GRID COMPUTING SECURITY
CONTENTS 1 INTRODUCTION BACKGROUND GRID COMPUTING OVERVIEW EVOLUTION OF GRID COMPUTING BENEFITS OF GRID COMPUTING GRID COMPUTING ISSUES AND CONCERNS ABOUT THE BOOK TARGET AUDIENCE ORGANIZATION OF THE BOOK 2 OVERVIEW OF SECURITY INTRODUCTION CHARACTERISTICS OF SECURE SYSTEM SECURITY THREATS DIFFERENT ENCRYPTION SCHEMES DIFFERENT AUTHENTICATION SCHEMES SHARED SECRET BASED AUTHENTICATION PUBLIC KEY BASED AUTHENTICATION THIRD PARTY AUTHENTICATION SCHEMES DIFFERENT INTEGRITY SCHEMES MESSAGE AUTHENTICATION CODE (MAC) KEYED MAC STANDARD PROTOCOLS PUBLIC KEY INFRASTRUCTURE SECURE SOCKET LAYER (SSL) KERBEROS IP SECURITY (IPSEC) CHAPTER SUMMARY 3 TAXONOMY OF GRID SECURITY ISSUES GRID SECURITY TAXONOMY ARCHITECTURE RELATED ISSUES INFORMATION SECURITY AUTHORIZATION SERVICE SECURITY INFRASTRUCTURE RELATED ISSUES HOST SECURITY ISSUES NETWORK SECURITY ISSUES MANAGEMENT RELATED ISSUES CREDENTIAL MANAGEMENT TRUST MANAGEMENT MONITORING 4 GRID INFORMATION SECURITY ARCHITECTURE GRID SECURITY INFRASTRUCTURE (GSI) GRID SECURITY MODEL AUTHENTICATION IN GSI CERTIFICATE BASED AUTHENTICATION PASSWORD BASED AUTHENTICATION INTEGRATION WITH KERBEROS DELEGATION IN GSI AN EXAMPLE: SECURITY IN GLOBUS TOOLKIT 40 (GT4) MESSAGE PROTECTION IN GT4 DELEGATION IN GT4 5 GRID AUTHORIZATION SYSTEMS DIFFERENT ACCESS CONTROL MODELS PUSH VS PULL AUTHORIZATIONS CHARACTERISTICS OF GRID AUTHORIZATION SYSTEMS SCALABILITY ISSUES SECURITY ISSUES REVOCATION ISSUES INTER-OPERABILITY ISSUES GRID AUTHORIZATION SYSTEMS VO LEVEL AUTHORIZATION SYSTEMS COMMUNITY AUTHORIZATION SERVICE (CAS) VIRTUAL ORGANIZATION MEMBERSHIP SERVICE (VOMS) ENTERPRISE AUTHORIZATION AND LICENSING SERVICE (EALS) RESOURCE LEVEL AUTHORIZATION SYSTEMS AKENTI PRIVILEGE AND ROLE MANAGEMENT INFRASTRUCTURE STANDARDS VALIDATION (PERMIS) PROJECT AUTHORIZATION USING GRIDMAP COMPARING THE DIFFERENT AUTHORIZATION SYSTEMS COMPARISON ROADMAP TO GRID AUTHORIZATION SYSTEMS 6 SERVICE LEVEL SECURITY IN GRID SYSTEMS COMPONENTS OF SERVICE SERVICE VULNERABILITIES DOS ATTACKS AND COUNTERMEASURES EFFECT OF DOS ATTACKS DISTRIBUTED DENIAL-OF-SERVICE ATTACKS EXISTING DOS COUNTERMEASURES PREVENTIVE DOS COUNTER-MEASURES REACTIVE DOS COUNTERMEASURES COMPARISON BETWEEN DOS COUNTERMEASURES QOS VIOLATION ATTACKS AND COUNTERMEASURES DIFFERENT TYPES OF QOS VIOLATION ATTACKS EXISTING SOLUTIONS 7 HOST LEVEL SECURITY DATA PROTECTION ISSUE APPLICATION LEVEL SANDBOXING VIRTUALIZATION FLEXIBLE KERNEL SYSTEMS SANDBOXING JOB STARVATION ISSUE ADVANCED RESERVATION TECHNIQUES PRIORITY REDUCTION TECHNIQUES 8 GRID NETWORK