Security Issues in Grid Computing

1. Security Issues in Grid Computing Reading: Grid Book, Chapter 16: “Security, Accounting and Assurance” By Clifford Neuman

2. Security Issues Traditional systems: • Protect a system from its users • Protect data of one user from compromise In Grid systems: • Protect applications and data from system where computation executes • Stronger authentication needed (for users and code) • Protect local execution from remote systems • Different admin domains/security policies

3. Organization • Authentication • Password-based • Kerberos authentication • SSL authentication • Certification authorities • Authorization • Integrity and Confidentiality • Symmetric and asymmetric cryptography • PGP (Pretty Good Privacy) • SSL

4. Organization (cont.) • More Security Issues • Assurance • Accounting • Audit • More Security Technologies • IPSec and IPv6 • VPN (Virtual Private Networks) • Firewalls • GSS-API

5. Authentication • Process of verifying identity of a participant to an operation or request • Principal: entity whose identity is verified • local user OR user logged into remote system • Traditional systems: authenticate client to protect server • Grid systems: mutual authentication required • Ensure that resources and data not provided by an attacker

6. Authentication Methods:Password-based Authentication • Send unencrypted passwords: only suitable when messages can’t be read by untrusted processes while on network • Instead: Prove knowledge of a password: • Don’t send password over network • Use password as an encryption key • Encrypt a known but non-repeating value • Send encrypted value to party verifying authentication • Both parties must know password or trust a third-party to distribute it

7. Authentication Systems:Kerberos • Authentication and key distribution protocol • Used with symmetric encryption systems (both sides must share same key) • Better performance than systems using public key or asymmetric cryptography • Well-suited to frequent authentication • Centrally administered • Requires trusted, on-line certification authority: Key Distribution Center (KDC)

8. Using Kerberos to authenticate a client and a server • Each client and server register their keys in advance with Kerberos authentication server • Client wants to communicate with service provider: sends client and service provider names to Kerberos authentication server • Kerberos server randomly generates a session key that will be used for symmetric encryption between client and server • Kerberos server sends session key to client as well as a ticket that contains client’s name and session key, all encrypted with server’s key

9. Kerberos Authentication (cont.) • Client caches encrypted session key and ticket, which are valid for some period • Reduces number of authentication requests to server • Client forwards ticket to service provider AND sends server a timestamp encrypted using the session key • Server decrypts ticket and extracts session key • Server uses session key to decrypt timestamp and checks that timestamp is recent • If client needs to authenticate server, server encrypts the timestamp with the session key and sends it back to client

10. Authentication Systems: Secure Sockets Layer (SSL) • Widely-deployed: every web browser! • Client authenticates identity of the server • Send a session key from client to server to set up an encrypted communication • Server has a certificate that contains its public key • If client has a certificate, can authenticate itself to the server

11. Using SSL to authenticate a server • Client web browser with SSL contacts web server with SSL • Server sends public-key certificate to client • Client uses public key of a trusted Certificate Authority (CA) to verify server’s certificate is valid • Client verifies that hostname embedded in certificate is hostname of intended server • Client extracts server’s public key from certificate • Client uses server’s public key to encrypt a session key for a symmetric cryptosystem • Client sends encrypted session key to server • Server uses its private key to decrypt session key • Client and server communicate using symmetric cryptosystem with session key

12. Certificates and Certification Authorities (CA) • Certification mechanism provides binding between encryption key and authenticated identity • Certification authority (CA) is a third party that certifies or validates the binding • CA issues a certificate and signs it • Certificate is a data object that contains: • Distinguished name of a principal • In asymmetric cryptographic systems: the public key of the principal • Optional attributes: authorizations, group memeberships, email addresses, alternate names

13. Certification (cont.) • X.509 certificates:most widely used format • Web browsers • Secure email services • Public-key-based electronic payment systems • Validating the binding • Verifier must know the CA’s public key • Uses CA’s public key to validate CA’s signature • Hierarchy of CAs: each CA certified by higher-level CA except for root CA(s) • Applications and servers must know public key of trusted root CAs

