1. EGEE is a project funded by the European Union under contract IST-2003-508833 EGEE Security Åke Edlund Security Head EU IST-FP6 Concertation, 17 th September 2004 www.eu-egee.org

2. EU IST-FP6 Concertation, 17 th September 2004 - 2 Contents EGEE security plans Identified problems/challenges

3. EU IST-FP6 Concertation, 17 th September 2004 - 3 EGEE security plans (1/2) Security Requirements - Horizontal activity, managed through central groups  Lesson learned: reused and updated requirements from earlier projects  Collecting (continuous process) the requirements from the activities - Middleware, Sites, Applications.  Share the requirements with other grid activities and get feedback, e.g. in the US  Prioritization set in the security groups, with representatives from all involved activities.  Defining what security modules to deliver when. Product - leverage on the biomed requirements  To keep the industry focus we put extra effort, from day one, in supporting biomed applications, being a security demanding application. Middleware - Security is not an add-on, has to be there from start  From start, and ‘all over the place’: All JRA3 members are also part of the Middleware development.  Active in the architecture and design of the middleware Middleware, JRA1 Security, JRA3

4. EU IST-FP6 Concertation, 17 th September 2004 - 4 EGEE security plans (2/2) Security Architecture - Modular, Agnostic, Standard, Interoperable  Modular – add new modules later  Agnostic – modules will evolve  Standard – start with transport-level security but intend to move to WS-Security when it matures  Interoperable - at least for AuthN & AuthZ  Applied to Web-services hosted in containers and applications (Apache Axis & Tomcat) as additional modules Worldwide solution - Involve non-European partners at an early stage  Bob Cowles (SLAC, OSG) and Dane Skow (Fermilab, OSG) members of the MWSG  Establish contact through hands-on activities. Example: EGEE and OSG to define common operational security procedures, by contributing to/working out common documents, mostly by reusing OSG work already in place.

5. EU IST-FP6 Concertation, 17 th September 2004 - 5 Identified problems/challenges IssueCurrent solution Get focus on SecurityActive security work from start, security groups, driving/guiding documents Get involvement from GGF, OSG,..Middleware Security Group (MWSG) Avoid gaps in the security work Security Architect for the MW, Security Head overall responsible Lagging standardization work, e.g. Writing initial recommendations OGSA (Open Grid Services Architecture)for reengineering focusing on ordinary WS now, OGSA later Coordinating operational sec workJoint Security Group (JSG, SA1), guided by JRA3 documents (created together with SA1, OSG)

6. EU IST-FP6 Concertation, 17 th September 2004 - 6 Scope, objectives and status of M5/M6 deliverables: DJRA3.1 - Global security architecture (2/5) ServiceDescriptionTime frame Logging and AuditingEnsures monitoring of system activities, and accountability in case of a security event Now AuthenticationCredential storage ensures proper security of (user-held) credentials Now Proxy certificates enable single sign-on TLS, GSI, WS-Security and possibly other X.509 based transport or message-level security protocols ensure integrity, authenticity and (optionally) confidentiality Now EU GridPMA establishes a common set of trust anchor for the authentication infrastructure Now Pseudonymity services addresses anonymity and privacy concerns Mid-term Overview of the security architecture services.

7. EU IST-FP6 Concertation, 17 th September 2004 - 7 Scope, objectives and status of M5/M6 deliverables: DJRA3.1 - Global security architecture (3/5) ServiceDescriptionTime frame AuthorizationAttribute authorities enable VO managed access control Policy assertion services enable the consolidation and central administration of common policy Authorization framework enables for local collection, arbitration, customisation and reasoning of policies from different administrative domains, as well as integration with service containers and legacy services Now Future Now DelegationAllows for an entity (user or resource) to empower another entity (local or remote) with the necessary permissions to act on its behalf Now Overview of the security architecture services.

8. EU IST-FP6 Concertation, 17 th September 2004 - 8 Scope, objectives and status of M5/M6 deliverables: DJRA3.1 - Global security architecture (4/5) Overview of the security architecture services. ServiceDescriptionTime frame Data key managementEnables long-term distributed storage of data for applications with privacy or confidentiality concerns Mid-term SandboxingIsolates a resource from the local site infrastructure hosting the resource, mitigating attacks and malicious/wrongful use Mid-term Site proxyEnables applications to communicate despite heterogenous and non-transparent network access Mid-term

9. EU IST-FP6 Concertation, 17 th September 2004 - 9 Scope, objectives and status of M5/M6 deliverables: DJRA3.1 - Global security architecture (5/5) RequirementFulfilledSolution/Technology/ServiceTime frame Single sign-onYesProxy certificates and a global authentication infrastructure Now User PrivacyPartiallyPseudonymity servicesMid-term Data PrivacyPartiallyEncrypted data storageMid-term Audit abilityPartiallyMeaningful log informationNow AccountabilityYesAll system interactions can be traced back to a user Now VO managed access controlYesVOMSNow Support for legacy and non- WS based software components YesModular authentication and authorization software suitable for integration Now Timely revocation delaysYesGradual transition from CRL based revocation to OCSP based revocation Mid-term Non-homogenous network accessYesSite ProxyFuture High-level requirements and how the architecture address them

10. EU IST-FP6 Concertation, 17 th September 2004 - 10 Summary of work accomplished since last AA meeting -Productive meeting, kick-off for the s/w maintenance/development at JRA3. - Global Security Architecture - Security requirements - Incident response capability PM4PM5PM6 MWSG3 August 25 JRA1 All-hands meeting June 28-30 Task 1: Security requirement doc MJRA3.1 (PM3) completed Recurrent tasks: - JRA1 design team, integration, testing - EUGridPMA, QAG - Software maintenance and development Task 5: Taxonomy document on Incident handling and Security operational procedures; definition of a common Grid incident format. (PM6+) In cooperation with JSG and OSG Task 3: Phase1 OGSA doc MJRA3.3 (PM4) completed Task 4: DJRA3.1 Security Architecture doc (PM5) delivery date: Sept. 17 TR7: Software maintenance and development PM5: SOAP over HTTPS 80% PM6: Delegation 45%, AuthZ framework 70%, Mutual AuthZ 10%, VOMS admin & parser (ongoing) PM7: Message level security 70% PM9: Resource access control 10%, Grid enhancements for OpenSSL Started PM11: Site Proxy for GRID cluster Started September 13