- ogsa-authz-wg - lists.ogf.org

[ogsa-wg] Proposed agenda for Oct. 5th call
by Hiro Kishimoto 05 Oct '06

05 Oct '06

Hi all, The following is a proposed agenda for OGSA-WG telecon on Oct. 5th Thursday from 8:30am - 10:30am (CDT). Dial-in numbers for Thursday: Free: +1-888-452-0308 Intl/Toll: +1-484-644-0505 PIN: 71815 See more information: - https://forge.gridforum.org/sf/go/wiki1477?nav=1 Screen share service will be provided. URL: http://ogsa.glance.net Session key: 1005 See more explanation: https://forge.gridforum.org/sf/go/wiki1584?nav=1 1) Early discussion (20 min) Note taker assignment Roll call Telecon minutes approval (Sept. 28) - https://forge.gridforum.org/sf/go/doc13912?nav=1 Action Items status review (see the bottom of this email) Agenda bashing 2) OGSA security (David Snelling, 60 min) - What needs to be done to achieve simple interop generally and to bootstrap more - Profile to get authentication information from a secure channel for authentication - Profile for other methods to get authentication informatin for authorization 3) Secure Channel Security Profile status (Takuya Mori, 20 min) > Takuya will prepare a new version. Since there are a number of > unresolved issues the Secure Channel will not go to final call until > the issues raised during this review are closed. > > There is a security discussion scheduled for next Thursday (Oct > 5). Confirm status at that time. 4) Wrap up (10 min) AOB <*NEXT CALL*> https://forge.gridforum.org/sf/go/wiki1477?nav=1 Oct. 9 (Mon): EGA reference model, OGSA roadmap Oct. 12 (Thu): <No call?> Oct. 16 (Mon): DMTF Workregister Oct. 19 (Thu): Information/data modeling, Security, secure channel profile review Oct. 23 (Mon): EGA reference model, OGSA roadmap Oct. 26 (Thu): Information/data modeling Oct. 30 (Mon): <TBD> <*ACTION ITEMS*> https://forge.gridforum.org/sf/go/wiki1569?nav=1 > From Sept. 28 call. AI-0928a: Takuya will issue a final call on BSP-Core on the list. AI-0928b: Takuya will get another opinion on TLS 1.1 and ciphersuites (probably ask Frank Siebenlist) AI-0928c: Andreas will propose new text for the reference to the NIST document to make it clearer that it is an informative statement > From Sept. 25 call. AI-0925a: Hiro to setup wiki page with names of people who have expressed interest in the security team AI-0925b: Jem to pull definitions together and produce a new merged first draft. - Send a mail to the ogsa list about this work - Set Oct. 9 as the target for the first Glossary draft AI-0925c: Hiro to ask Alan Clark to ask EGA TC member who want to contribute to join the OGSA list and this convergence work. - Members may have changed but organizations have not AI-0925g: Tom will send a note to the list (to: Ellen S and Fred M) on why the current separation of service/info model may not be quite right. > From Sept. 21 call. AI-0921b: Security members to discuss the BoF proposal(s) further - For example, one outcome could be some standards activity to mirror CAOPS activities and tie-in to OGSA AI-0921d: Dave S to collect additional material in order to identify security issues better. - (AI-0921e is an issue instance) AI-0921i: Dave S to provide an agenda for the next security call. - Draft agenda items for Oct. 5th: - What needs to be done to achieve simple interop generally and to bootstrap more - Profile to get authentication information from a secure channel for authentication - Profile for other methods to get authentication informatin for authorization > From Sept. 15 OGSA F2F AI-0915a: (A Savva, S McGough): Set up a telephone conference to collect workflow (BPEL) experience AI-0915b: Ellen to check the status of the items on the DMTF work register: report which have been done, and what DMTF is doing for the rest. (by Oct. 13) AI-0915c: Ellen to propose new text to update the DMTF register (by Oct. 13) AI-0915d: Tom will post BP base faults issue to tracker AI-0915e: Hiro to talk with OGF Editor to start an errata process > From Sept. 14 OGSA F2F AI-0914f (Fred Brisard and Hiro Kishimoto): Fix the location of the next F2F and inform the group vial the mailing list > From Aug. 17 call AI-0817a: Dave Berry and Jay Unger will approach groups (GIN, Globus, etc) that have implemented practical grids and start a discussion on how they handle data: - how data is treated as a resource that can be scheduled - how transfers are modeled - how files are advertised - how applications find files (query, by knowledge,?) (Due Oct. 9) > From Aug. 3 call AI-0803e: Jun will provide an example of the CDL mechanism and why using ID/IDREF is not a good idea. AI-0803f: Jun will update the CDL document to remove the Environment variables > From July 20 F2F - EGR-WG (Ravi) will contact Geoffrey Fox and invites him to contribute use cases. - Andreas to go through the minutes and formulate a reply mail to Geoffrey on each artifact covered in these minutes. Postponed: Until next EMS call. AI-0914a (Andreas Savva): Integrate the simple Data scenario just presented into the scenarios document AI-0913a: Andreas to update function names of BES. AI-0913b: Andrew to write-up a couple of such JM functionalities (short paragraph for each, e.g. time constraint as JSDL extension.) AI-0913c: Andreas to add another scenario to use this “terminate” method of activity interface. AI-0913e: Andreas to separate un-deployment as a separate scenario. AI-0913f: Andreas to describe relation between ACS and CDDLM. AI-0913g: Donal to provide his proposal on "ActivityExecutionCandidate." AI-0831e: (A Savva) Talk to ACS working group for refining this scenario. AI-0831f: (A Savvva) Research RNS and probably update the EMS Arch Scenarios document AI-0921c: Dave S (as Standards VP) to talk to the next Security AD (when one is selected) about the Security Area task list. ---- Hiro Kishimoto

