- glue-wg - lists.ogf.org

Security considerations
by Paul Millar 20 Nov '08

20 Nov '08

Hi all, As promised, here's a few words on security, following from RFC-3552's suggestions: Cheers, Paul --- 9. Security Considerations This section considers security implications when using the GLUE 2.0 conceptual model. It follows the advice given in RFC-3552. As the conceptual model of GLUE 2.0 provides limited scope for embedding security information many of these concerns listed here are delegated to the concrete data models and to the underlying software implementations. Nonetheless, some points are independent of which concrete data model is employed so some discussion is appropriate. When deploying a information system conforming to GLUE 2.0 conceptual model, consideration should be given to the points discussed below. 9.1 Communication security The GLUE conceptual model is independent of how information is stored and how that information is exchanged between agents. Because of this, concern for communication security is largely delegated to the underlying concrete data model and software implementations. 9.1.1 Confidentiality. GLUE information schema contains information that may be personal or confidential in nature. Contact details and indications of end-user activity may fall into this category. Conforming implementations should identify which components of the data should be considered confidential and appropriate precautions should be in place to safeguard against disclosure to unintended audiences. 9.1.2 Data integrity. The information within GLUE has many potential uses, from operational to accounting. How accurate is the information may depend on many factors, including the software agents that publish data and the transport used to propagate information. The software used to provide an information system may cache GLUE information. If so, these caches provide additional points where data integrity may be compromised. 9.1.3 Peer Entity authentication. No explicit description of the agents that publish GLUE information is included within the GLUE schema. This prevents authentication information from being included within the abstract model. In general, support for peer-entity authentication is delegated to the concrete data model or the underpinning software. In many cases the agents will act on behalf of some AdminDomain; if so, elements of peer entity authentication (e.g., public/private key-pairs) may be included using the described schema extension mechanisms provided issues with data integrity are understood. 9.2 Non-repudiation GLUE conceptual model contains no explicit description of the publishing agents that provide GLUE information. This prevents explicitly support for non-repudiation. In many cases a set of publishing agents will provide information for Services in some AdminDomain. If so, then it is the AdminDomain that asserts the non-repudiation of the data the publishing agents provide. Non-repudiation may require information from whoever asserts the non-repudiation of the data; for example, a cryptographic certificate of some AdminDomain. If the publishing agent is identified with an AdminDomain then this information may be included using the schema extension mechanisms of the AdminDomain (via OtherInfo or Extension). It is also possible for this information to be included in fields specific to the concrete data model or it may be provided outwith of the GLUE conceptual model. In addition, information may be published with corresponding non-repudiation information, such as a cryptographic signature. Signatures may be included using schema extensions (OtherInfo or Extension) or may be included in fields specific to the concrete data model. 9.3 System security GLUE conceptual model intended use is to provide an abstract view of a grid system. There are many processes that may make use of this information, each may depend on GLUE conceptual model to undertake work. 9.3.1 Unauhorized usage The GLUE conceptual model has no explicit description of end-users of the schema information and no explicit description of authorized usage. In general, is assumed that any authorization controls for access to GLUE information is provided by specific concrete bindings and software implementation. It may be possible to identify a UserDomain with those agents authorised to use GLUE information and embed authorization information using described schema extension mechanisms, provided issues with data integrity are understood. 9.3.2 Inappropriate Usage The GLUE conceptual model provides no mechanism for describing appropriate usage. GLUE conceptual model does not include a data-processing model, so providing a description of inappropriate usage is considered out-of-scope. Individual grids may describe what they consider appropriate usage of GLUE information and implement appropriate procedure to ensure this policy is enacted. 9.4 Specific attacks RFC-3552 describes several specific attacks that must be considered. These are detailed below. 9.4.1 Eavesdropping Some information described in the GLUE schema may be sensitive in nature; this may include contact details and descriptions of user activity. Appropriate care should be taken to prevent unintended access or disclosure to an unintended audience. 9.4.2 Replay Grid operations may depend on information provided in GLUE conceptual model. A replay attack would revert part (possible all) information in the conceptual model to some previous state as seen by some (possible all) end users. A replay attack may result in disrupted service. If security attributes, such as authorization, are embedded within GLUE conceptual model then a replay attack may result in inappropriate access to data. Underlying concrete models and implementing software should prevent replay attacks. 9.4.3 Message insertion The ability to insert information is key to providing accurate information. However, inserting incorrect information may have a detrimental effect to the running systems; for example, there are attributes in the conceptual model accept multiple values. If incorrect values are included, the systems may suffer. Many aspects of GLUE provide service discovery. Inserting false information would allow unauthorised services to publish their presence and attract activity. This may be used as a basis for further attacks. Underlying concrete models and implementing software should ensure that agent's ability to insert information is limited and appropriate. 9.4.4 Deletion The ability to delete information from an information system could interfere with normal operations; for example, if Services are removed then activity that would use those services may be affected; if AdminDomains are removed then normal operation procedures may be impossible; if security components are removed (such as X509 certificates) then facilities such as non-repudiation may become ineffectual. Underlying concrete models and implementing software should ensure that any ability of an agent to delete information is limited and appropriate. 9.4.5 Modification The ability to modify information is key to providing accurate information. However, concrete data models and implementing software should limit agents so their ability to modify information is limited and appropriate. 9.4.6 Man-in-the-middle. Man-in-the-middle attacks may allow arbitrary modification of data within the GLUE conceptual model. This may have severe influence on the systems based on GLUE information. Underlying concrete models and implementing software should understand the risk from man-in-the-middle attacks and provide appropriate security against them. 9.4.7 Denial of service attacks A Denial of Service attack is one that attempts to prevent normal operation of systems. Perhaps, the most obvious is to prevent or corrupt the flow of information. Systems using GLUE conceptual model should understand the risk from lack of information. Appropriate measures should be taken to ensure the systems continue to run whenever possible.

