Proxy Certificates Research Articles

Capability-Based Authorization for HEP

Outside the HEP computing ecosystem, it is vanishingly rare to encounter user X509 certificate authentication (and proxy certificates are even more rare). The web never widely adopted the user certificate model, but increasingly sees the need for federated identity services and distributed authorization. For example, Dropbox, Google and Box instead use bearer tokens issued via the OAuth2 protocol to authorize actions on their services. Thus, the HEP ecosystem has the opportunity to reuse recent work in industry that now covers our needs. We present a token-based ecosystem for authorization tailored for use by CMS. We base the tokens on the SciTokens profile for the standardized JSON Web Token (JWT) format. The token embeds a signed description of what capabilities the VO grants the bearer; the site-level service can verify the VO’s signature without contacting a central service. In this paper, we describe the modifications done to enable token-based authorization in various software packages used by CMS, including XRootD, CVMFS, and HTCondor. We describe the token-issuing workflows that would be used to get tokens to running jobs in order to authorize data access and file stageout, and explain the advantages for hosted web services. Finally, we outline what the transition would look like for an experiment like CMS.

Accessing Data Federations with CVMFS

Data federations have become an increasingly common tool for large collaborations such as CMS and Atlas to efficiently distribute large data files. Unfortunately, these typically are implemented with weak namespace semantics and a non-POSIX API. On the other hand, CVMFS has provided a POSIX-compliant read-only interface for use cases with a small working set size (such as software distribution). The metadata required for the CVMFS POSIX interface is distributed through a caching hierarchy, allowing it to scale to the level of about a hundred thousand hosts. In this paper, we will describe our contributions to CVMFS that merges the data scalability of XRootD-based data federations (such as AAA) with metadata scalability and POSIX interface of CVMFS. We modified CVMFS so it can serve unmodified files without copying them to the repository server. CVMFS 2.2.0 is also able to redirect requests for data files to servers outside of the CVMFS content distribution network. Finally, we added the ability to manage authorization and authentication using security credentials such as X509 proxy certificates. We combined these modifications with the OSGs StashCache regional XRootD caching infrastructure to create a cached data distribution network. We will show performance metrics accessing the data federation through CVMFS compared to direct data federation access. Additionally, we will discuss the improved user experience of providing access to a data federation through a POSIX filesystem.

New security infrastructure model for distributed computing systems

At the paper we propose a new approach to setting up a user-friendly and yet secure authentication and authorization procedure in a distributed computing system. The security concept of the most heterogeneous distributed computing systems is based on the public key infrastructure along with proxy certificates which are used for rights delegation. In practice a contradiction between the limited lifetime of the proxy certificates and the unpredictable time of the request processing is a big issue for the end users of the system. We propose to use unlimited in time hashes which are individual for each request instead of proxy certificate. Our approach allows to avoid using of the proxy certificates. Thus the security infrastructure of distributed computing system becomes easier for development, support and use.

Special Aspects of the Development of the Security Infrastructure for Distributed Computing Systems

Abstract The paper describes some special aspects of the security infrastructure for distributed com- puting systems. Most heterogeneous and geographically dispersed distributed computing systems, e.g. GRID, use the Public Key Infrastructure (PKI). One of the main problem in such systems is the necessity to use time-limited proxy certificates for delegation of rights from user to an execution remote service which acts on behalf of the user. The problem is that there exists a contradiction between the limited lifetime of the proxy certificates and unpredictable time of the request processing. Our approach allows to avoid using the proxy certificates. This makes the security infrastructure of distributed computing systems simpler for development, support and use. In particular, the proxy renewal service becomes unnecessary at all.

The insecurity of two proxy signcryption schemes: proxy credential forgery attack and how to prevent it

Securing different online e-business activities usually requires applying different cryptographic algorithms. The proxy signcryption algorithms are designed for applications such as online proxy auction or online proxy signatures on business contracts, which require a proxy agent to sign on confidential messages. This paper proposes a proxy credential forgery attack to two recent proxy signcryption schemes in the literature. Using the attack, a malicious proxy signer can create a fake proxy credential from his original credential to extend his signing power. Simple modifications to these two schemes are also provided in this paper to prevent the attack without adding too much computational complexity. In addition to the contribution of introducing a new type of attacks to signcryption schemes, the paper also points out that, while designing a secure proxy signcryption scheme, not only the unforgeability of proxy signatures is important, but also that of proxy credentials as well.

