Upload File

security

19
Security Daniel Mallmann [email protected] MWSG meeting Amsterdam 14-15 December 2005

Upload: heinz

Post on 06-Jan-2016

40 views

Category:

Documents


0 download

Report

DESCRIPTION

Security. Daniel Mallmann [email protected] MWSG meeting Amsterdam 14-15 December 2005. Architecture Overview. Client. Internet. Client. Gateway. Gateway. Usite A. Usite B. Vsite A1. Vsite B1. Vsite B2. Network Job Supervisor. Network Job Supervisor. Network Job Supervisor. - PowerPoint PPT Presentation

TRANSCRIPT

Page 1: Security

Security

Daniel Mallmann [email protected]

MWSG meeting Amsterdam 14-15 December 2005

Page 2: Security

2

Usite B

Vsite B2Vsite B1

Usite A

Vsite A1

Architecture Overview

Gateway

InternetInternet

Gateway

TargetSystem

Interface

NetworkJob

Supervisor

TargetSystem

Interface

TargetSystem

Interface

NetworkJob

Supervisor

NetworkJob

Supervisor

Client

Client

Page 3: Security

3

Client

Java application User authentication via X.509 certificates Global or local list of Unicore sites (Usites) Connects to Gateway via SSL and

Unicore Protocol Layer (UPL) Job preparation

♦ Workflow management

♦ File management

♦ Abstract Job Object (AJO) generation

♦ Job signing

Job monitoring Job control

JobPreparation

JobMonitor

WorkflowManagement

Usites

Vsites

Page 4: Security

4

Client

InternetInternet

Gateway

Unicore Site list

Unicore Site list

SSL

Client

Client

Page 5: Security

5

Usite B

Vsite B2Vsite B1

Usite A

Vsite A1

Gateway

Gateway

InternetInternet

Gateway

TargetSystem

Interface

NetworkJob

Supervisor

TargetSystem

Interface

TargetSystem

Interface

NetworkJob

Supervisor

NetworkJob

Supervisor

Client

Gateway

Page 6: Security

6

Gateway

Authentication:♦ Connection only with valid certificates from accepted

Certification Authorities♦ Forwards client certificate to NJS for authorisation

Single point of entry for all Unicore services of the Usite♦ Only one open port

List of Vsites Connects to Vsites via UPL (SSL optional)

Page 7: Security

7

Gateway

InternetInternetClient

Gateway

SSL

VSite list

Vsite 2

NetworkJob

Supervisor

Vsite 1

NetworkJob

Supervisor

Vsite 3

NetworkJob

Supervisor

Firewall

Page 8: Security

8

Network Job Supervisor

Usite B

Vsite B2Vsite B1

Usite A

Vsite A1

Gateway

InternetInternet

Gateway

TargetSystem

Interface

NetworkJob

Supervisor

TargetSystem

Interface

TargetSystem

Interface

NetworkJob

Supervisor

NetworkJob

Supervisor

Client

NetworkJob

Supervisor

Page 9: Security

9

Network Job Supervisor

Checks integrity of jobs Authorises the user by Unicore User Data Base (UUDB)

♦ Mapping of Unicore user certificate to target system Xlogin

Forwards sub jobs to remote Vsites Translates abstract job into target system specific tasks

based on Incarnation Data Base (IDB) Transfers files to work directory on the target system via

socket connection Submits jobs to Target System Interface (TSI) via

socket connection

Page 10: Security

10

Network Job Supervisor

TargetSystem

Interface

NetworkJob

Supervisor

Gateway

IncarnationData Base

Unicore User

Data Base

NetworkJob

Supervisor

Gateway

InternetInternet

Page 11: Security

11

Usite B

Vsite B2Vsite B1

Usite A

Vsite A1

Target System Interface

Gateway

InternetInternet

Gateway

TargetSystem

Interface

NetworkJob

Supervisor

TargetSystem

Interface

TargetSystem

Interface

NetworkJob

Supervisor

NetworkJob

Supervisor

Client

TargetSystem

Interface

Page 12: Security

12

Target System Interface

Interfaces between Unicore and the Grid resource Executes the specific tasks, translated by the NJS, or

submits them to the batch sub system Stores and sends files from/to the Unicore Client or

local directories Contains batch sub system, operating system and

installation specific code Runs as root

Page 13: Security

13

TargetSystem

Interface

Target System Interface

NetworkJob

Supervisor

ShepardWorker Worker

BatchSub System

FileSystem

ApplicationOperating

System

Page 14: Security

14

Usite B

Vsite B2Vsite B1

Usite A

Vsite A1

Multiside Job

Gateway

InternetInternet

TargetSystem

Interface

NetworkJob

Supervisor

TargetSystem

Interface

TargetSystem

Interface

NetworkJob

Supervisor

NetworkJob

Supervisor

Client

Gateway

Page 15: Security

15

Secondary Network Job Supervisor

Primary Network Job Supervisor

SSLSSL

Client

Multiside Job

= User certificate = NJS certificate

Job

SubJob

Consigner♦ The entity (user client or NJS) that consigns a job or sub-job♦ Expressed by use in SSL connection

Endorser♦ The entity (user) that authorises the tasks to be performed♦ Expressed by signing of serialized AJO direct acyclic graph

Page 16: Security

16

Usite B

Vsite B2Vsite B1

Usite A

Vsite A1

Explicit Trust Delegation

Gateway

InternetInternet

TargetSystem

Interface

NetworkJob

Supervisor

TargetSystem

Interface

TargetSystem

Interface

NetworkJob

Supervisor

NetworkJob

Supervisor

Client

Gateway

Portal

Page 17: Security

17

SSL

Network Job Supervisor

SSL

PortalWS- Client(Browser)