14. Data Origin Authentication • Provides assurance that a particular message, data item or executable originated with a particular principal • Determines whether program was modified or sent by attacker

15. Delegation of Identity • Process that grants one principal the authority to act as another individual • Assume another’s identity to perform certain functions • E.g., in Globus: use the gridmap file on a particular resource to map authenticated user onto another’s account, with corresponding privileges

16. Reminder: Organization • Authentication • Password-based • Kerberos authentication • SSL authentication • Certification authorities • Authorization • Integrity and Confidentiality • Symmetric and asymmetric cryptography • PGP (Pretty Good Privacy) • SSL

17. Authorization • Process that determines whether a particular operation is allowed • Traditionally: based on authenticated identity of requester and local information • Access Control Lists (ACLs) • Grids: determine whether access to resource is allowed • Might have access control lists associated with resources, principals or authorized programs • User-provided code must also be authenticated

18. Distributed Authorization • E.g., Distributed Computing Environment • Systems still being developed • Distributed maintenance of authorization information: • Group membership • Access control lists • Need to verify the authenticity of authorization (and assurance) information • One approach: Embed these attributes in certificates • Signed by trusted third-party • “Privilege attribute certificates”

19. Distributed Authorization (cont.) • Restricted proxy: authorization certificate that grants authority to perform operation on behalf of grantor • Restricted for access to particular objects • Only when specified restrictions are satisfied • Alternative: separate authorization server • Party providing a service checks with server whether a named principal is authorized

20. Delegation of Authority • User or process that is authorized to perform an operation can grant authroity to perform the operation to another process • More restricted than identity delegation • In Grids: • Used for tasks that run remotely on grid that must read or write data stored across the network • E.g., resource manager allocates a node to a job and delegates to job’s initator authority to use that node

21. Integrity and Confidentiality • Protect data during transmission on network • Anyone connected to an open network may observe, insert or possibly remove messages • Cryptography • Encryption: scrambles data in a way that varies based on a secret encryption key • Decryption: unscramble data using corresponding decryption key • Ciphertext: scrambled data • Plaintext: original or unscrambled data

22. Encrypted messages provide integrity and confidentiality • Protect data from eavesdroppers • data encrypted before transmission and decrypted afterward • Checksums protect data integrity • Attach a checksum to data before enryption • After decryption, receiver verifies checksum • Detect modifications of data by someone who doesn’t know encryption key

23. Symmetric Cryptosystems • Examples:DES (data encryption standard), triple-DES, idea, blowfish, RC4, RC5 • Uses same key for encryption & decryption • Both parties must share same key • With static keys: • User needs different key for every other user or service provider • Service provider maintains key for every user • Or, use mutually-trusted intermediary to generate and distribute session key to both parties • E.g., Kerberos Key Distribution Center

24. Symmetric Encryption Key Distribution Using Kerberos • Each client and server register their keys with Kerberos authentication server in advance • Client wants to communicate with service provider: sends client and service provider names to Kerberos authentication server • Kerberos server randomly generates a session key that will be used for symmetric encryption between client and server • Kerberos server sends session key to client as well as a ticket that contains client’s name and session key, all encrypted with server’s key

25. Key Distribution Using Kerberos (cont.) • Client caches encrypted session key and ticket, which are valid for some period • Reduces number of authentication requests to server • Client forwards ticket to service provider AND sends server a timestamp encrypted using the session key • Server decrypts ticket and extracts session key • Server uses session key to decrypt timestamp, checks that it is recent • If client needs to authenticate server, server encrypts the timestamp with the session key and sends to client

26. Asymmetric Cryptography • Also Public Key cryptography (PKI) • E.g., RSA or DSA (digital signature algorithm) • Uses a pair of keys for encryption and decryption • Knowledge of one key does not reveal the other • Public key: published and available to anyone • Private key: secret, known to only one party • Advantage: can disseminate public key freely • Disadvantage: significantly worse performance than symmetric encryption • Because of performance, rarely used in isolation • Used in combination with symmetric encryption