Modelling Access Propagation in Dynamic Systems

Access control is a critical feature of many systems, including networks of services, processes within a computer, and objects within a running process. The security consequences of a particular architecture or access control policy are often difficult to determine, especially where some components are not under our control, where components are created dynamically, or where access policies are updated dynamically. The SERSCIS Access Modeller (SAM) takes a model of a system and explores how access can propagate through it. It can both prove defined safety properties and discover unwanted properties. By defining expected behaviours, recording the results as a baseline, and then introducing untrusted actors, SAM can discover a wide variety of design flaws. SAM is designed to handle dynamic systems (i.e., at runtime, new objects are created and access policies modified) and systems where some objects are not trusted. It extends previous approaches such as Scollar and Authodox to provide a programmer-friendly syntax for specifying behaviour, and allows modelling of services with mutually suspicious clients. Taking the Confused Deputy example from Authodox we show that SAM detects the attack automatically; using a web-based backup service, we show how to model RBAC systems, detecting a missing validation check; and using a proxy certificate system, we show how to extend it to model new access mechanisms. On discovering that a library fails to follow an RFC precisely, we re-evaluate our existing models under the new assumption and discover that the proxy certificate design is not safe with this library.

Mediated definite delegation - Certified Grid jobs in ALICE and beyond

Grid computing infrastructures need to provide traceability and accounting of their users’ activity and protection against misuse and privilege escalation, where the delegation of privileges in the course of a job submission is a key concern. This work describes an improved handling of Multi-user Grid Jobs in the ALICE Grid Services.A security analysis of the ALICE Grid job model is presented with derived security objectives, followed by a discussion of existing approaches of unrestricted delegation based on X.509 proxy certificates and the Grid middleware gLExec. Unrestricted delegation has severe security consequences and limitations, most importantly allowing for identity theft and forgery of jobs and data. These limitations are discussed and formulated, both in general and with respect to an adoption in line with Multi-user Grid Jobs. A new general model of mediated definite delegation is developed, allowing a broker to dynamically process and assign Grid jobs to agents while providing strong accountability and long-term traceability. A prototype implementation allowing for fully certified Grid jobs is presented as well as a potential interaction with gLExec. The achieved improvements regarding system security, malicious job exploitation, identity protection, and accountability are emphasized, including a discussion of non-repudiation in the face of malicious Grid jobs.

Enhancing the AliEn Web Service Authentication

Web Services are an XML based technology that allow applications to communicate with each other across disparate systems. Web Services are becoming the de facto standard that enable inter operability between heterogeneous processes and systems. AliEn2 is a grid environment based on web services. The AliEn2 services can be divided in three categories: Central services, deployed once per organization; Site services, deployed on each of the participating centers; Job Agents running on the worker nodes automatically. A security model to protect these services is essential for the whole system.Current implementations of web server, such as Apache, are not suitable to be used within the grid environment. Apache with the mod_ssl and OpenSSL only supports the X.509 certificates. But in the grid environment, the common credential is the proxy certificate for the purpose of providing restricted proxy and delegation. An Authentication framework was taken for AliEn2 web services to add the ability to accept X.509 certificates and proxy certificates from client-side to Apache Web Server. The authentication framework could also allow the generation of access control policies to limit access to the AliEn2 web services.

Solving identity delegation problem in the e-government environment

At present, many countries allow citizens or entities to interact with the government outside the telematic environment through a legal representative who is granted powers of representation. However, if the interaction takes place through the Internet, only primitive mechanisms of representation are available, and these are mainly based on non-dynamic offline processes that do not enable quick and easy identity delegation. This paper proposes a system of dynamic delegation of identity between two generic entities that can solve the problem of delegated access to the telematic services provided by public authorities. The solution herein is based on the generation of a delegation token created from a proxy certificate that allows the delegating entity to delegate identity to another on the basis of a subset of its attributes as delegator, while also establishing in the delegation token itself restrictions on the services accessible to the delegated entity and the validity period of delegation. Further, the paper presents the mechanisms needed to either revoke a delegation token or to check whether a delegation token has been revoked. Implications for theory and practice and suggestions for future research are discussed.

