init User Certificate Subject Public Key Issuer (CA) Digital Signature private key (encrypted) sign

10. How a user is authenticated by GridNodes (3) • Proxy Certificate • Minimize exposure of user’s private key. • A “proxy certificate” is a special type of certificate that is signed by the normal end entity cert, or by another proxy. • Used in short term, • Proxy’s private key is not encrypted. • Rely on file system security, proxy certificate file must be readable only by the owner

11. Proxy-2 Public Proxy-2 Cert How a user is authenticated by GridNodes (4) • Delegation • Remote creation of a user proxy • Results in a new private key and proxy certificate, signed by the original key • Allows remote process to act on behalf of the user • Avoids sending private keys across the network Proxy-1 Public Key Proxy-1 Private key Proxy-2 public Proxy-2 private User Private grid-proxy-init GridNode1 GridNode2 User Public Key User Private key

12. User Identity CA User Certificate User Identity User Identity CA User Certificate Proxy Certificate How a user is authenticated by GridNodes (5) • Traverse Certificate Chain to verify identity CA Proxy Certificate User Certificate Proxy Certificate

13. How a user is authenticated by GridNodes (5) • Example • Create Proxy certificate $ grid-proxy-init Enter PEM pass phrase: ***** • Remote Authentication Test $ globusrun –a –r hostname • Running a Job on Remote node $ globus-job-run hostname <executable> $ globusrun-ws …

14. Authorization • Identity Mapping • User is mapped to local identities to determine local policy. • . Map tolocal name Grid Identity LocalPolicy Map tolocal name LocalPolicy

15. Authorization (2) • Gridmap File • Gridmap file maintained by Globus administrator • Entry maps Grid-id into local user name(s) # Distinguished name Local # username "/O=Grid/OU=VNU-HCM/OU=HCMUT/OU=CSE/CN=Grid Test 1" griduser1 "/O=Grid/OU=VNU-HCM/OU=HCMUT/OU=CSE/CN=Nguyen Tuan Anh" tanguyen "/O=Grid/OU=VNU-HCM/OU=HCMUT/OU=CSE/CN=Thoai Nam" griduser3 "/O=Grid/OU=VNU-HCM/OU=HCMUT/OU=CSE/CN=Tran Van Hoai" hoai "/O=Grid/OU=VNU-HCM/OU=HCMUT/OU=CSE/CN=Nguyen Cao Dat" dat "/O=Grid/OU=VNU-HCM/OU=HCMUT/OU=CSE/CN=Ly Hoang Hai" griduser1

16. SSL/TLS Certificates TCP Sockets Message protection • Uses certificates and TCP sockets to provide a secured connection • Authentication of one or both parties using the certificates • Message protection • Confidentiality (encryption) • Integrity

17. EDAGrid Security Infrastructure • GSI is: Proxies and delegation (GSI Extensions) for secure single Sign-on Proxies and Delegation SSL/ TLS PKI (CAs and Certificates) SSL for Authentication And message protection PKI for credentials PKI: Public Key Infrastructure

18. Security issues • Authentication issues • User Interface • Single CA vs. Multiple CAs • Credential Management • Authorization issues • What happens if there are thousands to millions of users? • The grid-mapfile doesn’t scale well, and works only at the resource level, not the collective level (site level). • Accounting issues • Logs from VOInformation are not enough. • Billing system.

19. Outline • Grid Security on VN-GRID • VN-GRID topology • Authentication • Authorization • To do list

20. Certification Certification Authority Authority VO Server VO Server VN-GRID topology 1 1 2 2 GridNodes GridNodes Site 1 Site 2

21. Authentication • Goals • Support multi CAs. • User • Transparent authentication (Proxys/delegation). • Site/Individual Node • Easy to adhere.

22. Authentication (2) • Multiple CAs • Manual update -> simple. • Automatic update solution VN-GRID 1. request Site N CA CA 2. certificate 3. Adhere CAs data Portal 4. Agree/ Not Agree Update CAs List

23. Authorization • Goals • Support thousands to millions users from sites. • Compatible with site/local security policies. • Easy to understand and verify. • Easy to administer. Access Granted by community To user Access Granted by local To community Access Granted by site To user

24. Authorization (2) • Approachs • “Classic” Authorization Method • Identity mapping • Attribute-Based Authorization Methods • CAS(Community Authorization Service) • VOMS(Virtual Organization Membership Service) • PERMIS • GridShib • CaBig tools

25. Authorization (3) • Identity mapping • Gridmap file format Subject DNs  [user0, user1, …, usern-1] • Dual function identity-based gridmap file • Authorization Policy • Username Mapping Policy • A single gridmap file serves both functions

26. Authorization (4) • Attribute-Based Authorization • User create Proxy Certificate with Attributes user SAML:Security Assertion Markup Language

27. Authorization (5) • Attribute-Based Authorization • Authz on GridNodes GridNode PDP/PEP PDP: Policy Decision Point PEP: Policy Enforcement Point policies

28. Authorization (6) • GridShib • GridShib SAML Tools • A SAML producer • Binds a SAML assertion to an X.509 proxy certificate • The same X.509-bound SAML token can be transmitted at the transport level or the message level (using WS-Security X.509 Token Profile). • GridShib for Globus Toolkit • A SAML consumer • GridShib for GT (GS4GT) is a plug-in for GT 4.x

29. Authorization (7) • GridShib for GT (GS4GT)

30. Authorization (8) • GridShib for GT (GS4GT) • Two separate attribute-based policy files • Authorization Policy [A0, A1, …, Am-1] • Username Mapping Policy [A0, A1, …, Am1-1]  [user0, user1, …, usern1-1] [A0, A1, …, Am2-1]  [user0, user1, …, usern2-1] • A single XML-based policy file may encapsulate both types of policies

31. To do list • Building testbed system • Resources: 03 GridNodes (03 sites) • Install & configure GT4.x, GridShib • Programming • CLI to create Proxy Certificate with Attributes • Site Registration Service • Update CAs list programs for VO Server/GridNode • Documentation • Technical report • Admin Guide

32. Appendix

33. Symmetric Encryption • Encryption and decryption functions that use the same key are called symmetric • In this case everyone wanting to read encrypted data must share the same key • DES is an example of symmetric encryption Data Encrypt Decrypt Data

34. Asymmetric Encryption • Encryption and decryption functions that use a key pair are called asymmetric • Keys are mathematically linked • RSA is an example of asymmetric encryption

35. Asymmetric Encryption • When data is encrypted with one key, the other key must be used to decrypt the data • And vice versa Data Data Decrypt Encrypt Encrypt Decrypt Data Data

36. Public and Private Keys • With asymmetric encryption each user can be assigned a key pair: a private and public key Public key is given away to the world Private key is known only to owner

37. Public and Private keys • Anything encrypted with the private key can only be decrypted with the public key • And vice versa • Since the private key is known only to the owner, this is very powerful… Data Encrypt Decrypt Data

38. Digital Signatures • Digital signatures allow the world to verify I created a hunk of data • e.g. email, code

39. Digital Signatures • Digital signatures are created by encrypting a hash of the data with my private key • The resulting encrypted data is the signature • This hash can then only be decrypted by my public key Data Hash Encrypt Signature

40. Digital Signature • Given some data with my signature, if you decrypt a signature with my public key and get the hash of the data, you know it was encrypted with my private key Hash Hash Data =? Decrypt Signature Hash

41. Digital Signature • Since I’m the only one with access to my private key, you know I signed the hash and the data associated with it • But, how do you know that you have my correct public key? • Answer: A Public Key Infrastructure… ?