March 2005 - security-area

Trusted Computing: Proposed Research Group
by Andrew Martin 03 May '05

03 May '05

Following the distribution of a draft charter a couple of weeks ago, we held a BOF at GGF13 last week on this proposed new research group. Notes of the meeting, with copies of the presentations, and a draft charter are at the group's temporary web site: http://www.softeng.ox.ac.uk/Andrew.Martin/TC/index.html There appeared to be a fair amount of support, and general interest in at least some of the items in the draft charter. We remain uncertain about whether to include the production of a roadmap document as part of the initial charter or not. Discussion of the charter and the research group's formation is now welcome. Please use this mailing list: if the traffic becomes too high, no doubt a separate list can be created. Best regards Andrew Martin Wenbo Mao

2 2

Fw: [ogsa-wg] Updated telecon schedule table
by Takuya Mori 30 Mar '05

30 Mar '05

Hi, The attached is the dial-in information for the upcoming OGSA conference call. Thanks, Takuya Mori

1 0

[Resend from Takuya] RE: Update on OGSA Basic Profile Security work
by Von Welch 25 Mar '05

25 Mar '05

[Takuya, please sub-scribe to security-area(a)ggf.org if you plan on posting. Thanks, Von ] ------- start of forwarded message ------- To: security-area(a)ggf.org Cc: ogsa-wg(a)gridforum.org Subject: Re: [ogsa-wg] RE: Update on OGSA Basic Profile Security work From: Takuya Mori <mori(a)mcs.anl.gov> Dear All, There is an update on the telecon schedule. I applogize my duplicate, if you guys have already been noticed it. It is proposed to have the Basic Profile sessions 1-3pm ET on Wednesdays. The security related issues is also scheduled in the same time slot on Mar 30th now. If it does not work for you, please let me know it. Thank you, Takuya Mori From: "Hiro Kishimoto" <hiro.kishimoto(a)jp.fujitsu.com> Subject: [ogsa-wg] RE: Update on OGSA Basic Profile Security work Date: Wed, 23 Mar 2005 17:05:37 +0900 > Thanks Dane for your obliging email, > > Certainly OGSA-WG welcomes and requires security experts. > Proposed telecon date is March 30th. If it does not work for > you, April 6th is another option. Please let me know your > preference. > > You can sub-scribe our mailing list; > https://forge.gridforum.org/projects/sourceforge/document/majordomo_help/en… > jordomo_help.doc > http://www-unix.gridforum.org/mail_archive/ogsa-wg/threads.html > > Our Wednesday call is 5-7pm CST. The dial in number is 1-888-452-0308 > or 1-484-644-0505 and the pass code is 71815. > > You can download the latest basic profile draft from; > https://forge.gridforum.org/projects/ogsa-wg/document/draft-ggf-ogsa-basic-… > le/en/3 > > Now we have four open security related issues on this profile; > #1320: Transport and/or Message Level security > MUST or SHOULD?? > #1321: Discovery of key-info for encryption in message level security > Service Group Profile/ EPR embedding > #1322: Use of Proxy Certificates > Standard but not widely adopted outside of grid communit > Time boxed certificates (short lived certs) > #1323: Communication of assertions > Profiles for common assertions in headers or Proxy Certificate > #1324: Separate Security Basic Profile > Should we have a separate profile document for security > > Basic profile tracker is at; > https://forge.gridforum.org/tracker/index.php?group_id=42&atid=780 > > Thanks, > ---- > Hiro Kishimoto > > > > -----Original Message----- > > From: Dane Skow [mailto:dane@fnal.gov] > > Sent: Thursday, March 17, 2005 6:03 PM > > To: security-area(a)ggf.org > > Cc: Ian Foster; Hiro Kishimoto > > Subject: Update on OGSA Basic Profile Security work > > > > As Frank mentioned in the Security Area Meeting, the OGSA Basic Profile > > is now > > being worked intensely toward conclusion. The Working Group has set a > > goal of > > mid April for resolving all the open issues with the current draft. The > > majority of > > the new issues opened this meeting have to do with security. Takuya has > > asked for > > a week to allow the interested parties in the Security Area to read the > > current draft > > and comment on the current open issues (or raise others). This means > > that interested > > parties will need to engage within the next few days to have maximal > > effectiveness. > > I encourage those interested in OGSA to engage on the Basic Profile now. > > > > The response to the question about which use cases from the OGSA use > > case > > document must be supported by the Basic Profile was "all of them". > > However, since > > we will not have a normative spec for WS-Delegation by June, nor do I > > know > > any other credential delegation standard, I suspect there > > was likely a misunderstanding. Takuya will follow up on that question. > > > > I believe Hiro and Ian (chairs of OGSA-WG) > > will second me in saying that input on this document from > > security experts is welcomed and requested. The most effective form > > would be for > > people to join the mailing list and attend the relevant phonecons. The > > next most > > effective is to download and read the current drafts and provide > > comments to the list. > > > > Frank and Takuya have volunteered to try to alert the area about > > relevant phonecons > > and open issues. However, they will not be able to relay > > comments/discussion with this > > short timeline. Interested parties will have to join them directly to > > keep up with the discussion. > > > > Cheers, > > Dane > > ------- end of forwarded message -------

