September 2006 - ogsa-authz-wg

Next Telecon
by David Chadwick 02 Nov '06

02 Nov '06

Dear All the next teleconference is scheduled for Monday 16 October at the following times 7:00 US West Coast 10:00 US East Coast 15:00 UK 16:00 Europe 23:00 Japan Frank S circulated a set of numbers to be used in his last email message of 13 Sept. They are > Skype number is <skype:+99008275780044> > > > > If you want to use a regular phone in the US, call *#1-712-432-4000 with > > Conference Room Number: *5780044* It seems they have the following alternative "local" regular phone call-in numbers available for some European countries: Austria 0820 400 01562 Belgium 0703 59 984 France 0826 100 266 Germany 01805 00 7620 UK 0870 119 2350 I suggest the following provisional agenda 1. Discussion of updated CVS Requirements document (to be circulated soon) 2. Discussion of revised Authorisation Functional components doc (to be circulated soon) 3. Update on suggested changes to VOMS attribute profile 4. Update on documentation of GT4 interfaces 4. Any other topics? Once we can get reasonable agreements on 1 and 2 above, I would then like to move onto discussing protocols between the various authorisation components. But I suggest that this will be at the next telecon after this one. If you have any comments on the above prior to the telecom, please circulate the list regards David -- ***************************************************************** David W. Chadwick, BSc PhD Professor of Information Systems Security The Computing Laboratory, University of Kent, Canterbury, CT2 7NF Skype Name: davidwchadwick Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick(a)kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://sec.cs.kent.ac.uk Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 *****************************************************************

7 22

Links for material on path validation and on the IGTF, etc.
by Alan Sill 23 Sep '06

23 Sep '06

Per action items from meeting of 21 Sep. 2006: A link for information on the International Grid Trust Federation (IGTF) and its activities with respect to the large-scale grids in science and academics is below: http://www.gridpma.org/ Information in general on path validation is available at http://tools.ietf.org/html/rfc3379 I will look for and try to supplement the above with information specific to path validation and related issues for the use of Bridge CAs and similar structures in grids as soon as possible. Note that The Americas Grid PMA (TAG PMA) has formed a working group on the above issue including members from the other PMAs, and that is currently in process. There is also extensive activity, especially in the Internet2, Educause and related sectors with respect to the use of Shibboleth with grids, including related PKI and X.509-embedding issues, see http://grid.ncsa.uiuc.edu/events/ggf18-shib-bof/ Best, Alan Alan Sill TIGRE Senior Scientist High Performance Computing Center TTU ==================================================================== : Alan Sill, Texas Tech University Office: Admin 233, MS 4-1167 : : e-mail: Alan.Sill(a)ttu.edu ph. 806-742-4350 fax 806-742-4358 : ====================================================================

