The EDGeS project receives Community research funding 1 Specific security needs of Desktop Grids Desktop Grids Desktop Grids EDGeS project EDGeS project Delegation for access to trusted resources Delegation for access to trusted resources

Etienne URBAH LAL, Univ Paris-Sud, IN2P3/CNRS, Orsay, France v1.2 2 DG = Desktop Grid = Loose grid scavenging idle resources Specific security needs of Desktop Grids DG = Desktop Grid = Loose grid scavenging idle resources Unit of Work = Application + Input Data Unit of Work = Application + Input Data Grid User Submits input data for an application Requests Unit of Work Sends Unit of Work Application Manager Certifies Application Resource Owner (often volunteer) Owns Resource Sends back results Accepts or Refuses an application on his resource Grid Server with Application Repository Computing Resource (often Desktop Computer) Sends back results Currently, for BOINC, both roles of ‘Application Manager’ and ‘Grid User’ are fulfilled by ‘BOINC Project Owners’.

Etienne URBAH LAL, Univ Paris-Sud, IN2P3/CNRS, Orsay, France v1.2 3 DG = Desktop Grid = Loose grid scavenging idle resources Specific security needs of Desktop Grids DG = Desktop Grid = Loose grid scavenging idle resources Computing and Storage Resources are owned by various Owners (it is often volunteer computing), but they are NOT managed and NOT authenticated.Computing and Storage Resources are owned by various Owners (it is often volunteer computing), but they are NOT managed and NOT authenticated. Grid Servers are authenticated by a X509 certificate.Grid Servers are authenticated by a X509 certificate. Users are authenticated by the Grid Servers, but NOT by the Computing and Storage Resources.Users are authenticated by the Grid Servers, but NOT by the Computing and Storage Resources. Executables are certified by managers of the Grid Servers.Executables are certified by managers of the Grid Servers. So :– Resource Owners have to trust the Grid Servers, – BOINC sends each Work Unit to several Resource Owners, because BOINC does NOT fully trust them. Order of magnitude can be CPUs.Order of magnitude can be CPUs. Starving Computing Resources pull Work Units from Grid Servers.Starving Computing Resources pull Work Units from Grid Servers. Examples : BOINC, XtremWeb, xGrid, OurGrid

Etienne URBAH LAL, Univ Paris-Sud, IN2P3/CNRS, Orsay, France v1.2 4 Presentation of the EDGeS project Specific security needs of Desktop Grids Presentation of the EDGeS project New FP7 project started on 01/01/2008 Integrate Service Grids and Desktop GridsIntegrate Service Grids and Desktop Grids Enable very large number of computing resources (100K-1M processors)Enable very large number of computing resources (100K-1M processors) Attract new scientific communitiesAttract new scientific communities Provide a Grid application development environmentProvide a Grid application development environment Provide application repository and bridges for the execution in the SG-DG systemProvide application repository and bridges for the execution in the SG-DG system WLCG (CERN) EDGeS gLite (EGEE) ARC (NorduGrid) Boinc (Berkeley) XtremWeb (INRIA/IN2P3) Xgrid (Apple) Unicore (DEISA) VDT (OSG) Current Future

Etienne URBAH LAL, Univ Paris-Sud, IN2P3/CNRS, Orsay, France v1.2 5 Presentation of the EDGeS project Specific security needs of Desktop Grids Presentation of the EDGeS project Now, Interoperation : Ad-hoc bridges and interfaces between EGEE, BOINC and XtremWeb.Ad-hoc bridges and interfaces between EGEE, BOINC and XtremWeb. A MoU between EDGeS and EGEE has been signed on 23 Sept 2008.A MoU between EDGeS and EGEE has been signed on 23 Sept XtremWeb users must have a X509 certificate, be registered in a VO and submit their Jobs with a VOMS proxy.XtremWeb users must have a X509 certificate, be registered in a VO and submit their Jobs with a VOMS proxy. BOINC Project Owners must have a X509 certificate, be registered in a VO and store a medium-term X509 proxy in a MyProxy server.BOINC Project Owners must have a X509 certificate, be registered in a VO and store a medium-term X509 proxy in a MyProxy server. All files must be transferred through the Input and Output sandboxes.All files must be transferred through the Input and Output sandboxes. In the future : Interoperability using OGF standards, in order to bridge more Grids.Interoperability using OGF standards, in order to bridge more Grids. Better support of grid file access (ByteIO, GridFTP).Better support of grid file access (ByteIO, GridFTP).