3 7

call schedule
by Sergio Andreozzi 18 Nov '08

18 Nov '08

Dear all, please, find an updated call schedule covering Nov and Dec: • Mon 24 Nov 2008 - 3 PM CET - 1,5h • Thu 27 Nov 2008 - 3 PM CET - 1,5h • Mon 01 Dic 2008 - 3 PM CET - 1,5h • Thu 04 Dic 2008 - 3 PM CET - 1,5h • Tue 09 Dic 2008 - 3 PM CET - 1,5h • Thu 11 Dic 2008 - 3 PM CET - 1,5h • Mon 15 Dic 2008 - 3 PM CET - 1,5h • Thu 18 Dic 2008 - 3 PM CET - 1,5h http://forge.ogf.org/sf/wiki/do/viewPage/projects.glue-wg/wiki/PhoneMeetings note that: - starting from next week, we will run two calls a week to speed up the process - this Thursday there is no call - next Monday, Cal Loomis will join us to help in including his comments if you have any problem with the schedule, let me know. Cheers, Sergio

1 0

GLUE 1.3 errata
by Burke, S (Stephen) 17 Nov '08

17 Nov '08

Hi, Paul just spotted another erratum (or two). The graphic of enumerated types on page 21 of the glue 1.3 spec (figure 6) doesn't include sestatus_t, and while it does have cestatus_t it's wrong in that the values are given as all lowercase. In fact they should be capitalised (Prodution etc) as it correctly says in the text in the CE and SE tables. Stephen -- Scanned by iCritical.

1 0

minutes from today call - next call 20/11 3 PM CET
by Sergio Andreozzi 17 Nov '08

17 Nov '08

Dear all, please, find a few notes about the today call here: http://forge.ogf.org/sf/wiki/do/viewPage/projects.glue-wg/wiki/PhoneMeeting… today we reviewed comments from C.22 to C.29: http://forge.ogf.org/sf/wiki/do/viewPage/projects.glue-wg/wiki/GLUE20Commen… next call is scheduled for the next Thursday, 20/11, 3 PM CET. Cheers, Sergio -- Sergio Andreozzi INFN-CNAF, Tel: +39 051 609 2860 Viale Berti Pichat, 6/2 Fax: +39 051 609 2746 40127 Bologna (Italy) Web: http://www.cnaf.infn.it/~andreozzi

