Middleware Security Group Meeting

Name: Middleware Security Group Meeting
Start: 2007-12-06T09:00:00+01:00
End: 2007-12-07T16:00:00+01:00
Location: Berkeley

6 Dec 2007, 09:00 → 7 Dec 2007, 16:00 Europe/Zurich

Berkeley

Description

Logistics http://www.es.net/hypertext/MWSG/logistics.html Registration http://www.es.net/hypertext/MWSG/registration.html Agenda (Soon)

Thursday 6 December
- Thu 6 Dec
- Fri 7 Dec
- 09:00 → 12:35
  Session 1: General security topics
  - 09:00
    
    Welcome, discussion of Agenda 15m
    
    Speaker: Chairs (Bob C., C.Witzig)
  - 09:15
    
    Security Incidents and Countermeasures (was LCAS/LCMAPS concern) 15m
    
    Speaker: Oscar Koeroo
    
    Slides
  - 09:30
    
    How to leverage an existing SSH-PKI for our ssl-based grid security middleware 15m
    
    Speaker: Frank Siebenlist
    
    Slides
  - 09:45
    
    Proxy restriction 30m
    
    Speaker: Joni Hahkala
    
    Slides
  - 10:15
    
    break 30m
  - 10:45
    
    Pseudonymity Service - First Prototype Implementation 30m
    
    Speaker: Henri Mikkonen
    
    Slides
  - 11:15
    
    End-to-end security 30m
    
    Goal of the presentation: We want to draw attention to the problems the current trust model poses; i.e. the fact that all the middleware needs to be trusted. We will present our current view on how this could be changed, so that only the end points, i.e. the user and the execution machine, need to be trusted. We will have a proposal for a prototype implementation, and we would like to have a discussion with the other middleware developers.
    
    Speakers: Ian Aldermann, Igor Sfilioi
    
    Slides
  - 11:45
    
    Email break 30m
- 12:15 → 13:30
  
  lunch break
- 13:30 → 17:30
  Session 2: Authorization
  Goals of the Authorization sessions:
  1. For end-to-end study:
    a) Presentation of ideas based on end-to-end authorization study for EGEE-III
    b) Input of OSG to these ideas
    c) Identification of possible problems
  2. For authZ interoperability:
    a) reviewing all fundamental areas of the work (even the ones settled and not discussed in several months) and reassuring ourselves that we are still on the same page everywhere
    b) discuss the scope and release schedule for the development work in OpenSAML 2. The goal is gathering enough information to update our plans. After the MWSG, we will need to carefully evaluate if these changes of scope and schedule make the joint project still cost effective.
    c) discuss communication channels w/ new development team and its management; discuss expectations for participation, response time, quality, etc.
    d) agree on the draft profile to be distributed by Chad on Nov 30 (note: this will be done in a smaller group in a parallel session on Thu morning and Fri afternoon)
  - 13:30
    
    Authorization end-to-end study 1h 30m
    
    Speaker: Christoph Witzig
    
    Slides
  - 15:00
    
    break 30m
  - 15:30
    
    AuthZ Interop: Requirements, Plans and Milestones 20m
    
    Speaker: Gabriele Garzogolio
    
    Slides
  - 15:50
    
    AuthZ Interop: A common XACML Profile and its current implementation 20m
    
    Speaker: Oscar Koeroo
    
    Slides
  - 16:10
    
    AuthZ Interop: G-PBox and gJAF experience with the GT XACML library(Java version) 20m
    
    Speaker: Hakon Sagehaug
    
    Slides
  - 16:30
    
    AuthZ Interop: GT XACML library implementation and future plans 20m
    
    Speaker: Rachana Ananthakrishnan
    
    Slides
  - 16:50
    
    AuthZ Interop: Discussion 40m
    
    Speaker: all
Friday 7 December
- Thu 6 Dec
- Fri 7 Dec
- 09:00 → 13:15
  Session 3: Authorization continued
  - 09:00
    
    GP-Box: current role and future development 30m
    
    Speaker: Alberto Forti
    
    Slides
  - 09:30
    
    Discussion on authorization service 45m
    
    Speaker: all
    
    pictures
  - 10:15
    
    break 30m
  - 10:45
    
    COmanage and GridGrouper 1h
    
    Speaker: Tom Barton
    
    Slides
  - 11:45
    
    How virtual machine technology could make our client and server deployments more secure and resilient 30m
    
    Speaker: Frank Siebenlist
    
    Slides
- 12:15 → 13:30
  
  lunch break
- 13:30 → 16:00
  Session 4: General security topics
  - 13:30
    
    CO-Manage and GridGrouper (cont) 30m
    
    Speaker: Tom Barton
  - 14:00
    
    VOMS migration to openSSL 15m
    
    Speaker: Andrea Ceccanti
    
    Slides
  - 14:15
    
    Security of VO schedulers 15m
    
    Large VOs are deploying their own schedulers which interact directly with Worker Nodes. This raises the question whether these schedulers should be considered as part of the core middleware. The goal of this presentation is to find out whether the MWSG should investigate the security implications of VO specific schedulers. If so, how should the group proceed? There was a long discussion of how to control connections between the worker nodes and the Internet. Christoph asked for reactions to some standardization of a sort of proxy facility that schedulers would go through to fetch jobs. Oscar dug up his slides from 2004 were he had proposed a facility for controlling connections to the Internet. Those slides are attached.
    
    Speaker: Christoph Witzig
    
    Slides
  - 14:30
    
    Proxy lifetime restrictions 30m
    
    Speaker: Mine Altunay
  - 15:00
    Update on Security Token Service (STS) 15m
    
    Speaker: Chad La Joie
    
    Slides
    
    sts-update.pdf
    
    sts-update.ppt
    
    sts-update.ppt
  - 15:15
    
    Discussion, AOB 15m