1 / 14

Security Group

Security Group. D7. 6 Design Ideas E-mail : Akos.Frohner@cern.ch. Mutual Authentication. GSI – certificate based authentication challenge = random data key(data) = encoding with key validation: decode(public key, encode(private key, data)) = data Short-time certificates! -> no CRL.

creola
Download Presentation

Security Group

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Security Group D7.6 Design Ideas E-mail: Akos.Frohner@cern.ch

  2. Mutual Authentication GSI – certificate based authentication • challenge = random data • key(data) = encoding with key • validation: decode(public key, encode(private key, data)) = data Short-time certificates! -> no CRL

  3. Delegation • proxy certificate is generated on the server side • private key not crosses the net • rights of the proxy are subset of the original rights

  4. organisation virtual organisation VO policy site policy read a file ACL file VO membership, group, role Membership (dataflow) • Authenticate a user at a service • Gather additional information associated to the user or the actual session (e.g. group membership, role, time) • Gather additional information associated to the protected service or object (e.g. file permissions) • Get local policy applicable to the situation (e.g. temporarily disabled user) • Make an authorization information based on the identity and the additional information

  5. Membership (sequence)

  6. Access Control List • user – list of capabilities • operation • protected object – access control list • (policy: pattern + ACL) -> yes/no decision capability: • DN • VO DN • group/role/... ACL +cap.1:read +cap.2:write,read -cap.3:read … +cap.m:op1,op2 read user DN, VO cap.1 cap.2 … cap.n file decision yes/no policy /cms/**:+cms:read *:-Bob:read,write,delete *.bak:+cleanup-role:delete

  7. the original owner (creator) is marked for accountingnot user for authorization! creator have admin (getacl, setacl) permissions additional permissions from the enclosing object (default ACL), site and VO policy delete is a file attribute mark group/VO for accounting? File creator: Alice ACL +Alice:getacl,setacl, read,write,delete Directory creator:Alice ACL +Alice:getacl,setacl,create,list,delete default ACL dir:+Alice:getacl,setacl,create,list,delete file:+Alice:getacl,setacl,read,write,delete New File or Directory in an SE

  8. File Replication (sequence)

  9. +Alice:read,write,admin MC user RM 6.2. 1. 3. * 7. +Alice:read,write,admin SE SE +Alice:read,write,admin +RM-role:admin f1 f1 +Alice:read +RM-role:admin +Alice:read +RM-role:admin File Replication • SE.getACL(+Alice:read,write,admin) • RM.preRegister -> RM-role • SE.setACL(+Alice:read,write,admin; RM-role:admin) • Alice: RM.register • RM: MC.register • SE.getACL, MC.setACL (+Alice:read,write,admin; RM-role:admin) • SE.setACL(+Alice:read; RM-role:admin) 2. 5. 4. 6.1.

  10. MC user RM SE SE f1 Normal File Access • RM.getBestFile(LFN) -> SE, FN • SE.read(FN) 1. 2. f1 +Alice:read +RM-role:admin +Alice:read +RM-role:admin

  11. SE f1 Medical Image Access MC • RM.getBestFile(LFN) -> SE, FN • RM.getAppMetaData -> restricted-cert, key • SE.read(FN, restricted-cert) • decode(key, FN) Alice 1., 2. RM patient +Alice:read image 3. key SE f1 +RM-role:admin,read +RM-role:admin,read

  12. MC CAS user 2. 4. 1. 3. RM-2 RM-1 RM-role RM-role 5. SE SE 6. f1 f1 +Alice:read +RM-role:admin +Alice:read +RM-role:admin RM-role • CAS.getMembership -> RM-role • CAS.getMembership -> RM-role • user • metadata catalog • storage element • file ACL entry

  13. CA it CA ch CA fr VO LHC RM RB CAS VO EDG RM RB CAS job file SE CE INFN SE CE CNRS SE CE CERN Administrator Roles Certificate Authorities Virtual Organisation administrators • CAS admin • RM admin • RB admin Site administrators • SE admin • CE admin

  14. Other issues • initial credential: userid/password (PAM), kx509, ... • renewable, forwardable certificates • CAS: does more, then necessary • encoding of capabilities (structure vs. DN) • mapping CAS: composition of (Virtual) Organisations • mutual authorization: use only VO-role playing service • ACLs for jobs: monitor, stop, resume, kill • using multiple vs. single VO (multiple vs. one cas-certificate) ...

More Related