1 0

[Bounce from Hiro] RE: Update on OGSA Basic Profile Security work
by Von Welch 23 Mar '05

23 Mar '05

------- start of forwarded message ------- From: "Hiro Kishimoto" <hiro.kishimoto(a)jp.fujitsu.com> To: "'Dane Skow'" <dane(a)fnal.gov>, <security-area(a)ggf.org> Cc: "'Ian Foster'" <foster(a)mcs.anl.gov>, "'ogsa-wg'" <ogsa-wg(a)gridforum.org> Subject: RE: Update on OGSA Basic Profile Security work Date: Wed, 23 Mar 2005 16:43:47 +0900 Message-ID: <00e301c52f7c$0c60ae40$63e61fac@ORD> Thanks Dane for your obliging email, Certainly OGSA-WG welcomes and requires security experts. Proposed telecon date is March 30th. If it does not work for=20 you, April 6th is another option. Please let me know your=20 preference. You can subscribe our mailing list; https://forge.gridforum.org/projects/sourceforge/document/majordomo_help/= en/1/ma jordomo_help.doc http://www-unix.gridforum.org/mail_archive/ogsa-wg/threads.html Our Wednesday call is 5-7pm CST. The dial in number is 1-888-452-0308 or 1-484-644-0505 and the pass code is 71815. You can download the latest basic profile draft from; https://forge.gridforum.org/projects/ogsa-wg/document/draft-ggf-ogsa-basi= c-profi le/en/3 Now we have four open security related issues on this profile; #1320: Transport and/or Message Level security MUST or SHOULD?? #1321: Discovery of key-info for encryption in message level security Service Group Profile/ EPR embedding #1322: Use of Proxy Certificates Standard but not widely adopted outside of grid communit Time boxed certificates (short lived certs) #1323: Communication of assertions Profiles for common assertions in headers or Proxy Certificate #1324: Separate Security Basic Profile Should we have a separate profile document for security Basic profile tracker is at; https://forge.gridforum.org/tracker/index.php?group_id=3D42&atid=3D780 Thanks, ---- Hiro Kishimoto > -----Original Message----- > From: Dane Skow [mailto:dane@fnal.gov] > Sent: Thursday, March 17, 2005 6:03 PM > To: security-area(a)ggf.org > Cc: Ian Foster; Hiro Kishimoto > Subject: Update on OGSA Basic Profile Security work >=20 > As Frank mentioned in the Security Area Meeting, the OGSA Basic = Profile > is now > being worked intensely toward conclusion. The Working Group has set a > goal of > mid April for resolving all the open issues with the current draft. = The > majority of > the new issues opened this meeting have to do with security. Takuya = has > asked for > a week to allow the interested parties in the Security Area to read = the > current draft > and comment on the current open issues (or raise others). This means > that interested > parties will need to engage within the next few days to have maximal > effectiveness. > I encourage those interested in OGSA to engage on the Basic Profile = now. >=20 > The response to the question about which use cases from the OGSA use > case > document must be supported by the Basic Profile was "all of them". > However, since > we will not have a normative spec for WS-Delegation by June, nor do I > know > any other credential delegation standard, I suspect there > was likely a misunderstanding. Takuya will follow up on that question. >=20 > I believe Hiro and Ian (chairs of OGSA-WG) > will second me in saying that input on this document from > security experts is welcomed and requested. The most effective form > would be for > people to join the mailing list and attend the relevant phonecons. The > next most > effective is to download and read the current drafts and provide > comments to the list. >=20 > Frank and Takuya have volunteered to try to alert the area about > relevant phonecons > and open issues. However, they will not be able to relay > comments/discussion with this > short timeline. Interested parties will have to join them directly to > keep up with the discussion. >=20 > Cheers, > Dane >=20 ------- end of forwarded message -------

