1. Grid Computing, B. Wilkinson, 20045a.1 Security Continued

2. Grid Computing, B. Wilkinson, 20045a.2 Public Key Cryptography Double Encryption Hello. This is my message that must be kept secret 12ga;jey ck027jc;L; sajckjyfras biiop[pa23 54mghdas Receiver’s public key Receiver’s private Key Original data Transmitted data Original data Sender Receiver Sender’s public key Sender’s private Key Slow but secure.

3. Grid Computing, B. Wilkinson, 20045a.3 Question Why is single encryption with receiver’s public key/single decryption with receiver’s private key (slide 5-19) not sufficient? Answer

4. Grid Computing, B. Wilkinson, 20045a.4 Public Key and Secret Key Cryptography Public Key and Secret Key Cryptography generally used together. Public key Cryptography with Certificates and a Certificate Authority (CA) used to establish a secure authenticated connection between parties. Then: –Secret key passed between parties. –Secret key cryptography used to encrypt data, which is much faster than public key cryptography.

5. Grid Computing, B. Wilkinson, 20045a.5 Use of Public Key Infrastructure (PKI) Several network protocols have embedded public key and/or secret key cryptographic algorithms. Most notable is SSL (described in slides5), which can be added on top of protocols such as http (i.e. https), FTP (sftp), and telnet.

6. Grid Computing, B. Wilkinson, 20045a.6 Others include: For secure email - S/MIME (Secure Multipurpose Internet Mail Extensions) developed by RSA Data Security Inc, see: http://www.rsa.com/smime For secure e-commerce - SET (Secure Electronic Transaction), developed jointly by Visa, Mastercard, IBM, and other companies, for secure credit card transactions over the Internet, see: http://www.setco.org

7. Grid Computing, B. Wilkinson, 20045a.7 Certificate Authorities Commercial Certificate Authorities exist, such as: –VeriSign Inc. –Entrust Technologies Inc., Web browsers have built-in recognition such trusted CAs, allowing SSL and other secure connections.

8. Grid Computing, B. Wilkinson, 20045a.8 General Public Key Infrastructure From: “Deploying a Public Key Infrastructure,” IBM Redbook, SG24-5512-00.

9. Grid Computing, B. Wilkinson, 20045a.9 Certificate Repository Used to store: –Issued certificates –Revoked certificates (CRLs - Certificate Revocation List) –Might be accessed through LDAP (Lightweight Directory Access Protocol)

10. Grid Computing, B. Wilkinson, 20045a.10 Registration Authority Acts for CA for some management functions (see IBM Redbooks). Not strictly necessary as CA could do all functions.

11. Grid Computing, B. Wilkinson, 20045a.11 CA’s own certificate CA needs it own certificate identify itself First it generates key pair. It protect its private key. (This is vitally important!) It then creates a certificate and signs it with its private key: CA’s public key Certificate CA’s digital signature CA’s X-500 name

12. Grid Computing, B. Wilkinson, 20045a.12 Requesting a certificate from a CA Usually the requesting client generates a public/private key pair and then submits an unsigned certificate to the CA. The certificate returned signed by the CA contains the public key.

13. Grid Computing, B. Wilkinson, 20045a.13 Question Why usually does the CA not generate the public/private key pair for the requester? Answer Because it would require the private key to be sent to the requester. If the requester generates the private key, it is more secure as it does not leave requester.

14. Grid Computing, B. Wilkinson, 20045a.14 Using a signed certificate to send a secure message One can attached it to your message. Alternatively, the message is sent without a certificate and the receiver has to retrieve the certificate from a public place. Either way, the receiver checks the signature. It has to be CA it can trust.

15. Grid Computing, B. Wilkinson, 20045a.15 Certificate Lifetime Certificates have a limited lifetime for security purposes, i. e. certificates are issued with an expiration date. Have a renewal process but user will normally have same public/private key pair.

16. Grid Computing, B. Wilkinson, 20045a.16 Certificate Authority for Grid Computing Usually a certificate authority is created for the specific grid computing environment. Globus has “simple” implementation called simpleCA.

17. Grid Computing, B. Wilkinson, 20045a.17 Grid Users After Certificate Authority established for the grid, users have to register with grid CA. This was done for each account provided at WCU, so users did not have to do anything. In general, users joining a grid from geographically dispersed locations must communicate with the CA system administrator to verify their identity and to get a certificate. Communication often done by email.

18. Grid Computing, B. Wilkinson, 20045a.18 Grid Security Infrastructure From: “Introduction to Grid Computing with Globus,” IBM Redbooks, SG24-6895-012003, Fig. 3-3. Globus Interaction with Certificate Authority This step done by email or a more a secure way.

19. Grid Computing, B. Wilkinson, 20045a.19 Grid Computers Computers added to a grid (donors) preferably need their identity verified in a similar fashion. Computers registered with certificate authority - only those machines will be allowed to participate in the grid activities. Computers might be used under a certain access rights.

20. Grid Computing, B. Wilkinson, 20045a.20 GSI Authentication/Authorization Functions Communicating from Host A to Host B From host A to host B: –Host A send its certificate to Host B –Host B gets Host A’s public key and name using CA’s public key. –Host B creates a random number and sends it to Host A. –Host A encrypts random number with its private key and sends it to host B. –Host B decrypts number and checks number. If correct, Host B authenticates host A’s certificate.

21. Grid Computing, B. Wilkinson, 20045a.21 From: “Introduction to Grid Computing with Globus,” IBM Redbooks, SG24-6895-012003, Fig. 3-4.

22. Grid Computing, B. Wilkinson, 20045a.22 Proxies Proxy needed to delegate authority to another host, say host C through host B, where the proxy will act on your behalf. Rather a large number of steps.

23. Grid Computing, B. Wilkinson, 20045a.23 From: “Introduction to Grid Computing with Globus,” IBM Redbooks, SG24-6895-012003, Fig. 3-5.

24. Grid Computing, B. Wilkinson, 20045a.24 Proxies used to authenticate users and run user programs on grid. Proxy created with grid-proxy-int command. We shall see a use of this in assignment 3. Next task is assignment 2.