An Introduction to The Americas Grid Policy Management Authority (TAGPMA) and the International Grid Trust Federation (IGTF)

Transcription

1 An Introduction to The Americas Grid Policy Management Authority (TAGPMA) and the International Grid Trust Federation (IGTF) Derek Simmel (PSC, U.S.A) Scott Rea (DigiCert, U.S.A) Alejandra Stolk (ULA, Venezuela) 2012 Latin American Conference on High Performance Computing (CLCAR) Technological University of Panama, Panama City, Panama 29 August 2012

2 Overview IGTF Structure TAGPMA Leadership Background Community Current TAGPMA Membership IGTF CA Accreditation Profiles IGTF CA Accreditation Process Other TAGPMA Projects Future Directions TAGPMA Communications TAGPMA Conference Calls Summary 2

3 IGTF Structure International Grid Trust Federation (IGTF) The Americas Grid Policy Management Authority (TAGPMA) North America, Central America, South America, Caribbean European Grid Policy Management Authority (EUGridPMA) Europe, Middle East, Africa Asia Pacific Grid Policy Management Authority (APGridPMA) Asia, Pacific, Australia, New Zealand 3

4 TAGPMA Leadership Current Officers Chair: Derek Simmel Pittsburgh Supercomputing Center, U.S.A. Vice Chair: Scott Rea DigiCert, Inc., U.S.A. Secretary: Ale Stolk ULAGrid, Venezuela 4

5 Background Public Key Infrastructure (PKI) X.509 digital certificates data signed using a secure, cryptographic checksum typically used for identity credentials hosts, services, people Certificate Authorities (CAs) securely issue digital certificates Registration Authorities (RAs) verify identity of end entities requesting certificates Relying Parties (RPs) any person or organization that trusts a CA and depends (relies) upon the CA to issue certificates Internet Protocols, e.g., SSL, TLS 5

6 Background Grid / Cloud computing & Web Services Distributed computing with standards-based interfaces for secure authentication and secure communications Open Grid Forum (OGF) Organization for the Advancement of Structured Information Standards (OASIS) World Wide Web Consortium Certificate Authority/Browser Forum Internet Engineering Task Force 6

7 Community High Performance Computing (HPC) primarily with the HPC computational science communities National and international HPC cyberinfrastructures, e.g., European Grid Infrastructure (EGI) U.S. National Science Foundation (NSF) XSEDE Partnership for Advanced Computing in Europe (PRACE) U.S. NSF & DoE Open Science Grid Worldwide Large Hadron Collider (LHC) Grid (WLCG) High Throughput Computing (HTC) cloud computing and high-scaling computing on collections of distributed nodes Grid/Cloud Distributed Computing & Storage National, Institutional and Commercial CAs 7

8 Community - EGI 8

9 Community - XSEDE 9

10 Community - PRACE 10

11 Community OSG 11

12 Community - WLCG Tier-0 (CERN): Data recording Initial data reconstruction Data distribution Tier-1 (11 centres): Permanent storage Re-processing Analysis Tier-2 (~130 centres): Simulation End-user analysis Ian.Bird@cern.ch 12 12

13 Current TAGPMA Membership Organization Country Respresentative AP/RP DigiCert USA Scott Rea AP ESNet USA Mike Helm AP GridCanada Canada Roger Impey AP IBDS ANSP Brazil Sergio Lietti AP NCAR USA Steve Beaty AP NCSA USA Jim Basney AP NERSC USA Shreyas Cholia AP NICS USA Victor Hazlewood AP PSC USA Derek Simmel AP REUNA Chile Sandra Jaque AP SDSC USA Scott Sakai AP SENAMHI Peru Otto Huiman Carrasco AP TACC USA Nathaniel Mendoza AP UFF Brazil Vinod Rebello AP ULAGrid Venezuela Alejandra Stolk AP UNAM Mexico Francisco Martinez AP UNIANDES Colombia Andres Holguin AP UNLP Argentina Paula Venosa AP FNAL USA Irwin Gaines RP gisela Spain Vinod Rebello RP NIH USA Debbie Bucci RP OSG USA Jim Basney RP REBCA USA Scott Rea RP SURAGrid USA Jerry Perez RP THEGrid USA Alan Sill RP WLCG Switzerland Dave Kelsey RP XSEDE USA Jim Marsteller RP 13