1 0

Update on OGSA Basic Profile Security work
by Dane Skow 17 Mar '05

17 Mar '05

As Frank mentioned in the Security Area Meeting, the OGSA Basic Profile is now being worked intensely toward conclusion. The Working Group has set a goal of mid April for resolving all the open issues with the current draft. The majority of the new issues opened this meeting have to do with security. Takuya has asked for a week to allow the interested parties in the Security Area to read the current draft and comment on the current open issues (or raise others). This means that interested parties will need to engage within the next few days to have maximal effectiveness. I encourage those interested in OGSA to engage on the Basic Profile now. The response to the question about which use cases from the OGSA use case document must be supported by the Basic Profile was "all of them". However, since we will not have a normative spec for WS-Delegation by June, nor do I know any other credential delegation standard, I suspect there was likely a misunderstanding. Takuya will follow up on that question. I believe Hiro and Ian (chairs of OGSA-WG) will second me in saying that input on this document from security experts is welcomed and requested. The most effective form would be for people to join the mailing list and attend the relevant phonecons. The next most effective is to download and read the current drafts and provide comments to the list. Frank and Takuya have volunteered to try to alert the area about relevant phonecons and open issues. However, they will not be able to relay comments/discussion with this short timeline. Interested parties will have to join them directly to keep up with the discussion. Cheers, Dane

1 0

Security Area news
by Dane Skow 17 Mar '05

17 Mar '05

For those of you who didn't attend GGF13, I'm happy to report we had a very successful meeting and wish to acknowledge a good amount of work since last Fall. Not only were there several milestone accomplished at the meeting, there was good wireless and plentiful electrical power in every room ;-) Raises the bar for the upcoming meetings. As far as that goes: GGF14 will be in Chicago June 26-29. The datse for GGF15 are now Oct. 15-19, the location yet to be determined, but will be a major city in North America. On the work front, we seem to be very close to completing the OGSA-AuthZ specification documents (WG resolving last comments from WG last call) and there is a team beginning to step forward to talk about the next generation to take account the advances made in SAML v2.0 and XACML v2.0. There was a successful meeting of the GridPMA with agreement to form a Global Federation of 3 regional accreditation groups of CAs. These groups continue to grow and we are in a consolidation phase as Identity Providers globally are forming peer groups to simplify life for the Relying Parties. As more and more grids start interoperating, I expect we'll see more of this kind of thing. We had a number of BOFs this time and you can expect to see some traffic on this list following up on the TrustedComputing, FirewallIssues, and WS-Delegation discussions, with at least 2 of those groups intending to submit charter proposals in the near future. There was a VPN BOF held in the Data area and we are discussing with those organizers and ADs the next steps there. Finally, I'll point to the rapid progress being made in the OGSA Working Group. We discussed how best to contribute to discussions about the security portion of the Basic Profile and I will send a followup message describing the results. All the best from Seoul, Dane