Etienne URBAH LAL, Univ Paris-Sud, IN2P3/CNRS, Orsay, France v1.2 6 EGEE WMS EDGeS 3G bridge EGEE Plugin 1 for each (BOINC Project Owner, EGEE VO) pair Queue Manager & Job DB BOINC Handler 1 for each (BOINC server, BOINC Project Owner, EGEE VO) triple Bridge BOINC  EGEE (WU = Work Unit) Specific security needs of Desktop Grids Bridge BOINC  EGEE (WU = Work Unit) WU i+1 WU i+2 WU i+3 Job i+1 Job i+2 BOINC Server Work Unit BOINC Project Owner Submission MyProxy trusting EDGeS 3G bridge Medium term X509 proxy Config. file DN of X509 proxy Short term X509 proxy VOMS Server VOMS extensions Job Handler Interface Grid Handler Interface BOINC jobwrapper client (simulating a large BOINC computing resource) 3G job- wrapper VOMS proxy Retriever

Etienne URBAH LAL, Univ Paris-Sud, IN2P3/CNRS, Orsay, France v1.2 7 Bridge BOINC  EGEE Specific security needs of Desktop Grids Bridge BOINC  EGEE Solution = Inside EDGeS bridge, marshalling of the BOINC Work Units into Job collections For each (BOINC server, BOINC Project Owner, EGEE VO) triple, a separate Job Handler collects the BOINC Work Units and place them in a queue.For each (BOINC server, BOINC Project Owner, EGEE VO) triple, a separate Job Handler collects the BOINC Work Units and place them in a queue. For each (BOINC Project Owner, EGEE VO) pair, a separate EGEE plugin :For each (BOINC Project Owner, EGEE VO) pair, a separate EGEE plugin : –Retrieves a short term X509 Proxy for the BOINC Project Owner from a MyProxy server, and VOMS extensions from a VOMS server, –Periodically processes new Work Units found in the queue : It converts each Work Unit into an EGEE Job, In order to reduce the usage of the EGEE WMS, it uses Collection possibili- ties of EGEE to submit many Jobs in one request described using JDL.

Etienne URBAH LAL, Univ Paris-Sud, IN2P3/CNRS, Orsay, France v1.2 8 EGEE Bridge XtremWeb  EGEE Specific security needs of Desktop Grids Bridge XtremWeb  EGEE XtremWeb User X509 proxy VOMS proxy Submits User Job with VOMS proxy Sends back Job Status and Results VOMS Server XtremWeb Server Submits mono-user Pilot Job with VOMS proxy Gives Pilot Job Status gLite WMS Computing Element Pushes Pilot job Mono-user Pilot Job Requests only 1 User Job Sends 1 User Job with same VOMS proxy User Job Gives Pilot Job Status Sends back results directly XtremWeb Bridge Requests User Jobs Sends User Jobs with VOMS proxy Manages User Job status

Etienne URBAH LAL, Univ Paris-Sud, IN2P3/CNRS, Orsay, France v1.2 9 Bridge XtremWeb  EGEE Specific security needs of Desktop Grids Bridge XtremWeb  EGEE Solution = XtremWeb bridge : Gliding with a mono-user Pilot Job 1.A XtremWeb User submits to the XtremWeb server his User Job with a VOMS proxy. 2.At the request of the XtremWeb bridge, the XtremWeb server sends him the User Job with the VOMS proxy. 3.The XtremWeb bridge submits to a gLite WMS a mono-user Pilot Job with this VOMS proxy (job description in a JDL). 4.The gLite WMS pushes the Pilot Job to a Computing Element, which executes it. 5.The mono-user Pilot Job requests 1 User Job from the XtremWeb server, and stops itself if it receives none. 6.The XtremWeb server verifies that the requested User Job has a VOMS proxy, and sends the User Job and the VOMS proxy to the Pilot Job. 7.The Pilot Job verifies that the received VOMS proxy is the same as its own VOMS proxy, and executes the User Job. 8.At the end of the User Job, the Pilot Job sends the Job results directly to the XtremWeb server, then stops itself.

Etienne URBAH LAL, Univ Paris-Sud, IN2P3/CNRS, Orsay, France v Bridge EGEE  Desktop Grids Specific security needs of Desktop Grids Bridge EGEE  Desktop Grids EGEE LCG-CE for EDGeS Gets EXE Watches Reports resources and performance Pushes job Checks EXE Submits Job Logs events Gets VOMS proxy Logs events EDGeS Application Repository EGEE BDII gLite WMS EGEE LB EGEE VOMS EGEE User Sends output Gets output EDGeS 3G bridge Adds job Watches job Desktop Grid plugin Information provider GRAM Job Manager for EDGeS Queue Manager & Job DB Generic Job WS Handler Desktop Grid

