Vinod Rebello

Who do you Trust? The roles of certificates, certification authorities and the IGTF in Grid Computing Prof. Vinod Rebello Instituto de Computação Universidade Federal Fluminense Brazil [email_address] TAGPMA The Americas Grid Policy Management Authority

A talk about PKI - Why me? ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

The Grid Computing Model Grid/Cloud offering services In this generic model, institutions and businesses own fewer of their own resources. Third parties provide facilities; users get access to services. Businesses themselves can also offer services over the Grid.

What is Grid Security? ,[object Object],[object Object],[object Object],[object Object],[object Object]

Essentials for Grid Security ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Characteristics of Grid Security ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Role of Computer Security ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Security Building Blocks ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Asymmetric Cryptography ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Hello $w!4& F(x) priv Hello $w!4& F(x) pub

Assymetric Key Pairs ,[object Object],The public key is known by everybody. The private key should not be known by anyone else. It may be protected by hardware. priv pub

Authentication Server Client ch =rand(); Same as ch ? Server needs to keep track of Fred’s public key Challenge - Response I’m Fred 1423 AxW8 Hi Fred decrypt(AxW8); pub of Fred encrypt(1423) priv

Creating a Digital Signature ,[object Object],[object Object],Original Document Digest function hash Original Document hash SHA-1 MD5 priv

Verifying a Digital Signature ,[object Object],[object Object],[object Object],Original Document Digest function hash Original Document = ? hash hash pub hash

[object Object],[object Object],Distributing the Public Key ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],-> identity

X.509 Public Key Certificate ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],(Extension data: what type of vehicles the person is authorized to drive)

Signing a certificate ,[object Object],[object Object],[object Object],Digest function hash issuer’s private key ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],priv

Verifying a certificate ,[object Object],[object Object],[object Object],Digest function hash hash = ? issuer’s public key But who should sign the certificate? ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],pub

Certification Authority ,[object Object],User data Public key Trusted Third Party User data Public key CA signature User certificate CA

Certification Process ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Subscriber Registration Authority (RA) Agent 3 4 7 ,[object Object],[object Object],[object Object],2 Sponsor Project DBMS 4 5 6 Certificate Manager (CM) (Certificate Signing Engine) Registration Manager (RM) CA 4 1 2 8 9

Certificates ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Authentication ,[object Object],CA repository Server Client ch =rand(); cert .getPubKey(); decrypt(AxW8); Same as ch ? cert .validate() ? cert .getName(); Hello 1423 Hi Fred encrypt(1423) priv AxW8 pub Fred

Trusting the CA ,[object Object],[object Object],[object Object],[object Object]

Establishing Trust ,[object Object],[object Object],[object Object],[object Object]

Solving the Trust Problem ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

International Grid Trust Fed. ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Building the Federation ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Model for Grid Authentication ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],CA 1 CA 2 CA 3 CA n charter guidelines acceptance process relying party 1 relying party m

The Regional PMAs The Americas Grid PMA Asia Pacific Grid PMA European Grid PMA TAGPMA

EUGridPMA ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

APGridPMA ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

TAGPMA ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

TAGPMA Membership ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],IGTF Accredited CA Operators CA Accreditation in progress Interested in accreditation Relying Party

IGTF Common Policy IGTF Federation Document Common Authentication Profiles Classic (EUGridPMA) SLCS (TAGPMA) trust relations Subject Namespace Assignment Distribution Naming Conventions worldwide relying parties see a uniform IGTF “mesh” ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Policies and Practices ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

TAGPMA CA Accreditation ,[object Object],[object Object],[object Object],[object Object],[object Object]

What Are Grid PKIs For? ,[object Object],[object Object],[object Object],[object Object],[object Object]

Fostering NGIs in LA? ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Acknowledgements ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Vinod Rebello

Recommended

Recommended

More Related Content

What's hot

What's hot (16)

Similar to Vinod Rebello

Similar to Vinod Rebello (20)

Recently uploaded

Recently uploaded (20)

Vinod Rebello