1 0

Re: [security-area] Agenda Firewall Issues BOF - GGF13
by Dane Skow 14 Mar '05

14 Mar '05

FIG comment forwarded for Inder. D > Olle/Leon, > > I agree with the reasoning to add NAT considerations into the BOF. > Though, > when exploring requirements/solutions we should not assume that the > firewall > and NAT functions always are implemented together at points in the > network. > > Inder > > > > > -----Original Message----- > From: owner-security-area(a)ggf.org [mailto:owner-security-area@ggf.org] > On > Behalf Of Leon Gommans > Sent: Thursday, March 10, 2005 3:56 AM > To: Olle Mulmo > Cc: Mike Helm; Mike 'Mike' Jones; john.mccoy(a)pnl.gov; > security-area(a)ggf.org; > chin(a)es.net; schissel(a)fusion.gat.com > Subject: Re: [security-area] Agenda Firewall Issues BOF - GGF13 > > > Olle, > > One way I see that naturally merges the consideration of Firewall and > NAT functions, is to use RFC3303 (middelbox communication architecture > and > framework) as a basis to work from. The work the IETF > currently pursues in this area, such as the NSIS group, also mentions > Firewalls and NAT's in the same breath. From this perspective, > merging NAT's and Firewall considerations sounds a logical idea. > > Thanks for clearifying the scope issue, > > Regards .. Leon. > > > Olle Mulmo wrote: > >> Without implying that we should freeze or postpone any current >> discussions on this topic, NATs are definitely a discussion item at >> the BOF as well, I would say. >> >> I would say that in these discussions, NATs are equally important as >> firewalls, as they both are devices that are "in the way", meddling >> with the network traffic in ways that cause problems for middleware >> and application developers. Identifying (and seeking to rectify?) the >> problems that appear in Grid settings is what this BOF is about. >> >> Side remark: one can claim that NATs are (stupid) firewalls. That can >> be debated endlessly though, and I'm certain the people that build >> "real" firewalls disagree! >> >> /Olle >> >> On Mar 8, 2005, at 20:10, Leon Gommans wrote: >> >>> Mike, >>> >>> Thanks for raising the question. The answer will depend on the >>> charter discussion. Anybody is welcome to comment. >>> >>> This is my personal view: >>> >>> If you look for example the IETF Middlebox work, NATs >>> were part of the charter. >>> >>> An answer may also depend on the outcome of the question >>> if this should be a Research Group or a Working Group. >>> A WG charter needs to be very focussed and >>> our Area Directors may prefer a limited the scope with clearly >>> defined deliverables. The scope may therefore be limited to >>> Firewalls. There is also a BoF that wants to look at VPN's. A RG >>> could pursue a wider range of middlebox services such as mentioned >>> in RFC 3303. >>> >>> Kind regards .. Leon Gommans. >>> >>> >>> >>> Mike 'Mike' Jones wrote: >>> >>> Would it be useful to discuss NAT at the same time as firewalls? >>> >>> I think NAT raises some issues that are similar to firewalls. I'm >>> coming >>> from an AFS in globus2 based grids perspective and have also seen >>> clashes >>> between globus-IO and NAT. >>> >>> I'm afraid I'm not able to goto Korea to stick my hand up and ask the >>> question there, sorry! >>> >>> Cheers, >>> Mike >>> >>> On Tue, 8 Mar 2005, Mike Helm wrote: >>> >>> >>> LG, can you put me on the agenda? I'd like to mention >>> 3 things (provided the material all shows up :^) that >>> might be of interest: some MPLS work at ESnet, a PNNL localhost-based >>> firewall solution that should be grid friendly, and an interesting >>> use-case from Fusion Grid (some have seen this, at last GGF). >>> >>> Thanks, ==mwh >>> Michael Helm >>> ESnet/LBNL >>> >>> >>> >> >> > > > ------_=_NextPart_001_01C52864.CB3191D2 > Content-Type: text/html > Content-Transfer-Encoding: quoted-printable > > <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN"> > <HTML> > <HEAD> > <META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; = > charset=3Dus-ascii"> > <META NAME=3D"Generator" CONTENT=3D"MS Exchange Server version = > 5.5.2658.2"> > <TITLE>RE: [security-area] Agenda Firewall Issues BOF - GGF13</TITLE> > </HEAD> > <BODY> > > > Olle/Leon, > > > I agree with the reasoning to add NAT considerations > = > into the BOF. Though, when exploring requirements/solutions we should = > not assume that the firewall and NAT functions always are implemented = > together at points in the network. > > Inder > > > > > > -----Original Message----- > From: owner-security-area(a)ggf.org [<A = > HREF=3D"mailto:owner-security-area@ggf.org">mailto:owner-security- > area@g= > gf.org</A>] On Behalf Of Leon Gommans > Sent: Thursday, March 10, 2005 3:56 AM > To: Olle Mulmo > Cc: Mike Helm; Mike 'Mike' Jones; = > john.mccoy(a)pnl.gov; security-area(a)ggf.org; chin(a)es.net; = > schissel(a)fusion.gat.com > Subject: Re: [security-area] Agenda Firewall Issues > = > BOF - GGF13 > > > > Olle, > > > One way I see that naturally merges the > consideration = > of Firewall and > NAT functions, is to use RFC3303 (middelbox = > communication architecture and framework) as a basis to work from. The > = > work the IETF > > currently pursues in this area, such as the NSIS = > group, also mentions Firewalls and NAT's in the same breath. From this > = > perspective, > > merging NAT's and Firewall considerations sounds a = > logical idea. > > > Thanks for clearifying the scope issue, > > > Regards .. Leon. > > > > Olle Mulmo wrote: > > > > Without implying that we should freeze or = > postpone any current > > discussions on this topic, NATs are definitely > = > a discussion item at > > the BOF as well, I would say. > > > > I would say that in these discussions, NATs > are = > equally important as > > firewalls, as they both are devices that are = > "in the way", meddling > > with the network traffic in ways that cause = > problems for middleware > > and application developers. Identifying (and = > seeking to rectify?) the > > problems that appear in Grid settings is what = > this BOF is about. > > > > Side remark: one can claim that NATs are = > (stupid) firewalls. That can > > be debated endlessly though, and I'm certain = > the people that build > > "real" firewalls disagree! > > > > /Olle > > > > On Mar 8, 2005, at 20:10, Leon Gommans = > wrote: > > > >>  Mike, > >> > >>  Thanks for raising the question. The > = > answer will depend on  the > >> charter discussion. Anybody is welcome to = > comment. > >> > >>  This is my personal view: > >> > >>  If you look for example the IETF = > Middlebox work, NATs > >>  were part of the charter. > >> > >>  An answer may also depend on the = > outcome of the question > >>  if this should be a Research Group > or = > a Working Group. > >>  A WG charter needs to be very = > focussed and > >>  our Area Directors may prefer a = > limited the scope with  clearly > >> defined deliverables. The scope may = > therefore be limited  to > >> Firewalls. There is also a BoF that wants = > to look at VPN's.  A RG > >> could pursue a wider range of middlebox = > services  such as mentioned > >> in RFC 3303. > >>   > >>  Kind regards .. Leon Gommans. > >> > >>   > >> > >>  Mike 'Mike' Jones wrote: > >> > >> Would it be useful to discuss NAT at the = > same time as firewalls? > >> > >> I think NAT raises some issues that are = > similar to firewalls.  I'm > >> coming > >> from an AFS in globus2 based grids = > perspective and have also seen > >> clashes > >> between globus-IO and NAT. > >> > >> I'm afraid I'm not able to goto Korea to = > stick my hand up and ask the > >> question there, sorry! > >> > >> Cheers, > >> Mike > >> > >> On Tue, 8 Mar 2005, Mike Helm wrote: > >> > >> > >> LG, can you put me on the agenda?  > I'd = > like to mention > >> 3 things (provided the material all shows = > up :^) that > >> might be of interest: some MPLS work at = > ESnet, a PNNL localhost-based > >> firewall solution that should be grid = > friendly, and an interesting > >> use-case from Fusion Grid (some have seen = > this, at last GGF). > >> > >> Thanks, =3D=3Dmwh > >> Michael Helm > >> ESnet/LBNL > >> > >> > >> > > > > > > > </BODY> > </HTML> > ------_=_NextPart_001_01C52864.CB3191D2-- >

