grid computing, b. wilkinson, 20045a.1 security continued

Grid Computing, B. Wilkinson, 2004 5a.1

SecurityContinued


Public Key CryptographyDouble Encryption

Hello. This is my message that must be kept secret

Hello. This is my message that must be kept secret

12ga;jey ck027jc;L;sajckjyfrasbiiop[pa2354mghdas

Receiver’s public key

Receiver’s private

Key

Original data

Transmitted data

Original data

Sender Receiver

Sender’s public key

Sender’s private

Key

Slow but secure.


QuestionWhy is single encryption with receiver’s public key/single decryption with receiver’s private key (slide 5-19) not sufficient?

Answer


Public Key and Secret Key Cryptography

• Public Key and Secret Key Cryptography generally used together.

• Public key Cryptography with Certificates and a Certificate Authority (CA) used to establish a secure authenticated connection between parties. Then:– Secret key passed between parties.– Secret key cryptography used to encrypt data,

which is much faster than public key cryptography.


Use of Public Key Infrastructure(PKI)

• Several network protocols have embedded public key and/or secret key cryptographic algorithms.

• Most notable is SSL (described in slides5), which can be added on top of protocols such as http (i.e. https), FTP (sftp), and telnet.


Others include:

• For secure email - S/MIME (Secure Multipurpose Internet Mail Extensions) developed by RSA Data Security Inc, see:

http://www.rsa.com/smime

• For secure e-commerce - SET (Secure Electronic Transaction), developed jointly by Visa, Mastercard, IBM , and other companies, for secure credit card transactions over the Internet, see:

http://www.setco.org


Certificate Authorities• Commercial Certificate Authorities exist,

such as:– VeriSign Inc.– Entrust Technologies Inc.,

• Web browsers have built-in recognition such trusted CAs, allowing SSL and other secure connections.


General Public Key Infrastructure

From: “Deploying a Public Key Infrastructure,” IBM Redbook, SG24-5512-00.


Certificate Repository

• Used to store:– Issued certificates– Revoked certificates (CRLs - Certificate

Revocation List)– Might be accessed through LDAP

(Lightweight Directory Access Protocol)


Registration Authority

• Acts for CA for some management functions (see IBM Redbooks).

• Not strictly necessary as CA could do all functions.


CA’s own certificateCA needs it own certificate identify itself• First it generates key pair.• It protect its private key. (This is vitally important!)• It then creates a

certificate and signs

it with its private key:

CA’s public key

Certificate

CA’s digital signature

CA’s X-500 name


Requesting a certificate from a CA

• Usually the requesting client generates a public/private key pair and then submits an unsigned certificate to the CA.

• The certificate returned signed by the CA contains the public key.


QuestionWhy usually does the CA not generate the public/private key pair for the requester?

AnswerBecause it would require the private key to be sent to the requester.If the requester generates the private key, it is more secure as it does not leave requester.


Using a signed certificate to send a secure message

• One can attached it to your message.

• Alternatively, the message is sent without a certificate and the receiver has to retrieve the certificate from a public place.

Either way, the receiver checks the signature. It has to be CA it can trust.


CertificateLifetime

• Certificates have a limited lifetime for security purposes, i. e. certificates are issued with an expiration date.

• Have a renewal process but user will normally have same public/private key pair.


Certificate Authorityfor Grid Computing

• Usually a certificate authority is created for the specific grid computing environment.

• Globus has “simple” implementation called simpleCA.


Grid Users

• After Certificate Authority established for the grid, users have to register with grid CA.

• This was done for each account provided at WCU, so users did not have to do anything.

• In general, users joining a grid from geographically dispersed locations must communicate with the CA system administrator to verify their identity and to get a certificate.

• Communication often done by email.


Grid Security Infrastructure

From: “Introduction to Grid Computing with Globus,” IBM Redbooks,SG24-6895-012003, Fig. 3-3.

Globus Interaction with Certificate Authority

This step done by email or a more a secure way.


Grid Computers

• Computers added to a grid (donors) preferably need their identity verified in a similar fashion.

• Computers registered with certificate authority - only those machines will be allowed to participate in the grid activities.

• Computers might be used under a certain access rights.


GSI Authentication/Authorization FunctionsCommunicating from Host A to Host B

• From host A to host B:– Host A send its certificate to Host B– Host B gets Host A’s public key and name using

CA’s public key.– Host B creates a random number and sends it

to Host A.– Host A encrypts random number with its private

key and sends it to host B.– Host B decrypts number and checks number. If

correct, Host B authenticates host A’s certificate.


From: “Introduction to Grid Computing with Globus,” IBM Redbooks,SG24-6895-012003, Fig. 3-4.


Proxies

• Proxy needed to delegate authority to another host, say host C through host B, where the proxy will act on your behalf.

• Rather a large number of steps.


From: “Introduction to Grid Computing with Globus,”

IBM Redbooks,SG24-6895-012003, Fig. 3-5.


• Proxies used to authenticate users and run user programs on grid.

• Proxy created with grid-proxy-int command.

• We shall see a use of this in assignment 3.

Next task is assignment 2.

grid computing, b. wilkinson, 20045a.1 security continued

Documents

grid computing

receivers private key

publicprivate key pair

answer slide

certificate authority

unsigned certificate

certificate repository

security continued slide