14 Current TAGPMA Membership 27 Members from North, Central and South America Covering Canada, US, Mexico, Venezuela, Chile, Peru Argentina, Brazil, and Colombia. Two Catchall CAs cover the remaining countries. 23 IGTF Accredited CAs 13 Classic DigiCert(2) US, TACC - US, UFF BrGrid & UFF LACGrid - Brazil, ANSPGrid Brazil, UNLPGrid - Argentina, REUNA Chile, ULAGrid Venezuela, GridCanada, UNAM Mexico, UNIANDES - Colombia. NOTE: DOE Grid accredited by EUGridPMA 7 SLCS (NCSA x 3, FermiLabs, NERSC, PSC, NICS UTK - US) 3 MICS (NCSA - US, CILogin - US and TACC - US) 3 CAs in-process, pending accreditation 1 Classic pending (SENAMHI Peru) 2 MICS pending (SDSC, NCAR US) 7 Relying Parties (OSG, XSEDE, THEgrid, LCG, REBCA, NIH, SURA Grid) 2 CAs accredited since last F2F in February, 2012 at SCSC, La Jolla, CA. NCSA Two-Factor CA U.S. SLCS ANSPGrid CA Brazil Classic Prospective Members: CIDITIS Panama, CI-Logon 14

15 CA Accreditation Profiles Classic CA Comprehensive CAs that issue long-term certificates to people (user certificates), computing systems (hosts), and services (e.g., web servers). Member-Integrated Credential Service (MICS) Online CAs that issue certificates via automated processes to end-entities (typically people) based on external identity data already maintained by a known and trusted organization (e.g. employer, member institution or federation) Certificates issued by MICS CAs have a maximum validity period of 13 months Short-Lived Credential Service (SLCS) Online, automated CAs that issue short-lived certificates (those with a validity period of less than 1 million seconds = ~11.6 days) rely on an existing, external source of identity data from a known and trusted organization 15

16 CA Accreditation Process Membership Application Organization applies for membership as an AP TAGPMA members vote to accept/decline membership Member requests accreditation of a CA Member describes CA and desired CA Profile A TAGPMA Mentor is assigned Two TAGPMA member reviewers are assigned Reviewers examine CA Certificate Policy and Certification Practice Statement (CP/CPS) Reviewers work with applicant to resolve issues TAGPMA members vote to accept/decline CA Operational Review Reviewers test operational aspects of CA Upon successful completion of operational tests, CA is considered TAGPMA accredited CA operators prepare and submit CA certificate and data for IGTF distribution A designated TAGPMA trusted introducer verifies CA certificate and related data, digitally signs file containing the CA certificate and data, and submits it to IGTF IGTF adds the new CA certificate and data to a pre-release collection for testing, and upon successful testing adds it to the next scheduled public IGTF distribution (optional) The CA operator applies to the TERENA Academic Certification Authority Repository (TACAR) to have their CA certificate added to the TACAR distribution. A designated TAGPMA trusted introducer verifies CA certificate and related data, digitally signs file containing the CA certificate and data, and submits it to TACAR for inclusion in the TACAR distribution. 16

17 Other TAGPMA Projects SHA-1 to SHA-2 Transition moving to a stronger standard for digital signatures Online Certificate Status Protocol (OCSP) Support online services to check for revoked certificates IPv6 addressability of CA services and data survey of readiness to support IPv6 for CA operations Private Key Protection Guidelines advise for relying parties about securely protecting private keys associated with digital certificates Attribute Authority Operations Guidelines advises prospective Attribute Authority operators regarding requirements for secure operations 17

18 Future Directions Collaboration with other communities interested in Authentication Authorization Infrastructure (AAI), e.g., InCommon incommon.org redclara Establishing closer ties to emerging cloud industry standards organizations and communities, e.g., Cloud Security Alliance cloudsecurityalliance.org Distributed Management Task Force Storage Networking Industry Association 18

19 TAGPMA Communications IGTF Website TAGPMA Website Hosts static, public information & profiles TAGPMA twiki http(s)://tagpma.es.net/wiki hosts in-process TAGPMA documents, notes, tutorials etc. Contains agenda and minutes from monthly meetings Mailing lists tagpma-general, tagpma-private Mailing lists have been moved over to Google Apps for Education, also enabling Calendar, Docs & Sites any issues direct to the Chair 19

20 TAGPMA Meetings Face-to-face meetings 2 times per year 2012 La Jolla, CA, U.S.A August Panamá City, Panamá Regular, Monthly Video Conference Calls 12:00noon Eastern on the 2nd Wednesday of each month Next one will be September 12, 2012 Video arrangements: EVO look for TAGPMA Call for agenda items goes out ~1 week in advance The agenda is usually posted on tagpma-general list no later than 1 day before the meeting. We welcome all IGTF members and prospective TAGPMA members to attend our TAGPMA meetings! 20

21 Summary TAGPMA defines accreditation profiles for secure, credential- and attribute-issuing services performs accreditations of digital certificate authorities promotes and publishes guidelines for best technical security practices and policies provides leadership in establishing trust among people, systems and services worldwide welcomes participation by Authentication Providers and Relying Parties in the Americas and the Caribbean IGTF coordinates policies and trust and among its PMAs publishes a distribution of trusted CAs data 21

22 Muchas Gracias! Many thanks to the CLCAR conference and to the Technological University of Panama for hosting our TAGPMA meeting and allowing us to speak with you today! Comments & Questions welcome! 22