1 0

Draft Agenda of TC-BoF at GGF13
by Wenbo Mao 13 Mar '05

13 Mar '05

Hear is a draft agenda of TC-BoF at GGF13. The BoF will be held on Monday or Tuesday am. Time and room will be announced shortly. 1. (10 mins) Introduction and Housekeeping 2. (20 mins) Wenbo Mao, HP Labs Bristol: "Innovations for the Grid Security from the Trusted Computing" -- System behavior conformance and group-oriented security from root of trust from measurement and remote platform attestation 3. (10 mins) Andrew Martin, Oxford University: "Opportunities for using Trusted Computing Platforms with Grid/Web Services" -- Use cases: Climateprediction.net clients, Medical Informatics 4. (20 mins) Hai Jin, Huazhong University of Science and Technology and ChinaGrid: "Security Requirements for ChinaGrid" -- What the current Grid security solutions cannot do 5. (20 mins) Michael Helm, ESnet: DOEGrids: "Trusted Computing vs Certificate Authorities" -- TC-like service in existing CA's Could TC help existing CA's? Can Grid CA's make TC more useful at the end user / server? 6. (30 mins) Charter Discussion Best regards, Wenbo Mao and Andrew Martin -- Dr Wenbo Mao Principal Engineer Tel: +44 (0)117 312 9528 Hewlett-Packard Labs. Fax: +44 (0)117 312 9285 Filton Road, Bristol Email: wenbo.mao(a)hp.com United Kingdom BS34 8QZ http://www.hpl.hp.com/personal/wm

1 1

Life Sciences RG looking for collaboration
by Olle Mulmo 11 Mar '05

11 Mar '05

FYI: The Life Sciences RG will have a workshop on Sunday. The whole health sector have strong requirements on privacy, auditability, data protection, and legal constraints, which current Grids do not adequately address. In case anyone is interested, the LSG-RG have their agenda here: https://forge.gridforum.org/projects/lsg-rg/document/GGF13-Agenda Some of the requirements from their application domain are really application specific. Other requirements touch the heart of our security architecture and provide plenty of opportunity for people to do something useful in those areas. The Life Sciences people would most likely be interested in getting some help on these issues (if nothing else to sort out what's domain specific and not). Initiating discussions across communities might be worthwhile. /Olle

1 0

GGF13 schedule (important changes!)
by Olle Mulmo 10 Mar '05

10 Mar '05

All, There were some unfortunate clashes in the schedules for the security area sessions. Therefore, the CAOPS#1 meeting HAS MOVED to Tuesday. There's an additional clash between CAOPS#2 and the ad-hoc delegation BOF, but nothing could be done about that. We will see if summaries of those sessions can be prepared and presented at the Security area meeting, which follows directly after. Various security related sessions that may be of interest: Monday, March 14: 1pm-2:30pm OGSA-AuthZ, Sapphire 3 5pm-6:30pm Firewall Issues Group BOF, Emerald 1&2 Tuesday, March 15 1pm-2:30pm Town Hall meeting, Crystal 3pm-4:30pm CAOPS#1, Onyx 5pm-6:30pm WS Delegation ADHOC BOF, Sapphire 1 5pm-6:30pm CAOPS#2, Crystal 3 7pm-8:30pm Security Area meeting, Sapphire 2 Wednesday, March 16 11am-12:30pm Grid VPN-RG BOF, Crystal 3 Not yet scheduled: Trusted Computing BOF See you in Seoul, /Olle

1 0