27. Using Asymmetric Encryption to Exchange a Symmetric Key • Sender generates a symmetric session key and an associated checksum • Sender encrypts key and checksum using recipient’s public key and sends them to recipient • Recipient decrypts key and checksum using its private key • Recipient verifies checksum is correct and extracts session key • Communication proceeds using symmetric encryption with the session key

28. Using Asymmetric Encryption to Exchange Symmetric Key (cont.) • Pay asymmetric performance penalty at startup but not on every block transferred • Relies on each party knowing public keys or relying on trusted third party (CA) to verify public keys • Otherwise, attacker could replace public key with different public key that has a private key known by attacker

29. Encryption with PGP (Pretty Good Privacy) • Provides integrity, authentication and confidentiality for email and data files • Sender: • Computes a message digest (similar to a checksum) • Encrypts original message using symmetric cryptography with a message key • Encrypts the message digest with asymmetric cryptography using the private key of the sender • Provides a digital signature (integrity) • Encrypts the message key with asymmetric cryptography using recipient’s public key

30. PGP (Pretty Good Privacy) (cont.) • Recipient: • Decrypts message digest using public key of sender • Decrypts message key using its own private key • Uses message key to decrypt original message • Verifies the correctness of message using digest

31. Digital Signatures • Does not require encryption of original message • Message digest • Computationally infeasible for another message to produce the same digest • Encrypted • Attached to message • Can detect if message was altered during transmission • Provides a digital signature

32. Reminder: Organization • More Security Issues • Assurance • Accounting • Audit • More Security Technologies • IPSec and IPv6 • VPN (Virtual Private Networks) • Firewalls • GSS-API

33. More Security Issues: Assurance • Service requester has requirements for: • performance, security, reliability • Does candidate service provider meet these requirements? • Form of authorization (“accreditation”) used to validate service provider • Grid example: check assurance credentials when selecting nodes for computation: • Do they meet performance, reliability, or security requirements? • Assurance schemes: not widely deployed

34. More Security Issues: Accounting • Means of tracking, limiting or charging for consumption of resources • Critical for fair allocation of resources • Tied in with authorization • In the grid: accounting is critical • Need a means of payment • Correctly charge user at time a resource is consumed • Need an incentive to make resources available • Grids require a distributed mechanism to maintain quotas across systems • Prevent users from exceeding resource limits by spreading use across machines • Grid accounting schemes still being developed

35. More Security Issues: Audit • Record operations performed by a system and associate actions with principals • Problems: Find out what went wrong • Security breaches: Intrusion detection • In a grid: audit mechanism must be distributed • Intrusion Detection • Need log of events for later or concurrent analysis • Protect confidentiality of audit data • Vulnerable to modification, deletion or denial of service • Grid applications will affect intrusion detection algorithms • Normal grid activities may look similar to certain network attacks

36. More Security Technologies: IPSec and IPv6 • Transport layer protection for confidentiality and integrity • When communication established between two network hosts: • Use key distribution to exchange key for symmetric encryption • Key distribution may use Kerberos, PKI, … • Keys are associated with hosts, not with applications or users

37. More Security Technologies:Virtual Private Networks (VPNs) • Use transport-layer confidentiality and integrity • Share physical infrastructure of internet • Communication only between participating nodes • Protected from disclosure to/modification by nodes that are not participants • Used when impractical to integrate security at application layer • Since they operate at tranport layer, cannot: • Authenticate end users • Understand application-level objects that need protection • Support security policies that distinguish users & application objects

38. More Security Technologies:Firewalls • Provide a barrier at boundary of organization’s network • Only specifically authorized communication may pass through • Prevent many attacks on hosts within organization • In grids: less useful • Grid applications will often require communication through firewall • Need to integrate IPSec and VPN technologies at network boundaries with firewalls • Messages on internal network remain unprotected • Encrypt/decrypt messages as they leave/enter VPN at the firewall

39. More Security Technologies:GSS-API • Generic Security Services Application Programming Interface • Facilitates integration of security at application layer • Applications make calls to authentication, confidentiality and integrity services • Calls are independent of underlying security services