1 0

[ogsa-wg] Proposed agenda for Sept. 21st call
by Hiro Kishimoto 22 Sep '06

22 Sep '06

Hi all, The following is a proposed agenda for OGSA-WG telecon on Sept. 21st. Thursday from 8:30am - 10:30am (CDT). Dial-in numbers for Thursday: Free: +1-888-452-0308 Intl/Toll: +1-484-644-0505 PIN: 71815 Screen share service will be provided. URL: http://ogsa.glance.net Session key: 0921 See more explanation: https://forge.gridforum.org/sf/go/wiki1584?nav=1 1) Early discussion (20 min) Note taker assignment Roll call Telecon minutes approval (Sept. 7) https://forge.gridforum.org/sf/go/doc13796?nav=1 Action Items status review (see the bottom of this email) Agenda bashing 2) GGF18 and F2F meeting debriefing (20 min) Feedback and impression on GGF18 sessions and F2F. Minutes approval https://forge.gridforum.org/sf/docman/do/listDocuments/projects.ogsa-wg/doc… If you have not yet upload your materials, please do so before the call. 3) OGSA security (David Snelling, 80 min) 3-1) Formalities 3-2) Existing Technologies Summary X.509 X.509, with proxy extension SAML Specific SAML profiles of interest. XACML .... 3-3) Overview of Security Area activity FI-RG OGSA-AuthZ-WG TC-RG 3-4) Initial short list of minimal use cases OGSA Base security profile summary OGSA secure channel for authorization SAML based point to point authorization Delegation? 3-5) Security Profile status update (Takuya) 3-6) Other?? 4) Wrap up (10 min) AOB <*NEXT CALL*> https://forge.gridforum.org/sf/go/wiki1477?nav=1 Sept. 25 (Mon): EGA reference model, OGSA roadmap Sept. 28 (Thu): TBD Oct. 2 (Mon): Information/data modeling Oct. 5 (Thu): Security Oct. 9 (Mon): EGA reference model, OGSA roadmap <*ACTION ITEMS*> https://forge.gridforum.org/sf/go/wiki1569?nav=1 > From GGF18 EGA session (Sept. 12) AI-0912a: Hiro to set up an initial group of people to start a discussion within OGSA. Identify what should be done. - Dave Snelling, Andrew Grimshaw, Tom Maguire - Paul Strong, Alan Clark, Bob Thome > From GGF18 EMS session (Sept. 13) AI-0913a: Andreas to update function names of BES. AI-0913b: Andrew to write-up a couple of such JM functionalities (short paragraph for each, e.g. time constraint as JSDL extension.) AI-0913c: Andreas to add another scenario to use this “terminate” method of activity interface. AI-0913d: Andrew to propose clarification on this issue in BES specification. AI-0913e: Andreas to separate un-deployment as a separate scenario. AI-0913f: Andreas to describe relation between ACS and CDDLM. AI-0913g: Donal to provide his proposal. > From Sept. 14 OGSA F2F AI-0914a (Andreas Savva): Integrate the simple Data scenario just presented into the scenarios document AI-0914b (D Snelling, D Merrill): Set up an OGSA Security design team AI-0914c (E Stokes): Send a mail to the BES mailing list requesting re-examination of the BES spec appendix regarding the Information Model relationship AI-0914d (A Grimshaw): Propose new text for the said appendix; arrange telecon woth interested parties to mediate the conflicting interests AI-0914e (A Grimshaw): Initiate and ramp up the interop fest activities AI-0914f (H Kishimoto): Fix the location of the next F2F and inform the group vial the mailing list > From Sept. 15 OGSA F2F AI-0915a (A Savva, S McGough): Set up a telephone conference to collect workflow experience > From Sept. 7 call AI-0907a: Hiro to add Chris Jordan to the list of people attending the F2F at the IBM facility. AI-0907b: Takuya will search for an external reliable source of strong (or deprecated) ciphers to reference. AI-0907c: Andreas will revise the explanatory text and send the new version to Takuya. AI-0907d: Takuya will update the documents and issue a final call on the list. (Probably during GGF18.) AI-0907e: Hiro to send an email to Greg requesting that the 'obsoletes' information be added to the document template. AI-0907f: Hiro to add an agenda item for the F2F to discuss a revision of statement R0711. > From Aug. 31 call AI-0831c: (A Savva) Update/rewrite secction 4.1 of the EMS Architecture scenarios AI-0831d: (A Savva) Add the Application Version in section 4.2, paragraph 4, of the EMS Arch Scenarios AI-0831e: (A Savva) Talk to ACS working group for refining this scenario. AI-0831f: (A Savvva) Research RNS and probably update the EMS Arch Scenarios document AI-0831g: (A Savva) List of open issues, scenarios and refinements for the EMS Arch Scenarios document AI-0831h: (M Morgan, A Grimshaw) Provide an outline sequence how BES, ByteIO, RNS, etc. are combined together at University of Virginia > From Aug. 28 call Action AI-0828a: Frank will do more investigation, read the paper, and make a proposal. > From Aug. 17 call AI-0817a: Dave Berry and Jay Unger will approach groups (GIN, Globus, etc) that have implemented practical grids and start a discussion on how they handle data: - how data is treated as a resource that can be scheduled - how transfers are modeled - how files are advertised - how applications find files (query, by knowledge,?) (Postponed until GGF18) > From Aug. 10 call AI-0810a: Donal to look into the relation of the EPS and CDL (retrieval, update, etc). (Eventually this should probably become a separate scenario.) > From Aug. 3 call AI-0803e: Jun will provide an example of the CDL mechanism and why using ID/IDREF is not a good idea. AI-0803f: Jun will update the CDL document to remove the Environment variables > From July 20 F2F - EGR-WG (Ravi) will contact Geoffrey Fox and invites him to contribute use cases. - Andreas to go through the minutes and formulate a reply mail to Geoffrey on each artifact covered in these minutes. <postponed> - Steve McGough & Andreas to do a mapping from the current JSDL elements / terminology into the new information model structure (Proposed split into Description and Requirements) (from July 18th F2F, By GGF18 as original discussed.) ---- Hiro Kishimoto