Explicit Trust Delegation

Job

User: name

= User certificate = Portal certificate

User♦ New role besides consignor and endorser♦ Entity (user) on whose behalf tasks will be performed

Trusted Agents (Portal)♦ Added to the UUDB explicitly♦ Allowed to endorse AJO on behalf of users

Page 18: Security

18

UniGrids project

All components are being moved to stateful Web Services

♦ Based on the Open Grid Services Architecture (OGSA)♦ Compliant with the Web Services Resource Framework

Gateway handles multiple protocols

Web Service implementation of the UUDB

Page 19: Security

19

References

Unicore♦ Software: http://unicore.sourceforge.net♦ Whitepaper: http://www.unicore.org/ ...... documents/UNICOREPlus-Final-Report.pdf

Unicore Security♦ GGF Document GFD.18

“An Analysis of the UNICORE Security Model”http://www.gridforum.org/documents/GFD.18.pdf

UniGrids♦ http://www.unigrids.org

Explicit Trust Delegation♦ Fujitsu Scientific & Technical Journal, Special Issue: Grid Computing,

2004-12 (Vol.40, No.2) “Explicit Trust Delegation: Security for Dynamic Grids”http://www.fujitsu.com/downloads/MAG/vol40-2/paper12.pdf


Remote Filtering - Web Security, Email Security, Data Security

Deployment Guide - Web Security, Email Security, Data Security

SECURITY INFRASTRUCTURE SECURITY

Agrochemicals and Security: Homeland Security and FertilizersFert-01 Homeland Security and Fertilizers Agrochemicals and Security Homeland Security and

Security II – Grid Computing Security and Globus Security

Getting Started - Web Security, Email Security, Data Security

Security Presented by : Qing Ma. Introduction Security overview security threats password security, encryption and network security as specific

ITS Security Office...Student Tech Security Training ITS Security Office ITS Security Office • “Total Security is an illusion – security will always be slightly broken.” •

Chapter 13-802.11 Network Security Architecture 802.11 Security Basics Legacy 802.11 security Robust Security Segmentation Infrastructure Security VPN

Cyber Security Specialist Information Security • Cyber ... · Cyber Security • Security Analyst • Cyber Security Specialist Information Security • Cyber Operations Manager

Evolución Fortinet Security Fabric · Network Security Network Security Cloud & Apps Security Multi-Cloud Security Open API Fabric Connectors Infrastructure Security Endpoint Protection

NETWORK SECURITY I ENDPOINT SECURITY I DATA SECURITY · NETWORK SECURITY I ENDPOINT SECURITY I DATA SECURITY MID-SIZE ORGANIZATIONS BUSINESS CONTINUITY IN COMPLEX ARCHITECTURES

Network Security Application Security Security Management

Buy the security standards you need shop.bsigroup.com/security Standards Brochure.pdf · Security standards shop.bsigroup.com/security BSI’s Security standards Welcome to our security

The Mobile Security (mSecurity) Bible: 2014 - 2020 - Device Security, Infrastructure Security & Security Services

Security #MiSSConceptsmiss.in.th/MiSSConf(SP2)/slides/Security-MiSSConcept.pdfSenior Security Engineer (AGODA) Penetration Tester Security Consultant. Security #MiSSConcepts. Security

For Security Professionals 1 INFORMATION SYSTEM SECURITY SECURITY

Mobile Security Apps - AV-TEST · PDF fileTesting mobile security Apps ... ESET MobileSecurity Norton Mobile Security QuickHeal Mobile Security Super Security Trend Micro Mobile Security

CYBER SECURITY ADVISORY & CONSULTING …...TELECOM SECURITY – Wireless Security – Signaling Security - SCTP and SS7 – 3G Mobile Network Security – LTE Security Architecture

HKC Security Installer - HKC Security - HKC Security

maritime security regulations - UNOLS · Maritime Security Regulations ... ship security – List primary ... Security Plan Port Security Plan Area Maritime Security Transportation

Security Shutters, Retractable Security Gates, …syston.com/...9267_Security_Shutters_Retractable_Security_Gates.pdf · Security Shutters, Retractable Security Gates, SeceuroBar

PHYSICAL SECURITY & ENVIRONMENTAL SECURITY · Physical Security & Environmental Security Policy and Procedures Title [company name] Physical Security & Environmental Security Policy

Wireless and Mobile Security Lesson Introduction ●WiFi security ●iOS security ●Android security

Food Security EconomicsFood Security Food Security in India

+ Security Concerns Chapter 10.1. + Security types Physical security Access security Database security

Security Admin security

Security Target IBM Internet Security Systems GX6116 Security

ANNUAL CONTRACT DETAILS - Banham Security · The following contract details are applicable to: Banham Security, Security 201, Bridger Security, Close Link Security, Tara Security

National Cyber Security Centre (NCSC) Cloud Security ... · Cloud Security Principle 4: Governance 23 Cloud Security Principle 5: Operational Security 25 Cloud Security Principle

Network Security - Norbert Pohlmann · Security Infrastructure Mobile/Desktop Security Network Security E-Commerce Enabler Internet Security Network Security Secure Communication

Web Services Security: SOAP Message Security 1.1 (WS-Security … · 176 Services Security: SOAP Message Security” or “WSS: SOAP Message Security”. 177 178 This specification

Tax Security 2.0 – A “Taxes-Security-Together” Checklistblogs.shu.edu/...Taxes-Security-Together_Checklist.pdf · The “Taxes-Security-Together Checklist • Security Summit

THEME Name Surname, Company Twitter handle (17).pdf · Cyber Security Information Security IT Security Physical Security IoT Security OT Security Smart Grid Security Network Perimeter

Physical & Personnel Security Physical Security Personnel Security