3 5

Links for material on path validation and on the IGTF, etc.
by Alan Sill 22 Sep '06

22 Sep '06

Per action items from meeting of 21 Sep. 2006: A link for information on the International Grid Trust Federation (IGTF) and its activities with respect to the large-scale grids in science and academics is below: http://www.gridpma.org/ Information in general on path validation is available at http://tools.ietf.org/html/rfc3379 I will look for and try to supplement the above with information specific to path validation and related issues for the use of Bridge CAs and similar structures in grids as soon as possible. Note that The Americas Grid PMA (TAG PMA) has formed a working group on the above issue including members from the other PMAs, and that is currently in process. There is also extensive activity, especially in the Internet2, Educause and related sectors with respect to the use of Shibboleth with grids, including related PKI and X.509-embedding issues, see http://grid.ncsa.uiuc.edu/events/ggf18-shib-bof/ Best, Alan Alan Sill TIGRE Senior Scientist High Performance Computing Center TTU ==================================================================== : Alan Sill, Texas Tech University Office: Admin 233, MS 4-1167 : : e-mail: Alan.Sill(a)ttu.edu ph. 806-742-4350 fax 806-742-4358 : ====================================================================

1 0

[ogsa-wg] Proposed agenda for Sept. 21st call
by Hiro Kishimoto 22 Sep '06

22 Sep '06

Hi all, The following is a proposed agenda for OGSA-WG telecon on Sept. 21st. Thursday from 8:30am - 10:30am (CDT). Dial-in numbers for Thursday: Free: +1-888-452-0308 Intl/Toll: +1-484-644-0505 PIN: 71815 Screen share service will be provided. URL: http://ogsa.glance.net Session key: 0921 See more explanation: https://forge.gridforum.org/sf/go/wiki1584?nav=1 1) Early discussion (20 min) Note taker assignment Roll call Telecon minutes approval (Sept. 7) https://forge.gridforum.org/sf/go/doc13796?nav=1 Action Items status review (see the bottom of this email) Agenda bashing 2) GGF18 and F2F meeting debriefing (20 min) Feedback and impression on GGF18 sessions and F2F. Minutes approval https://forge.gridforum.org/sf/docman/do/listDocuments/projects.ogsa-wg/doc… If you have not yet upload your materials, please do so before the call. 3) OGSA security (David Snelling, 80 min) 3-1) Formalities 3-2) Existing Technologies Summary X.509 X.509, with proxy extension SAML Specific SAML profiles of interest. XACML .... 3-3) Overview of Security Area activity FI-RG OGSA-AuthZ-WG TC-RG 3-4) Initial short list of minimal use cases OGSA Base security profile summary OGSA secure channel for authorization SAML based point to point authorization Delegation? 3-5) Security Profile status update (Takuya) 3-6) Other?? 4) Wrap up (10 min) AOB <*NEXT CALL*> https://forge.gridforum.org/sf/go/wiki1477?nav=1 Sept. 25 (Mon): EGA reference model, OGSA roadmap Sept. 28 (Thu): TBD Oct. 2 (Mon): Information/data modeling Oct. 5 (Thu): Security Oct. 9 (Mon): EGA reference model, OGSA roadmap <*ACTION ITEMS*> https://forge.gridforum.org/sf/go/wiki1569?nav=1 > From GGF18 EGA session (Sept. 12) AI-0912a: Hiro to set up an initial group of people to start a discussion within OGSA. Identify what should be done. - Dave Snelling, Andrew Grimshaw, Tom Maguire - Paul Strong, Alan Clark, Bob Thome > From GGF18 EMS session (Sept. 13) AI-0913a: Andreas to update function names of BES. AI-0913b: Andrew to write-up a couple of such JM functionalities (short paragraph for each, e.g. time constraint as JSDL extension.) AI-0913c: Andreas to add another scenario to use this “terminate” method of activity interface. AI-0913d: Andrew to propose clarification on this issue in BES specification. AI-0913e: Andreas to separate un-deployment as a separate scenario. AI-0913f: Andreas to describe relation between ACS and CDDLM. AI-0913g: Donal to provide his proposal. > From Sept. 14 OGSA F2F AI-0914a (Andreas Savva): Integrate the simple Data scenario just presented into the scenarios document AI-0914b (D Snelling, D Merrill): Set up an OGSA Security design team AI-0914c (E Stokes): Send a mail to the BES mailing list requesting re-examination of the BES spec appendix regarding the Information Model relationship AI-0914d (A Grimshaw): Propose new text for the said appendix; arrange telecon woth interested parties to mediate the conflicting interests AI-0914e (A Grimshaw): Initiate and ramp up the interop fest activities AI-0914f (H Kishimoto): Fix the location of the next F2F and inform the group vial the mailing list > From Sept. 15 OGSA F2F AI-0915a (A Savva, S McGough): Set up a telephone conference to collect workflow experience > From Sept. 7 call AI-0907a: Hiro to add Chris Jordan to the list of people attending the F2F at the IBM facility. AI-0907b: Takuya will search for an external reliable source of strong (or deprecated) ciphers to reference. AI-0907c: Andreas will revise the explanatory text and send the new version to Takuya. AI-0907d: Takuya will update the documents and issue a final call on the list. (Probably during GGF18.) AI-0907e: Hiro to send an email to Greg requesting that the 'obsoletes' information be added to the document template. AI-0907f: Hiro to add an agenda item for the F2F to discuss a revision of statement R0711. > From Aug. 31 call AI-0831c: (A Savva) Update/rewrite secction 4.1 of the EMS Architecture scenarios AI-0831d: (A Savva) Add the Application Version in section 4.2, paragraph 4, of the EMS Arch Scenarios AI-0831e: (A Savva) Talk to ACS working group for refining this scenario. AI-0831f: (A Savvva) Research RNS and probably update the EMS Arch Scenarios document AI-0831g: (A Savva) List of open issues, scenarios and refinements for the EMS Arch Scenarios document AI-0831h: (M Morgan, A Grimshaw) Provide an outline sequence how BES, ByteIO, RNS, etc. are combined together at University of Virginia > From Aug. 28 call Action AI-0828a: Frank will do more investigation, read the paper, and make a proposal. > From Aug. 17 call AI-0817a: Dave Berry and Jay Unger will approach groups (GIN, Globus, etc) that have implemented practical grids and start a discussion on how they handle data: - how data is treated as a resource that can be scheduled - how transfers are modeled - how files are advertised - how applications find files (query, by knowledge,?) (Postponed until GGF18) > From Aug. 10 call AI-0810a: Donal to look into the relation of the EPS and CDL (retrieval, update, etc). (Eventually this should probably become a separate scenario.) > From Aug. 3 call AI-0803e: Jun will provide an example of the CDL mechanism and why using ID/IDREF is not a good idea. AI-0803f: Jun will update the CDL document to remove the Environment variables > From July 20 F2F - EGR-WG (Ravi) will contact Geoffrey Fox and invites him to contribute use cases. - Andreas to go through the minutes and formulate a reply mail to Geoffrey on each artifact covered in these minutes. <postponed> - Steve McGough & Andreas to do a mapping from the current JSDL elements / terminology into the new information model structure (Proposed split into Description and Requirements) (from July 18th F2F, By GGF18 as original discussed.) ---- Hiro Kishimoto