Etienne URBAH LAL, Univ Paris-Sud, IN2P3/CNRS, Orsay, France v Bridges EGEE  BOINC & XtremWeb Specific security needs of Desktop Grids Bridges EGEE  BOINC & XtremWeb Solution = Installation of a LCG-CE sending the EGEE Jobs to the EDGeS bridge, which marshals them into Desktop Grid Jobs Information Provider publishes information to the BDII according to GLUE 1.3Information Provider publishes information to the BDII according to GLUE 1.3 Customized GRAM Job Manager (EGEE producer)Customized GRAM Job Manager (EGEE producer) –Gets job information from wrapper –Checks if exe is validated in the EDGeS application repository (GEMLCA) –Checks if exe is supported by attached BOINC –Gets files from WMS –Adds job to 3G bridge job Database –Polls status of jobs in 3G bridge job Database –Gets results from 3G bridge and uploads them to Logging & Bookkeeping EDGeS 3G bridge EDGeS 3G bridge –Manages jobs in the 3G bridge database –On events, updates entries in the 3G bridge database –Desktop Grid plugins BOINC plugin uses DC-API to generate BOINC Work Units XtremWeb plugin generates XtremWeb Jobs

Etienne URBAH LAL, Univ Paris-Sud, IN2P3/CNRS, Orsay, France v Delegation for access to trusted resources Specific security needs of Desktop Grids Delegation for access to trusted resources Jobs having to access trusted Resources require delegation (through X509 proxies or SAML assertions) Is it possible to provide delegation to untrusted Computing Resources of Desktop Grids ?

Etienne URBAH LAL, Univ Paris-Sud, IN2P3/CNRS, Orsay, France v – Delegation Current situation : NO restriction  Full impersonation Specific security needs of Desktop Grids – Delegation Current situation : NO restriction  Full impersonation Acceptable only with trusted computing resources NOT acceptable with untrusted (DG) computing resources Grid User Submits Job EGEE Computing Element Submits Job Trusted Worker Node Trusted Data Access Trusted Storage Resource Full impersonation Grid User Submits Job EGEE Computing Element Submits Job Untrusted Worker Node Untrusted Data Access Trusted Storage Resource Full impersonation X509 proxy without restrictions X509 proxy without restrictions X509 proxy without restrictions X509 proxy without restrictions X509 proxy without restrictions X509 proxy without restrictions

Etienne URBAH LAL, Univ Paris-Sud, IN2P3/CNRS, Orsay, France v – Delegation Current situation : NO restriction  Full impersonation Specific security needs of Desktop Grids – Delegation Current situation : NO restriction  Full impersonation By now, WITHOUT restrictions on delegation, X509 proxies permit full impersonation. Therefore, when sending jobs, it is acceptable to send along such X509 proxies : –only to TRUSTED computing resources (for example Worker Nodes of local or EGEE clusters), because the storage resources must trust that the computing resource will only access to data described in the job, –but NOT to UNTRUSTED computing resources (for example from a public Desktop Grid), because they could then have access to all user data.

Etienne URBAH LAL, Univ Paris-Sud, IN2P3/CNRS, Orsay, France v – Delegation Under development : X509 Proxies with Restrictions Specific security needs of Desktop Grids – Delegation Under development : X509 Proxies with Restrictions Improved security with trusted computing resources Could also be acceptable with untrusted computing resources Could also be acceptable with untrusted computing resources Grid User Submits Job EGEE Computing Element Submits Job Trusted Worker Node Trusted Data Access Trusted Storage Resource Restricted impersonation Grid User Submits Job EGEE Computing Element Submits Job Untrusted Worker Node Trusted Data Access Trusted Storage Resource Restricted impersonation X509 proxy with restrictions X509 proxy with restrictions X509 proxy with restrictions X509 proxy with restrictions X509 proxy with restrictions X509 proxy with restrictions

Etienne URBAH LAL, Univ Paris-Sud, IN2P3/CNRS, Orsay, France v – Delegation Under development : X509 Proxies with Restrictions Specific security needs of Desktop Grids – Delegation Under development : X509 Proxies with Restrictions When sending jobs, it could be acceptable to send X509 proxies containing restriction attributes about data access to UNTRUSTED computing resources (for example from a public Desktop Grid), because : –In order to get access to data, computing resources have to present to storage resources the full X509 proxy, INCLUDING ALL restriction attributes. –Storage resources are then able to refuse data access if restriction attributes forbid it, –Data that the jobs have to read are easily protected against corruption or deletion by using restriction attributes setting those data as read-only. –Malicious computing resources can always corrupt data on which they have write access, but they can already write false data in the Output Sandbox of jobs anyway. If these restriction attributes are really implemented, enforced and considered secure enough, this would permit computing resources of Desktop Grids to access storage resources of EGEE Storage Elements (using SRM, GridFTP, …), with a great impact on EDGeS JRA3.

Etienne URBAH LAL, Univ Paris-Sud, IN2P3/CNRS, Orsay, France v – Delegation Access to untrusted Storage Resources of Desktop Grids Specific security needs of Desktop Grids – Delegation Access to untrusted Storage Resources of Desktop Grids Could access of trusted Computing Resources to untrusted Storage Resources of Desktop Grids be acceptable ? EDGeS is studying the issue. We can get advices from you and Jesus LUNA. Grid User Submits Job EGEE Computing Element Submits Job Trusted Worker Node Untrusted Data Access Untrusted Storage Resource X509 proxy X509 proxy NO X509 proxy