2 2

CFP: 6th Annual PKI R&D Workshop
by Frank Siebenlist 20 Sep '06

20 Sep '06

Please take a look at the attached call for papers. Over the years, this PKI R&D Workshop has proven to be one of the most enjoyable security events with high quality papers and very interesting presentations. Securely yours, Frank. ---------------------- 6th Annual PKI R&D Workshop "Applications-Driven PKI (It's The Apps, Stupid!)" NIST, Gaithersburg, MD April 17-19, 2007 http://middleware.internet2.edu/pki07/ This workshop considers the full range of public key technology used for security decisions and supporting functionalities, including authentication, authorization, identity management, federation, and trust. This year's focus is striking the proper balance to permit users to complete tasks requiring security easily while exposing the appropriate security details through all layers of software. This workshop has three goals: Explore the current state of public key technology and emerging trust mechanisms in different domains, including web services, grid technologies, encryption functionality, authentication systems, etc., in academia, research, government, and industry. Share and discuss lessons learned and scenarios encountered from vendors and practitioners from current deployments. Provide a forum for leading security researchers to explore the issues relevant to PKI in relation to applications, usability, security management, identity, trust, policy, authentication, authorization and encryption (e.g., supporting privacy requirements). Call for Papers We solicit papers, case studies, panel proposals, and participation from researchers, systems architects, vendor engineers, and users. Suggested topics include but are not limited to: Reports of real-world experience with the use and deployment of applications that leverage PKI, how best to integrate such usage into legacy systems, and future research directions Federated versus Non-Federated trust models Standards related to PKI and security decision systems, such as X.509, SPKI/SDSI, PGP, XKMS, XACML, XRML, XML signatures, and SAML Identity management (Shibboleth, Liberty, Higgins, InfoCard, etc.) Cryptographic and alternative methods for supporting security decisions, including the characterization and encoding of data Intersection of policy-based systems and PKI Human-Computer Interaction (HCI) advances that improve usability of PKI for users and administrators Privacy protection and implications Use of PKI in emerging technologies (e.g., sensor networks) Scalability and performance of PKI systems Security of the components of PKI systems Security infrastructures for constrained environments Improved human factor designs for security-related interfaces, including authorization and policy management, naming, signatures, encryption, use of multiple private keys, and selective disclosure New paradigms in PKI architectures Submissions should be provided electronically, in PDF, for standard US letter-size paper (8.5 x 11 inches). Paper submissions must not exceed 15 pages (single space, two column format with 1" margins using a 10 pt or larger font) and have no header or footer text (e.g., no page numbers). Proposals for panels should be no longer than five pages and include possible panelists and an indication of which panelists have confirmed participation. Submissions will be handled electronically. Detailed submission instructions can be found at the workshop website (see http://middleware.internet2.edu/pki07/) All submissions will be acknowledged. Submissions of papers must not substantially duplicate work that any of the authors have published elsewhere or have submitted in parallel to any other conferences or journals. Accepted papers will be published in a preproceedings at the workshop and in a final proceedings shortly after the workshop. Deadlines for conference paper and panel submissions are: Papers and Proposals Due: October 22, 2006 Authors Notified: December 18, 2006 Final Materials Due: February 26, 2007 Workshop: April 17-19, 2007 -- Frank Siebenlist franks(a)mcs.anl.gov The Globus Alliance - Argonne National Laboratory