2 2

CFP: 6th Annual PKI R&D Workshop
by Frank Siebenlist 20 Sep '06

20 Sep '06

Please take a look at the attached call for papers. Over the years, this PKI R&D Workshop has proven to be one of the most enjoyable security events with high quality papers and very interesting presentations. Securely yours, Frank. ---------------------- 6th Annual PKI R&D Workshop "Applications-Driven PKI (It's The Apps, Stupid!)" NIST, Gaithersburg, MD April 17-19, 2007 http://middleware.internet2.edu/pki07/ This workshop considers the full range of public key technology used for security decisions and supporting functionalities, including authentication, authorization, identity management, federation, and trust. This year's focus is striking the proper balance to permit users to complete tasks requiring security easily while exposing the appropriate security details through all layers of software. This workshop has three goals: Explore the current state of public key technology and emerging trust mechanisms in different domains, including web services, grid technologies, encryption functionality, authentication systems, etc., in academia, research, government, and industry. Share and discuss lessons learned and scenarios encountered from vendors and practitioners from current deployments. Provide a forum for leading security researchers to explore the issues relevant to PKI in relation to applications, usability, security management, identity, trust, policy, authentication, authorization and encryption (e.g., supporting privacy requirements). Call for Papers We solicit papers, case studies, panel proposals, and participation from researchers, systems architects, vendor engineers, and users. Suggested topics include but are not limited to: Reports of real-world experience with the use and deployment of applications that leverage PKI, how best to integrate such usage into legacy systems, and future research directions Federated versus Non-Federated trust models Standards related to PKI and security decision systems, such as X.509, SPKI/SDSI, PGP, XKMS, XACML, XRML, XML signatures, and SAML Identity management (Shibboleth, Liberty, Higgins, InfoCard, etc.) Cryptographic and alternative methods for supporting security decisions, including the characterization and encoding of data Intersection of policy-based systems and PKI Human-Computer Interaction (HCI) advances that improve usability of PKI for users and administrators Privacy protection and implications Use of PKI in emerging technologies (e.g., sensor networks) Scalability and performance of PKI systems Security of the components of PKI systems Security infrastructures for constrained environments Improved human factor designs for security-related interfaces, including authorization and policy management, naming, signatures, encryption, use of multiple private keys, and selective disclosure New paradigms in PKI architectures Submissions should be provided electronically, in PDF, for standard US letter-size paper (8.5 x 11 inches). Paper submissions must not exceed 15 pages (single space, two column format with 1" margins using a 10 pt or larger font) and have no header or footer text (e.g., no page numbers). Proposals for panels should be no longer than five pages and include possible panelists and an indication of which panelists have confirmed participation. Submissions will be handled electronically. Detailed submission instructions can be found at the workshop website (see http://middleware.internet2.edu/pki07/) All submissions will be acknowledged. Submissions of papers must not substantially duplicate work that any of the authors have published elsewhere or have submitted in parallel to any other conferences or journals. Accepted papers will be published in a preproceedings at the workshop and in a final proceedings shortly after the workshop. Deadlines for conference paper and panel submissions are: Papers and Proposals Due: October 22, 2006 Authors Notified: December 18, 2006 Final Materials Due: February 26, 2007 Workshop: April 17-19, 2007 -- Frank Siebenlist franks(a)mcs.anl.gov The Globus Alliance - Argonne National Laboratory

