1. Grid Security work in 2004 Andrew McNab Grid Security Research Fellow University of Manchester

2. 4 January 2005A.McNab – Grid Security Outline ● Status in January 2004 ● e-Security Centre ● GridSite ● GridPP Website ● CERN + AHM Awards ● EGEE ● Secure web services ● GridPP + JISC funding ● Future plans

3. 4 January 2005A.McNab – Grid Security January 2004 ● I was still finishing off some Testbed Support work ● eg I still ran the UK HEP grid monitoring map ● Had just publish GridSite 1.0.0 software ● Had written security section of GridPP-2 proposal to PPARC ● Were discussing some kind of security group in Manchester, with MC, HEP, CS and Salford ISI ● Were still unsure how we would fit into CERN's LHC Computing Grid (LCG) and the EU's “Enabling Grids for e-Science” (EGEE) projects ● Still unsure how to fit in with move to Web Services

4. 4 January 2005A.McNab – Grid Security e-Security Centre ● Formed in January 2004 as a joint initiative between groups within the universities of Manchester and Salford: ● “University of Manchester, Department of Computer Science; University of Salford, Information Systems Security Research Centre; University of Manchester, High Energy Physics group; and Manchester Computing” ● So far, used as a platform for joint bids (eg our successful bid to JISC) and for “cross-advertising” at conferences, and for organising joint meetings

5. 4 January 2005A.McNab – Grid Security GridSite ● GridSite remains our key piece of grid security technology ● Adds support for grid security “objects” to Apache web server ● Identity certificates and GSI proxies ● VOMS attribute certificates for group membership ● GACL policy language ● Used by about 10 sites in HEP and UK Grid as the basis of their website ● Components in libgridsite are used by all sites in GridPP/LCG/EGEE

6. 4 January 2005A.McNab – Grid Security GridPP Website ● GridSite originally developed for managing www.gridpp.ac.uk ● This has been extended and redesigned during 2004 as part of GridPP-2 preparations ● Now about 100,000 page requests per month ● GridPP has ~50 active members by comparison

7. 4 January 2005A.McNab – Grid Security Awards ● In June, I got the CERN-UK award for “outstanding achievement in Grid development” ● Largely a recognition of the GridSite work, and also some security work during EDG ● In September, GridPP won the Best e-Science Project Website award at the UK e-Science All Hands Meeting ● Largely a recognition of the new design for the GridPP website done by people at QMUL, with the technical implementation done at Manchester

8. 4 January 2005A.McNab – Grid Security EGEE ● EGEE (“Enabling Grids for e-Science”) is a large EU- funded collaboration involving almost all EU countries, and led by CERN ● The aim is to get LHC Computing Grid technology into the hands of researchers in other sciences ● EU sees EGEE as similar to the GEANT academic network in Europe, which links JANET etc ● We have joined EGEE JRA3, which is developing security middleware ● We're providing the support for grid services not written in Java – so C/C++/Perl/Python etc

9. 4 January 2005A.McNab – Grid Security Web services ● Major trend in grids is away from binary protocols to use Web Services ● That is, that clients talk to services use a stream of XML (“SOAP”), with the interface itself defined in XML using the WSDL language. ● We are providing an implementation that supports the EGEE/JRA3 security architecture, based on GridSite/Apache ● Compatible with EGEE's own work for services in Java ● We've developed some of the EGEE specifications (eg the WSDL for the credential delegation protocol)

10. 4 January 2005A.McNab – Grid Security Funding + future plans ● We've received funding for 2.5 FTE from GridPP-2 for security middleware development ● To continue the GridSite and GACL work, as part of EGEE ● We've received funding for 0.5 FTE from GridPP-2 for security operations ● To operate www.gridpp.ac.uk and act as an “in-house” client for software developers ● We've received funding of 0.5 FTE from JISC for security middleware development ● Interoperation with other e-Sec Centre projects