- ogsa-authz-wg - lists.ogf.org

CFP: Workshop on Virtualization Technologies in Distributed Computing
by Frank Siebenlist 13 Jul '06

13 Jul '06

FYI. Note that there are some very interesting and challenging security aspects of using virtualization in distributed/grid environments. Regards, Frank. =============================================================== CALL FOR PAPERS (VTDC 2006) Workshop on Virtualization Technologies in Distributed Computing held in conjunction with SC 06, the International Conference for High Performance Computing, Networking and Storage. =============================================================== date: November 11, 2006, Tampa, Florida, USA SC 06: http://sc06.supercomputing.org/ VTDC 06: http://workspace.globus.org/vtdc06/ General Information The convergence of virtualization technologies and distributed computing is an exciting development and the subject of much research in both academia and industry. The VTDC workshop is intended to be a forum for the exchange of ideas and experiences on the use of virtualization technologies in distributed computing, the challenges and opportunities offered by the development of virtual systems themselves, as well as case studies of application of virtualization. The scope of “virtualization technologies” includes techniques and concepts to enable virtual machines, virtual networks, virtual data, virtual storage, virtual applications and virtual instruments. The scope of “distributed computing” includes Grid-computing, cluster computing, peer-to-peer computing and mobile computing. The workshop program will include presentations of peer-reviewed papers as well as a panel with participants from academia and industry. The proceedings of VTDC 2006 will be published in the IEEE Computer Society's Digital Library. VTDC 2006 topics of interest include, but are not limited to: • Using virtualization technologies for resource management and QoS assurance • Security aspects of using virtualization in a distributed environment • Virtual networks • Virtual data and storage systems • Fault tolerance in virtualization • Virtualization in P2P • Monitoring techniques in virtualization • Virtualization-based adaptive/autonomic systems • Virtual datacenters • Virtual environment factories and services • Environment configuration • Virtual machine management • Modeling (applications and systems) • Case studies of applications using virtual technologies • Deployment studies of virtualization technologies • Tools relevant to virtualization Paper Submission Authors are invited to submit original and unpublished work that exposes a new problem, advocates a specific solution, or reports on actual experience. Papers should be submitted as full-length 8 page papers of double column text using single spaces 10pt size type on an 8.5’’x11’’ paper, as per IEEE manuscript guidelines. Paper submission instructions will be placed on the workshop web page at http://workspace.globus.org/vtdc06. Presentations will be invited based on the originality, technical merit, and topical relevance of their submissions. Please contact vtdc06(a)mcs.anl.gov with questions. Important dates August 25, 2006 – Paper submission September 29, 2006 – Notification of acceptance October 27, 2006 – Final version due Program Chairs General Chair: Jose Fortes, University of Florida Program Chair: Kate Keahey, Argonne National Laboratory Program Committee Rob Carpenter, Intel Peter Dinda, Northwestern University Renato Figueiredo, University of Florida Marc Fiuczynski, Princeton University Ian Foster, University of Chicago Rob Gardner, HP Sebastian Goasguen, Purdue University Sverre Jarp, CERN Kevin Lai, HP Jose Moreira, IBM Ralf Ratering, Intel Frank Siebenlist, Argonne National Laboratory Dongyan Xu, Purdue University Mazin Yousif, Intel -- Frank Siebenlist franks(a)mcs.anl.gov The Globus Alliance - Argonne National Laboratory

1 0

Update on Progress
by David Chadwick 08 Jul '06

08 Jul '06

Dear WG I have just updated a revised version of the charter to the web site. You can find it at http://forge.gridforum.org/sf/go/doc13647?nav=1 I have also input the minutes of the last meeting. You can find them at http://forge.gridforum.org/sf/docman/do/listDocuments/projects.ogsa-authz/d… Finally, I have created a WG wiki, the first section of which is one in which user groups can add their Authz requirements. You can find this at http://forge.gridforum.org/sf/wiki/do/viewPage/projects.ogsa-authz/wiki/Hom… Please tell all your user groups to use this so that we can rapidly collect together all their authz requirements If you look at the revised charter we are in pretty good shape for having the first drafts of most of our deliverables ready for the next meeting in September. Von and I plan to restart the teleconferences again soon. We lost momentum after the last meeting when the first teleconference was missed and we all fell out of sync as a result. This doesn't mean that work wasn't going on in the background, but rather that it just wasn't visible to the group. We will contact you again within the week to give you a date and time of the next teleconference. In the meantime, if you have any comments on the revised charter, please send them to the list regards David ***************************************************************** David W. Chadwick, BSc PhD Professor of Information Systems Security The Computing Laboratory, University of Kent, Canterbury, CT2 7NF Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick(a)kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://sec.cs.kent.ac.uk Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 *****************************************************************

