Authentication Services in Open Grid Services
This document explores the authentication services integral to Open Grid Services Architecture (OGSA) as presented by Manish Mehta. It delves into the necessity for secure communication, trust relationships, and robust security services, including authentication, authorization, and integrity. The current status of OGSA security architecture is summarized, noting the reliance on Web Services Security (WS-Security) while acknowledging gaps in the existing infrastructure. Additionally, it outlines the challenges faced in dynamic environments and future specifications required for enhancing grid security frameworks.
Authentication Services in Open Grid Services
E N D
Presentation Transcript
Authentication Services in Open Grid Services by Manish Mehta April 27, 2004 Manish Mehta, CS 590L
Overview • Grid applications are • Distributed • Heterogeneous environments • Within dynamic “virtual organizations” Manish Mehta, CS 590L
OGSA aims at .. • Interoperable and Usable Grids for industry, e-science, and e-business. • This demands … • Trust Relationship • Secure Communication Manish Mehta, CS 590L
What Security Services are required? • Authentication • Authorization • Confidentiality • Integrity • Non-repudiation • Secure Delegation Manish Mehta, CS 590L
What is current status? • OGSA-Sec-WG has a draft out (June 2003) • Web Services (WS) Architecture has gained more attention • The Grid security is going to be based on WS security Architecture. • GGF has not yet accepted the WS architecture fully. But seems that they don’t have choice. Manish Mehta, CS 590L
OGSA Security Architecture Manish Mehta, CS 590L
OGSA Security Architecture (contd.) Manish Mehta, CS 590L
Basic requirements for authentication • Credential processing • Validate authentication tokens • Authorization • Evaluate the request against policy • Credential Conversion • Bridging different Trust Domains • Identity Mapping • Map identities in different domains Manish Mehta, CS 590L
GT2 model • Uses PKI • Kerberos, SSH, CRISIS were also reviewed. • Claims to introduce “proxy certificates” • Single entity decides its own Trust Domain (consequence of PKI) • Uses SSL Manish Mehta, CS 590L
GT3 Model • 2 main advantages over GT2 • Use of WS security protocol • Tight least-privilege model • Main Difference • Uses SOAP as opposed to TCP Manish Mehta, CS 590L
What are the problems? (Mainly due to WS security architecture) • Extension of the existing SSL infrastructure and use of authentication tokens at service level. • Need for authentication and authorization demands more than SSL. (Two-way) • Due to dynamic creation of services, key management becomes an issue. Manish Mehta, CS 590L
What is needed in future? • The WS security architecture is also immature and ill defined. Concrete specification needed. • OGSA does not fully adopt the WS security. GGF has to patch the holes in Architecture. Manish Mehta, CS 590L
