Managing Protected and Controlled Data with Globus. Vas Vasiliadis

Transcription

1 Managing Protected and Controlled Data with Globus Vas Vasiliadis

2 Globus SaaS: Research data lifecycle Instrument 1 Researcher initiates transfer request; or requested automatically by script, science gateway Globus transfers files reliably, securely Use a Web browser Access any storage 2 Transfer Use an existing identity 3 Researcher selects files to share, selects user or group, and sets access permissions Compute Facility Share Collaborator logs in to Globus and accesses shared files; no local account required; download via Globus 5 4 Globus controls access to shared files on existing storage; no need to move files to cloud storage! 6 Researcher assembles data set; describes it using metadata (Dublin core and domainspecific) Publish 6 7 Curator reviews and approves; data set published on campus or other system Peers, collaborators search and discover datasets; transfer and share using Globus Publication Repository 8 Personal Computer Discover

3 Globus for high assurance data management Restricted data handling: PHI, PII, CUI Security controls: NIST , Low Business Associate Agreement (BAA) w/uchicago University of Chicago has a BAA with Amazon

4 Compliance focus areas Access Control: Least privilege model Configuration Management: Change control, impact/risk Maintenance: Automation, vulnerability mitigation Accountability: Detailed audit trail (protection, forensics) Information integrity: Protection, monitoring

5 Restricted data disclosed to Globus Globus does not see file contents and never did! File paths/name can have restricted data, e.g. PHI No other elements (endpoint definitions, labels, collection definitions) can contain restricted data

6 Initial release scope Globus Service: Auth, Transfer, Groups, DNS, Sharing New web app (app.globus.org) try it now! Globus Connect Server v5.2 Globus Connect Personal v3.x Globus Command Line Interface (CLI)

7 Other features/services/products Connectors: AWS S3 as priority (future release) Platform: Globus Search (future release) Out of scope: Globus ID, data publication SaaS, current web app, GCS v4.x, GCSv5.0, 5.1, GCP2.x Discontinued: Hosted CLI (as of August 1, 2018)

8 Out with the old, in with the new Host endpoints Mapped collections Need local account to access data Shared endpoints Guest collections No local account needed for data access, permissions set in Globus Use host endpoint to create shared endpoint Use storage gateway to create guest collections Access via GridFTP Access via GridFTP or HTTPS Initially available via Globus Connect Server v5.2

9

10

11

12

13

14

15 Conceptual architecture: Mapped collections User identity mapped to local account DATA Channel No data relay or staging via Globus; files move directly between endpoints Globus Endpoint Subscriber Security Domain CONTROL Channel Globus client software Subscriber owned and administered storage system Single, globally accessible multi-tenant service Globus Security Domain External Security Domain (User, web app, data portal, science gateway, )

16 Conceptual architecture: Guest Collections External Security Domain (User, web app, data portal, science gateway, ) DATA Channel Globus Endpoint Subscriber Security Domain CONTROL Channel Subscriber managed filesystem and endpoint policies Guest Collection Globus Security Domain User managed overlay permissions stored in Globus service

17 Globus Connect Server v5 Milestones v5.3: v5.x: v4 feature parity+ v5.2: High assurance v5.0: Google Drive v5.1: POSIX guest collections, HTTPS Multi DTN support Additional storage types Custom IdPs Other features

18 High Assurance features Additional authentication assurance Policy (per storage gateway) on frequency of authentication with specific identity for access to data Enforce user authentication with specific identity within session Application instance isolation Authentication context is per app, per session Encryption of user data in transit and Globus data at rest Detailed audit log (on DTN via GCSv5.2)

19 Additional authentication assurance

20 Additional authentication assurance

21 Re-authentication timeout

22 Application Instance Isolation Authenticated in browser session (app instance 1) Re-authentication required in CLI session (app instance 2)

23 Application Instance Isolation

24 Application Instance Isolation

25 Application Instance Isolation

26 Application Instance Isolation

27 Application Instance Isolation

28 Async transfer between HA collections Mapped Collection HA timeout: 4hrs Mapped Collection HA timeout: 2hrs Encrypted data channel

29 Globus Auth: Foundational IAM service Enables login for diverse app ecosystem Protects REST API communications between and among apps and services No new identity required Based on OAuth2 and OpenID Connect Least privileges security model: scopes/consents Access via OAuth2 and OIDC libraries of your choice Programming language and framework agnostic

30 Globus Auth: Identity broker for research apps Brokers authentication and authorization among End-users Identity providers: enterprise, external (e.g. Google) Services: resource servers with REST APIs Apps: web, mobile, desktop, command line clients Services acting as clients to other services Mission: Provide a platform for developers to easily access 100 s of IdPs with just a bit of standard code

31 Sessions: High Assurance for Globus Auth Determine which identities in a user s identity set have been used to authenticate and when Services make access control decisions Uses token introspection Session context = app instance, device Failed operation app generates specific redirect URL docs.globus.org/api/auth/sessions

32 Example user flow: Guest collection [Role:Access Manager] grants:read HA Guest Collection (timeout: 4hrs)

33 Example user flow: Guest collection HA Guest Collection (timeout: 4hrs)

34 Example user flow: Guest collection HA Guest Collection (timeout: 4hrs)

35 Example user flow: Guest collection redirect UC Medicine HA Guest Collection (timeout: 4hrs)

36 Example user flow: Guest collection [Permission:Read] HA Guest Collection (timeout: 4hrs)

37 Example user flow: Manage Permissions grants:read, Write HA Guest Collection (timeout: 4hrs)

38 Example user flow: Guest collection redirect UC Medicine HA Guest Collection (timeout: 4hrs)

39 Groups accessing HA guest collections Policy options High assurance (not) strict Authentication assurance timeout Additional restrictions Invitations can only be issued by administrator or manager Changes to group policies require specific identity within session/ authentication assurance timeout Subgroups inherit HA policy

40 Example management flows Managing High Assurance endpoints requires authentication with authorized identity, within session Endpoint configuration Globus Groups used to provide access to high assurance data Management Console access (e.g. to review logs)

41 New Globus Connect Server installation flow Install GCSv5.2+ binaries Register the endpoint at developers.globus.org Add connectors Add storage gateways Set as high assurance, configure authentication assurance timeout Set policy on type of collections supported Add mapped collection User must login with identity from configured domain Local account determined by removing the TLD: username is local account

42 Audit log on DTN via GCSv5.2

43 Globus Connect Personal (GCP) New version for high assurance data handling Allow user to choose an identity for use with the endpoint Using GCP for data access requires that identity be in session Guest collections will work as they do with GCS Additional logging

44 Secure operations Intrusion detection and prevention Performance and health monitoring Logging Secure remote access, access control Uniform configuration management and change control Backups and disaster recovery AWS best practices for securing operating environment: VPCs, security groups, IAM best practices

45 New subscription levels High Assurance 33% uplift on Standard subscription and on premium connectors used for high assurance data BAA All High Assurance features + BAA with University of Chicago 50% uplift on Standard subscription and on premium connectors used under a BAA Separate subscription ID issued

46 Questions?