1 0

Minutes from yesterday's meeting
by David Chadwick 11 May '06

11 May '06

Dear Authz members please find attached the minutes from yesterdays meeting. A big thankyou to Nate for doing these David -- ***************************************************************** David W. Chadwick, BSc PhD Professor of Information Systems Security The Computing Laboratory, University of Kent, Canterbury, CT2 7NF Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick(a)kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://sec.cs.kent.ac.uk Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 ***************************************************************** Notes of GGF 17 OGSA Authz meeting, 10 May 2006 AGENDA Admin (scribe, note well etc.) Update of progress since last meeting Report of 2 recent telephone conferences Views about proposed revised charter Continue discussions on 2 draft protocol IDs Date of next telephone conference AOB Significant progress has been made since the last GGF meeting. The Charter has been revised and there's been some inconclusive discussion about it on this list. Two ID's have been published, PDP and CVS protocol specs. In addition there has been two long telephone conferences (minutes have been sent to the list). The first phone conference suggested that the charter should be slimmed down dramatically and should only fit the work we can do ie. produce documents that we have editors for. The phone conf suggested 3 docs: 1. Java interface for plugging different authorization functions (PDP, PIP, etc.) into an Apache Axis-based Grid Services runtime. The GT team have volunteered to edit this. 2. Two protocol IDs for the next generation Authz protocol(s) to replace the current SAML one. Editors David Chadwick et al; First is a protocol to interact with an XACML PDP, the second is WS-Trust interaction with a credential validation service. SAML assertions are not deprecated; instead, they are imbedded within XACML, and returned by WS-Trust. 3. Third is an authz scenarios and requirements document which needs an editor. None was forthcoming during the meeting itself. New Charter will be republished shortly and will be ready for discussion at the telephone conference in two weeks. Are the protocol Drafts true specifications, or are they either descriptions of current implementation or what future implementations should look like? Ans. They are primarily Profiles of current standards. The telecom and meeting agreed that we should generalize the authz protocols to allow the functional components to talk to each other in different configurations. That would be of much more interest to Internet2 and MSFT. Should we build on XACMLv2 or V3, since v3 isn't stable yet. XACMLv3 offers true delegation of policies and partial rights, but we're not sure whether that's much of a requirement at the present time because you can delegate attributes that are built into the XACML expression. A canvas of requirements in deployments would be important here to assess full delegation requirements at present. David Chadwick's team have reported a problem to the XACML committee that the interface is for synchronous requests only. Anne Anderson has said that the XACML group will to look at this issue and the various solutions to it. Can an XACML PDP's act as credential verification services? If the PDP could be asked in an XACML format whether a given credential were valid or not, then there could be a flattening of the space. We don't know whether XACML has the full range of functionality required of a credential validation service, since that wasn't a primary goal in its design. Architecturally, there's no need to separate this functionality; this is an implementation-time choice. The list of requirements for a CVS isn't part of the deliverables yet. It was agreed that understanding of what will be required from a CVS will dictate what the other deliverables will be. David agreed to circulate a copy of this list of draft functional requirements to the group for comment and further contributions. Olle mentioned the importance of having a framework approach and a profiling of the framework. Instead, we're looking at specific versions of specific technologies. Maybe they should be separated. David agreed to separate out the functional components diagram into a separate document to be a separate deliverable of the group, and to show the different ways in which the components can be architected together.vThe variety of potential groupings should be discussed and understood especially in light of the effect they will have on the protocols. Olle believes we really need a requirement doc; if the barrier to doing so is the amount of effort that would be poured into producing a GGF document, then instead we can have a more lightweight mechanism. Olle suggested that if a wiki was provided then many people might contribute their requirements into it. Alternatively, each protocol doc could imbed the requirements in the documents itself. It may be desirable for the many legacy authz monoliths that we have in place to be able to define a simple new service and be "future-proof". In some ways, the monolith call out is simpler for the application as well. Next telecon is Tuesday 23 May, 4pm European time, 3pm UK time, 10am Eastern, 7am Pacific and 11pm Japan. Frank Siebenlist will set it up The meeting ended at noon.