1 0

skype use for next telcon
by Frank Siebenlist 15 Sep '06

15 Sep '06

I've been using Highspeedconferencing.com a couple of times and it worked well. It gave me a personal, permanent telcon number that I can use any time: Skype number is <skype:+99008275780044> If you want to use a regular phone in the US, call *#1-712-432-4000 with Conference Room Number: *5780044* This should all work even without me attending... Regards, Frank. -- Frank Siebenlist franks(a)mcs.anl.gov The Globus Alliance - Argonne National Laboratory

2 2

Mins and charter
by David Chadwick 15 Sep '06

15 Sep '06

Dear WG I have uploaded the revised charter and the minutes of the GGF18 meeting to source forge https://forge.gridforum.org/sf/go/doc13860?nav=1 https://forge.gridforum.org/sf/go/doc13859?nav=1 the charter is open for comments for 2 weeks from today, and if no comments are received it will then be submitted to OGF as the definite version regards David -- ***************************************************************** David W. Chadwick, BSc PhD Professor of Information Systems Security The Computing Laboratory, University of Kent, Canterbury, CT2 7NF Skype Name: davidwchadwick Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick(a)kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://sec.cs.kent.ac.uk Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 *****************************************************************

1 0

Draft notes
by David Chadwick 13 Sep '06

13 Sep '06

Dear All please find attached draft notes of today's meeting. Please send any comments within the next 24 hours, and then I will post them to gridforge regards David -- ***************************************************************** David W. Chadwick, BSc PhD Professor of Information Systems Security The Computing Laboratory, University of Kent, Canterbury, CT2 7NF Skype Name: davidwchadwick Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick(a)kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://sec.cs.kent.ac.uk Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 *****************************************************************

1 0

Updated version of VOMS Specification
by Vincenzo Ciaschini 11 Sep '06

11 Sep '06

Hi to All, This is the updated document about VOMS specification I promised yesterday. Apart from a few minor language clarifications, the main changes are in the following sections: 3.4.1 clarifications about the syntax of FQANs. 3.4.2 rewritten, with a (slight) change in format. 3.5.1 explanation rewritten. The previous explanation was the exact opposite of the truth. OOPS! Also, the AC example in section5 has been substituted with a more complete one. Bye, Vincenzo

5 11

PERMIS AC profile
by David Chadwick 10 Sep '06

10 Sep '06

Dear WG I have just updated the first version of the PERMIS attribute certificate profile. You can find it at https://forge.gridforum.org/sf/go/doc13802?nav=1 regards David -- ***************************************************************** David W. Chadwick, BSc PhD Professor of Information Systems Security The Computing Laboratory, University of Kent, Canterbury, CT2 7NF Skype Name: davidwchadwick Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick(a)kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://sec.cs.kent.ac.uk Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 *****************************************************************

1 0

Minutes of Teleconference 7 Sept
by David Chadwick 10 Sep '06

10 Sep '06

Dear WG the notes from the last telephone conference call on 7 Sept can be downloaded from https://forge.gridforum.org/sf/go/doc13799?nav=1 regards David -- ***************************************************************** David W. Chadwick, BSc PhD Professor of Information Systems Security The Computing Laboratory, University of Kent, Canterbury, CT2 7NF Skype Name: davidwchadwick Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick(a)kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://sec.cs.kent.ac.uk Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 *****************************************************************

1 0