1. 30-Jan-03D.P.Kelsey, GridPP Security1 Security GridPP6 30 Jan 2003 Coseners House David Kelsey CLRC/RAL, UK d.p.kelsey@rl.ac.uk

2. 30-Jan-03D.P.Kelsey, GridPP Security2 Overview EU DataGrid LHC Computing Grid (LCG) GGF UK STF GridPP participants –Andrew McNab, Jens Jensen, Linda Cornwall, DPK (and others from time to time)

3. 30-Jan-03D.P.Kelsey, GridPP Security3 WP7 Security Coord Group D7.5 – Requirements and TB1 112 EDG requirements –72 essential, 37 desirable aims, 3 long-term aim Includes –Virtual Organisations (VO’s) – Role based authorisation Authorise resources as well as users –Local Authorisation Decisions and keep ACL’s local to data –Confidentiality Encrypted medical data Don’t know who is in a VO –International Collaboration – must inter-operate! D7.6 Security Design document – to be finalised during Feb 03

4. 30-Jan-03D.P.Kelsey, GridPP Security4 WP6 CA group - Authentication International/Inter-project collaboration important Building “Trust” between national CA’s and VO’s/projects –EDG, CrossGrid, ( also LCG, EGEE, …) Defines list of “trusted” CA’s –Minimum requirements and best practice –Currently 16 national CA’s Includes the new UK CA –Will grow to ~20 Considering FNAL (and CERN?) Kerberos CA –And SLAC Virtual Smart Card Aim to formalise a European PKI PMA body –with links to North America, (Asia-Pacific?), …

5. 30-Jan-03D.P.Kelsey, GridPP Security5 Security Design/Developments Security components developed (see EDG web) –CA Trust Matrix tools –VO/LDAP & VOMS – Authorisation –LCAS, LCMAPS – local authorisation and mapping –Gridmapdir – dynamic leased accounts –Gridsite – certificate-based web management –SlashGrid - dn-based grid homefile system –GACL – Library to parse ACL’s (XML) –edg-java-security (for Data Management, web services) –G-HTTPS (see Andrew’s slides)

6. 30-Jan-03D.P.Kelsey, GridPP Security6 UserVOMS service authr map pre-proc authr LCAS LCMAPS pre-proc LCAS Coarse-grained e.g. Spitfire WP2 service dn dn + attrs Fine-grained e.g. RepMeC WP2/WP3 Coarse-grained e.g. CE, Gatekeeper WP4 Fine-grained e.g. SE, /grid WP5 Java C Authorisation authenticate acl

7. 30-Jan-03D.P.Kelsey, GridPP Security7 VO Membership Service 1.Client and server authenticate themselves and establish a secure communication channel using standard Globus API. 2.The Client sends the request to the Server. 3.The Server checks the request and sends back the required info (signed by itself). 4.The Client checks the validity of the info received. 5.Steps 1—4 are repeated for each Server the Client wants to contact. 6.The Client creates a proxy certificate with an extension (non critical) containing all the info received from the contacted VOMS Servers. Query Authentication Request Auth DB VOMS pseudo- cert C=IT/O=INFN /L=CNAF /CN=Pinco Palla /CN=proxy VOMS pseudo- cert

8. 30-Jan-03D.P.Kelsey, GridPP Security8 LCG - Grid Deployment Planning now for LCG-1 (summer 03) –DPK is technical expert on LCG GDB WG3 Legal, political, site security policies, etc. –Acceptable Use policies (Rules) What is needed for User Registration (single signing)? –What is acceptable to Site Security Officers? GGF Site-AAA requirements group –An extremely important area – could kill the Grid! Authorisation (important area) –VO’s need to manage their members and sites/resource providers negotiate with VO’s

9. 30-Jan-03D.P.Kelsey, GridPP Security9 GGF and UK STF Global Grid Forum –We are active in the various Security Area groups CA –GridCP –CA Ops Authz –New Authorization group (McNab co-chair) Site- AAA – Requirements UK Security Task Force (core programme) –To advise the Director, and make recommendations –Jens Jensen and DPK members –http://umbriel.dcs.gla.ac.uk/NeSC/general/teams/stf/http://umbriel.dcs.gla.ac.uk/NeSC/general/teams/stf/ –NeSC Security workshop (Dec 5/6, 2002)