1 0

Minutes of teleconference 9 May
by David Chadwick 10 May '06

10 May '06

Dear All please definately find attached the minutes of yesterday's teleconference !! regards David -- ***************************************************************** David W. Chadwick, BSc PhD Professor of Information Systems Security The Computing Laboratory, University of Kent, Canterbury, CT2 7NF Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick(a)kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://sec.cs.kent.ac.uk Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 *****************************************************************

1 0

Minutes of teleconference 9 May
by David Chadwick 10 May '06

10 May '06

Dear All please find attached the minutes of yesterday's teleconference regards David -- ***************************************************************** David W. Chadwick, BSc PhD Professor of Information Systems Security The Computing Laboratory, University of Kent, Canterbury, CT2 7NF Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick(a)kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://sec.cs.kent.ac.uk Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 *****************************************************************

1 0

telcon: New charter and WS-TRUST/SAML profile discussion
by Frank Siebenlist 09 May '06

09 May '06

Dear all, We would like to setup a telcon to discuss the new charter and WS-TRUST/SAML profile documents that David has sent out to the list. The best time that David and I came up with is next Tuesday Apr 25 at 7am PST - 11pm Tokyo/Seoul - 3pm Amsterdam ... Unless I hear too many objection concerning the time, I'll arrange for a US-local telcon number in a few days. Regards, Frank. -- Frank Siebenlist franks(a)mcs.anl.gov The Globus Alliance - Argonne National Laboratory

2 3

Re: [OGSA-AUTHZ] Vincenzo's VOMS document?
by Mary Thompson 27 Apr '06

27 Apr '06

I'm with Von. Let's get it out there. I finally read it and made a few suggestions to Vincenzo. It describes an existing and widely used system so it seems to me we should not delay its publication any longer. Mary -- --------------------------------------------------------------------- Mary R. Thompson <MRThompson(a)lbl.gov> Secure Grid Technologies Group (510) 486-7408 Lawrence Berkeley National Lab http://dsd.lbl.gov/~mrt ----------------------------------------------------------------------

2 1

Minutes of Teleconference
by David Chadwick 27 Apr '06

27 Apr '06

Dear All please find attached the minutes of the teleconference call we had on 25 April The next call is scheduled for Tuesday 9 May. Frank will send out details nearer the date regards David -- ***************************************************************** David W. Chadwick, BSc PhD Professor of Information Systems Security The Computing Laboratory, University of Kent, Canterbury, CT2 7NF Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick(a)kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://sec.cs.kent.ac.uk Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 *****************************************************************

1 0

Revised Charter
by David Chadwick 25 Apr '06

25 Apr '06

Dear authz members please find attached an updated version of the charter for ratification at the next GGF meeting. If you have any comments on this charter please raise them on the list or at the next meeting in Tokyo, where I hope to get it ratified. Finally, can I ask for volunteers to start work on the authorisation scenarios and use cases document. There must be many of you on the list who already have great experience of implementing or integrating authorisation mechanisms into your grid applications and know the scenarios that you are working with, and the authorisation features that you require. So it should not be difficult for you to write these down on one or two sides of A4. I am happy to act as editor and to coordinate your input into the GGF output document. I look forward to seeing you in Tokyo regards David -- ***************************************************************** David W. Chadwick, BSc PhD Professor of Information Systems Security The Computing Laboratory, University of Kent, Canterbury, CT2 7NF Tel: +44 1227 82 3221 Fax +44 1227 762 811 Mobile: +44 77 96 44 7184 Email: D.W.Chadwick(a)kent.ac.uk Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html Research Web site: http://sec.cs.kent.ac.uk Entrust key validation string: MLJ9-DU5T-HV8J PGP Key ID is 0xBC238DE5 *****************************************************************

4 7

Vincenzo's VOMS document?
by Olle Mulmo 24 Apr '06

24 Apr '06

All, I'm curious as to Vincenzo's informational write-up on VOMS, submitted to the group on February 13. VOMS is used in a number of production grids today. It is the basis for interoperating authorization in the GIN effort. Having a solid write-up on its internals and semantics would most certainly be welcome. Question: how should this be handled? I can see it go multiple ways: 1. The document goes into public comment as an individual submission more or less as is 2. This group makes a round of editing on it first and then do a 2- week last call on the list before the public comment 3. This group includes the document it in the revised charter as another deliverable While the current document seems rather complete, I include 3. as an option anyhow as there are additional things to think of: for instance, a SAML wrapping of the attributes instead of/in addition to the current X.509 attribute certificate format. If we want such a thing (and I think we do), this would in turn advocate for a separation between the definition and the semantics of the attributes, and the packaging/delivery mechanisms of those attributes. Regards, /Olle

4 3