Adaptation of agent-based non-repudiation protocol to mobile digital right management (DRM)

Non-repudiation of a mobile digital rights management (DRM) ensures that when a user ( U) sends some message to a rights issuer (RI), neither U nor RI can deny having participated in this transaction. An evidence of a transaction is generated by wireless PKI mechanism such that U and RI cannot repudiate sending and receiving the message respectively. U generates a mobile agent which carries encrypted payment information to RI. This mobile agent is also issued a proxy certificate by U; this certificate guarantees the binding relationship between them. One trusted third party acts as a lightweight notary for evidence generation. One advantage of this agent-based non-repudiation protocol is to reduce inconvenience for mobile clients such as connection time; it causes difficulty for fair transaction for mobile DRM.

A robust and flexible digital rights management system for home networks

A robust and flexible Digital Rights Management system for home networks is presented. In the proposed system, the central authority delegates its authorization right to the local manager in a home network by issuing a proxy certificate, and the local manager flexibly controls the access rights of home devices on digital contents with its proxy certificate. Furthermore, the proposed system provides a temporary accessing facility for external devices and achieves strong privacy for home devices. For the validation of delegated rights and the revocation of compromised local managers, a hybrid mechanism combining OCSP validation and periodic renewal of proxy certificates is also presented.

Retelab: A geospatial grid web laboratory for the oceanographic research community

Retelab is a virtual laboratory for the Oceanographic research community. It is supported by a Grid infrastructure and its main objective is to provide an easy and useful tool for oceanographers, where computer skills are not an obstacle. To achieve these goals, Retelab includes improved versions of portal and Grid technologies related to security, data access, and job management. A solution based on a Role Access Management Model has been built for user access and registration, looking for a balance between simplicity and robustness. The sharing and discovery of scientific data is accomplished using a virtual database focused on metadata and designed specifically to store geospatial information. Finally, a comfortable and transparent procedure to submit and to monitor jobs has been developed. It is based on the integration and adaptation of the GridWay metascheduler to the multiuser portal environment in such a way that a single UNIX account can use several proxy certificates. The Virtual Laboratory has been tested by the implementation and deployment of several oceanographic applications.

Towards cross-middleware authentication and single sign-on for ARC Grid middleware

When pursuing the task of making access to Grids as simple as possible, security is one of the most important challenges in production Grid infrastructures, especially when the Grid applications span multiple administrative domains as well as heterogeneous Grid middlewares. A typical example is wide scale e-Science applications which need to coordinate resources shared among a number of independent institutions with different Grid middlewares deployed on these resources. In this paper, we describe security implementation and considerations used in the upcoming version of the Advanced Resource Connector (ARC) middleware, where the heterogeneity issue has been addressed. The main goal of ARC implementation in terms of security is to let the middleware be capable of interoperating with other Grid middlewares by leveraging on standard specifications. The key aspect of the work is to enhance the current proxy certificate based authentication and single sign-on by utilizing and enhancing the standardized Web Service specifications such as Security Assertion Markup Languages (SAML), single sign-on (SSO) profile and Web Services Security in order to achieve cross-middleware authentication and single sign-on.

A Kerberos security architecture for web services based instrumentation grids

Instrumentation Grids aim at controlling and managing heterogeneous resources & instruments securely, reliably and in near real-time. Within this context, we present a Web Services based Security Architecture that aims at improving security performance maintaining at the same time interoperability with legacy Grid Security Infrastructure (GSI). Our architecture utilizes GSI X.509 Certificates or Proxy Certificates (RFC3820) for the initial authentication of a user. However, it subsequently maps this identity to a Kerberos one and utilizes WS Security Kerberos Token Profile for embedding user credentials within WS exchange mechanisms. It then provides user authorization, thus realizing a complete AAI (Authentication & Authorization Infrastructure). In order to demonstrate and quantify the performance improvement achieved by our approach over a message exchange using X.509 Certificate Token Profile, we present comparative measurements on implementations of the two options. Our results demonstrate that the Kerberos message exchange schema exhibits up to 50% message throughput improvement, under high CPU load on the server.