2 1

telecon reminder - today 3 PM CET
by Sergio Andreozzi 17 Nov '08

17 Nov '08

Dear all, this is to remind our today GLUE call at 3 PM CET: http://forge.ogf.org/sf/wiki/do/viewPage/projects.glue-wg/wiki/PhoneMeeting… Cheers, Sergio -- Sergio Andreozzi INFN-CNAF, Tel: +39 051 609 2860 Viale Berti Pichat, 6/2 Fax: +39 051 609 2746 40127 Bologna (Italy) Web: http://www.cnaf.infn.it/~andreozzi

1 0

minutes today call + next call 17/11
by Sergio Andreozzi 03 Nov '08

03 Nov '08

Dear all, the minutes from the today call are available here: http://forge.ogf.org/sf/wiki/do/viewPage/projects.glue-wg/wiki/PhoneMeeting… the next call is scheduled for 17 November, 3 PM CET http://forge.ogf.org/sf/wiki/do/viewPage/projects.glue-wg/wiki/PhoneMeeting… Best regards, Sergio -- Sergio Andreozzi INFN-CNAF, Tel: +39 051 609 2860 Viale Berti Pichat, 6/2 Fax: +39 051 609 2746 40127 Bologna (Italy) Web: http://www.cnaf.infn.it/~andreozzi

1 0

GLUE WG telecon - today 15 CET - 1,5h
by Sergio Andreozzi 03 Nov '08

03 Nov '08

Dear all, this is to remind you that today we restart our weekly WG GLUE call to discuss comments received during public comment period and move the spec to final: http://forge.ogf.org/sf/wiki/do/viewPage/projects.glue-wg/wiki/PhoneMeeting… Looking to talk to you, Sergio -- Sergio Andreozzi INFN-CNAF, Tel: +39 051 609 2860 Viale Berti Pichat, 6/2 Fax: +39 051 609 2746 40127 Bologna (Italy) Web: http://www.cnaf.infn.it/~andreozzi

1 0

new schedule for GLUE call
by Sergio Andreozzi 30 Oct '08

30 Oct '08

Dear all, here is the proposed new schedule to restart work on GLUE 2.0: * 3 Nov 2008 - 3 PM CET - 1,5h (mon) * 11 Nov 2008 - 3 PM CET - 1,5h (tue) * 18 Nov 2008 - 3 PM CET - 1,5h (tue) * 25 Nov 2008 - 3 PM CET - 1,5h (tue) please, let me know if you have any problem with this. Best regards, Sergio -- Sergio Andreozzi INFN-CNAF, Tel: +39 051 609 2860 Viale Berti Pichat, 6/2 Fax: +39 051 609 2746 40127 Bologna (Italy) Web: http://www.cnaf.infn.it/~andreozzi

5 9

Glue 1.3 error
by Burke, S (Stephen) 29 Oct '08

29 Oct '08

Hi, Paul Millar has pointed out that there's a mistake in the GLUE 1.3 schema definition document: the AccessControlBaseRule attributes for CE, VOView, SA and VOInfo (but not Service) are incorrectly defined as multiplicity 1 (single-valued) when they should be multiplicity * (multi-valued). This is just a documentation error, the schema itself (at least the LDAP implementation) is correct. Is there any suggestion about the best way to record such an erratum? Stephen PS Second attempt to send this, the first one got hit by our forced change of email address ... -- Scanned by iCritical.

4 5

about today telecon
by Sergio Andreozzi 21 Oct '08

21 Oct '08

Dear all, today we have a scheduled GLUE call: http://forge.ogf.org/sf/wiki/do/viewPage/projects.glue-wg/wiki/PhoneMeeting… due to the recent evolution of the legislation in Italy, we are holding a personnel meeting here at CNAF to evaluate the situation and define possible actions. If you want to learn more on this topic, you can read and eventually sign the petition presented on this website: http://www.buconero.eu/ Given the overlapping meeting, I will not be able to attend the today call. Therefore, I propose to cancel it. I will communicate later this week about the next scheduled call. Best regards, Sergio -- Sergio Andreozzi INFN-CNAF, Tel: +39 051 609 2860 Viale Berti Pichat, 6/2 Fax: +39 051 609 2746 40127 Bologna (Italy) Web: http://www.cnaf.infn.it/~andreozzi

1 0