1 0

skype use for next telcon
by Frank Siebenlist 16 Sep '06

16 Sep '06

I've been using Highspeedconferencing.com a couple of times and it worked well. It gave me a personal, permanent telcon number that I can use any time: Skype number is <skype:+99008275780044> If you want to use a regular phone in the US, call *#1-712-432-4000 with Conference Room Number: *5780044* This should all work even without me attending... Regards, Frank. -- Frank Siebenlist franks(a)mcs.anl.gov The Globus Alliance - Argonne National Laboratory

2 2

Mins and charter
by David Chadwick 15 Sep '06

15 Sep '06

Dear WG I have uploaded the revised charter and the minutes of the GGF18 meeting to source forge https://forge.gridforum.org/sf/go/doc13860?nav=1 https://forge.gridforum.org/sf/go/doc13859?nav=1 the charter is open for comments for 2 weeks from today, and if no comments are received it will then be submitted to OGF as the definite version regards David -- ***************************************************************** David W. Chadwick, BSc PhD Professor of Information Systems Security The Computing Laboratory, University of Kent, Canterbury, CT2 7NF Skype Name: davidwchadwick Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick(a)kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://sec.cs.kent.ac.uk Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 *****************************************************************

1 0

Draft notes
by David Chadwick 14 Sep '06

14 Sep '06

Dear All please find attached draft notes of today's meeting. Please send any comments within the next 24 hours, and then I will post them to gridforge regards David -- ***************************************************************** David W. Chadwick, BSc PhD Professor of Information Systems Security The Computing Laboratory, University of Kent, Canterbury, CT2 7NF Skype Name: davidwchadwick Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick(a)kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://sec.cs.kent.ac.uk Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 *****************************************************************

1 0

Updated version of VOMS Specification
by Vincenzo Ciaschini 12 Sep '06

12 Sep '06

Hi to All, This is the updated document about VOMS specification I promised yesterday. Apart from a few minor language clarifications, the main changes are in the following sections: 3.4.1 clarifications about the syntax of FQANs. 3.4.2 rewritten, with a (slight) change in format. 3.5.1 explanation rewritten. The previous explanation was the exact opposite of the truth. OOPS! Also, the AC example in section5 has been substituted with a more complete one. Bye, Vincenzo

5 11

PERMIS AC profile
by David Chadwick 11 Sep '06

11 Sep '06

Dear WG I have just updated the first version of the PERMIS attribute certificate profile. You can find it at https://forge.gridforum.org/sf/go/doc13802?nav=1 regards David -- ***************************************************************** David W. Chadwick, BSc PhD Professor of Information Systems Security The Computing Laboratory, University of Kent, Canterbury, CT2 7NF Skype Name: davidwchadwick Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick(a)kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://sec.cs.kent.ac.uk Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 *****************************************************************

1 0

Minutes of Teleconference 7 Sept
by David Chadwick 10 Sep '06

10 Sep '06

Dear WG the notes from the last telephone conference call on 7 Sept can be downloaded from https://forge.gridforum.org/sf/go/doc13799?nav=1 regards David -- ***************************************************************** David W. Chadwick, BSc PhD Professor of Information Systems Security The Computing Laboratory, University of Kent, Canterbury, CT2 7NF Skype Name: davidwchadwick Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick(a)kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://sec.cs.kent.ac.uk Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 *****************************************************************

1 0