Secure on-demand grid computing

In this paper, a novel approach for enabling Grid users to autonomously install and use custom software on demand using an image creation station is presented, while at the same time offering new security mechanisms to protect both software and data from other Grid users and external attackers. An automated dynamic firewalling mechanism enables both virtual organization and user-based network security setups. Furthermore, the Grid environment is partitioned into several zones to protect local cluster resources from compromised Grid middleware. To enable the secure integration of this Grid environment into existing business processes, an extension of BPEL is presented which allows the execution of GSI secured Grid services in combination with existing business web services. The workflow engine transparently handles proxy certificate creation and monitors proxy certificate lifetime. An implementation based on the Globus Toolkit 4, the Sun Grid Engine and the ActiveBPEL Engine is presented. A performance evaluation of the critical components of the new Grid setup is provided.

An efficient delegation protocol with delegation traceability in the X.509 proxy certificate environment for computational grids

The X.509 proxy certificate is widely used to delegate an entity’s right to another entity in the computational grid environment. However, this proxy certificate has two drawbacks: the potential security threat caused by non-traceability of a delegation chain and the inefficiency caused by an interactive communication between the right grantor and the right grantee on the delegation protocol. To address these problems, a new delegation protocol is presented. The proposed protocol employs an ID-based key generation technique to support delegation traceability and non-interactive delegation. Since access-right delegation occurs frequently in the computational grid environment, the proposed protocol can enhance security by providing delegation traceability and can enhance efficiency by reducing the inter-domain communication cost.

Adaptation of proxy certificates to non-repudiation protocol of agent-based mobile payment systems

Non-repudiation of a mobile payment transaction ensures that when a buyer (B) sends some messages to a seller (S), neither B nor S can deny having participated in this transaction. An evidence of a transaction is generated by wireless PKI mechanism such that B and S cannot repudiate sending and receiving the purchase order respectively. The buyer generates a mobile agent which carries encrypted purchase order to the seller. This mobile agent is also issued a proxy certificate by the buyer; this certificate guarantees the binding relationship between them. One trusted third party acts as a lightweight notary for evidence generation. One advantage of this agent-based non-repudiation protocol is to reduce inconvenience for mobile clients such as connection time; it causes difficulty for fair transaction for mobile payments.

Using OGRO and CertiVeR to improve OCSP validation for Grids

Authentication and authorization in many distributed systems rely on the use of cryptographic credentials that in most of the cases have a defined lifetime. This feature mandates the use of mechanisms able to determine whether a particular credential can be trusted at a given moment. This process is commonly named validation. Among available validation mechanisms, the Online Certificate Status Protocol (OCSP) stands out due to its ability to carry near real time certificate status information. Despite its importance for security, OCSP faces considerable challenges in the computational Grid (i.e. Proxy Certificate's validation) that are being studied at the Global Grid Forum's CA Operations Work Group (CAOPS-WG). As members of this group, we have implemented an OCSP validation infrastructure for the Globus Toolkit 4, composed of the CertiVeR Validation Service and our Open GRid Ocsp (OGRO) client library, which introduced the Grid Validation Policy. This paper summarizes our experiences on that work and the results obtained up to now. Furthermore we introduce the prevalidation concept, a mechanism analogous to the Authorization Push-Model, capable of improving OCSP validation performance in Grids. This paper also reports the results obtained with OGRO's prevalidation rules for Grid Services as a proof of concept.

Proxy Certificate Trust List for Grid Computing

This paper proposes Proxy Certificate Trust List (PCTL) to efficiently record trusted delegation trace for grid computing. Our solution based on PCTL provides functions as follows: (1) On-demand inquiry service for real time delegation information of grid computing underway; (2) Lightweight mutual authentication that is beneficial for proxy nodes with short life span or limited computation power as wireless devices in mobile computing; (3) A kind of revocation mechanism for proxy certificates to improve the security and availability of grid computing.

A lightweight mutual authentification based on proxy certificate trust list

A lightweight mutual authentification based on proxy certificate trust list