SECURITY GRID NETWORK SECURITY ISSUES FIREWALLS DIFFERENT TYPES OF FIREWALLS FIREWALLS AND GRID – ISSUES FIREWALLS AND WEB SERVICES VIRTUAL PRIVATE NETWORKS (VPN) VPNS AND GRID – TYPES OF VPNS VPNS AND GRID – ISSUES VPNS AND GRID – SOME SOLUTIONS SECURE ROUTING IMPACTS OF ROUTING TABLE “POISONING” DIFFERENT ROUTING PROTOCOLS ROUTING ATTACKS AND COUNTERMEASURES MULTICASTING SECURE MULTICASTING SENSOR GRIDS SECURITY IN SENSOR NETWORKS – ISSUES HIGH PERFORMANCE INTERCONNECTS 10-GIGABIT ETHERNET INFINIBAND ARCHITECTURE (IBA) SOME HIGH PERFORMANCE SECURITY SOLUTIONS 9 GRID CREDENTIAL MANAGEMENT SYSTEMS TYPES OF CREDENTIALS CHARACTERISTICS OF CREDENTIAL MANAGEMENT SYSTEMS DIFFERENT CREDENTIAL MANAGEMENT SYSTEM CENTRALIZED VS FEDERATED CREDENTIAL MANAGEMENT CREDENTIAL REPOSITORIES SMART CARDS VIRTUAL SMART CARDS MYPROXY ONLINE CREDENTIAL REPOSITORY FEDERATED CREDENTIAL MANAGEMENT SYSTEMS VIRTUALIZED CREDENTIAL MANAGER (VCMAN) KX509 LIBERTY ALLIANCE FOR FEDERATED IDENTITY SHIBBOLETH IDENTITY FEDERATION S 10 MANAGING TRUST IN THE GRID DEFINITION OF TRUST REPUTATION AND TRUST CATEGORIES OF TRUST FUNCTIONS TRUST MANAGEMENT SYSTEMS LIFE CYCLE OF TRUST MANAGEMENT SYSTEMS CHARACTERISTICS OF TRUST MANAGEMENT SYSTEMS REPUTATION-BASED TRUST MANAGEMENT SYSTEMS PEERTRUST – A P2P TRUST MANAGEMENT SYSTEM XENOTRUST TRUST MANAGEMENT SYSTEM NICE TRUST MANAGEMENT SYSTEM SECURE GRID OUTSOURCING (SEGO) SYSTEM POLICY-BASED TRUST MANAGEMENT SYSTEMS PEERTRUST TRUST NEGOTIATION TRUSTBUILDER TRUST NEGOTIATION FOR THE GRID COMPARING THE TRUST MANAGEMENT SYSTEMS APPLICABILITY OF THE TRUST MANAGEMENT SYSTEMS 11 GRID MONITORING STAGES OF MONITORING REQUIREMENTS OF DISTRIBUTED MONITORING SYSTEM GRID MONITORING ARCHITECTURE (GMA) DIFFERENT MONITORING TOOLS/FRAMEWORKS SIMPLE NETWORK MANAGEMENT PROTOCOL (SNMP) DIFFERENT SYSTEM MONITORING TOOLS GANGLIA HAWKEYE MONITORING SYSTEM RELATIONAL GMA (RGMA) GLOBUS MONITORING AND DISCOVERY SYSTEM (MDS) MANAGEMENT OF ADAPTIVE GRID INFRASTRUCTURE (MAGI) GLUEDOMAINS DISCUSSIONS ON THE DIFFERENT MONITORING SYSTEMS APPLICABILITY SECURITY IN THE EUROPEAN DATA GRID (EDG) AUTHENTICATION AND DELEGATION JOB EXECUTION AN ENTERPRISE CASE STUDY OVERVIEW OF THE SECURITY ARCHITECTURE 13 CONCLUSION LOOKING AT THE FUTURE IDENTITY BASED ENCRYPTION (IBE) APPLICATION ORIENTED NETWORKING (AON) SUMMARIZING THE SECURITY ISSUES IN GRID IMMEDIATE ISSUES MEDIUM-TERM ISSUES LONG-TERM ISSUES SUMMARIZING THE SECURITY SOLUTIONS IN THE GRID SOLUTIONS TO IMMEDIATE ISSUES SOLUTIONS TO MEDIUM TERM ISSUES SOLUTIONS TO LONG TERM ISSUES 12 PUTTING IT ALL TOGETHER