- security-area - lists.ogf.org

GGF-16 coming up
by Olle Mulmo 26 Jan '06

26 Jan '06

All, The detailed program for GGF-16 can now be found at http://www.ggf.org/gf/event_schedule/ We have an interesting agenda lined up, security-wise. "Here and now" is the recurrent theme of this event, and that shows in the workshop program as well, with multi-grid interoperability, authorization here and now, and "Grid meets Shib" on the agenda. The virtualization ad- hoc BOF and the "Security and Privacy needs of Health Grids" sounds very interesting as well. Not to mention our usual RG and WG sessions, of course! On Wednesday, February 15th at 13:30 we have our security area session, for which we would like to take the opportunity to attract your interest with this invited presentation: Title: Microsoft R&D: Distributed Security for Grids Presenter: Mr. Blair Dillaway, Software Architect, Advanced Strategies and Policy Abstract: This talk will present an overview of distributed security work being done at Microsoft that is relevant to problems faced by the Grid community. It will identity the challenging Grid security problems we are focusing on and review Microsoft technologies that provided a foundation for this work. It will then discuss some of the ways the technologies are being evolved and integrated to create more practical and flexible solutions. In addition, we (your ADs) believe that the security area needs to start looking a little bit into the future[*], to make sure that our activities line up well with the new and emerging needs. This will also be discussed at our area meeting. Hope to see many of you there! Olle & Dane [*] Given that we have a guest from Microsoft, perhaps it would be appropriate to dub the area meeting "The Road Ahead". ;-)

2 1

NOMCOM volunteer deadline Nov 26
by Dane Skow 14 Nov '05

14 Nov '05

A reminder to the Area that the deadline for volunteers for NOMCOM is November 26. Since my term as AD expires this year, there is a decision to be made on a Security AD. Since the NOMCOM is the selection mechanism for GFSG members, service on the NOMCOM is an important part of community involvement in GGF and of direct interest to this area. I encourage everyone to consider volunteering. For those of you who would like to help make the decision of who should take the next Security AD term, here's your chance to volunteer. Since NOMCOM members are excluded from consideration as AD, here's also your chance to honorably escape being nominated ;-) Information about NOMCOM is at http://www.ggf.org/nomcom. To volunteer for NOMCOM, send email to Sven van den Berghe <Sven.vandenBerghe(a)uk.fujitsu.com> Regards, Dane

1 0

please review MyProxy protocol specification
by Jim Basney 17 Oct '05

17 Oct '05

Dear GGF Security Area members, At the GGF12 Security Area meeting, it was requested that I submit a specification of the MyProxy protocol to the GGF. I've now done so, and the document has entered a public comment period. I'd appreciate your comments on this short document. The deadline for public comments is November 14. GGF Public Comment page: http://www.ggf.org/ggf_docs_public.htm MyProxy Protocol document: http://www.ggf.org/Public_Comment_Docs/Documents/Oct-2005/draft-ggf-basney-… Forum for public comments: https://forge.gridforum.org/forum/forum.php?forum_id=570 Please submit comments using the GridForge URL above rather than replying to this message. Thanks, Jim > From: "Gregory Newby" <newby(a)arsc.edu> > Date: Mon, 10 Oct 2005 16:58:46 -0800 > To: wg-all(a)ggf.org > Subject: [wg-all] One new document in public comment > > One new document has entered public comment. > > Please visit this link to read the document, view public > comments, and make public comments. Public comments are a > very important part of the standards document process, and > your comments are valuable to authors in improving their > documents. > > Link: http://www.ggf.org/ggf_docs_public.htm > > This Experimental document is in 30-day public comment: > > Title: MyProxy Protocol version 2 > Author/editor: J. Basney > > Abstract: This document describes a protocol for storing and > retrieving X.509 proxy credentials [RFC3820] to and from a > server. The protocol uses proxy delegation [ProxyDelegation] to > transfer credentials without transferring private keys. > > > -- Greg Newby, GGF Editor

1 0

Date: Fri, 14 Oct 2005 08:06:13 -0500
by Von Welch 14 Oct '05

14 Oct '05

This CFP deadline has been extended to October 22nd. Von ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ CALL FOR PAPERS: ** Papers and Proposals Due: October 14, 2005 ** (see below for additional information) 5th Annual PKI R&D Workshop: Making PKI Easy to Use April 4-6, 2006 NIST -- Gaithersburg, MD Website: http://middleware.internet2.edu/pki06/ Registration Fee: $125.00 This workshop considers the full range of public key technology used for security decisions and supporting functionalities, including authentication, authorization, identity (syndication, federation, and aggregation), and trust. This year, the workshop has a particular interest in novel approaches to simplifying the use and management of X.509 digital certificates, both within and across enterprises. This workshop has three goals: 1. Explore the current state of public key technology and emerging trust mechanisms in different domains including web services; grid technologies; encryption functionality; authentication systems, et al., in academia, government and the private sector. 2. Share & discuss lessons learned and scenarios from vendors and practitioners on current deployments. 3. Provide a forum for leading security researchers to explore the issues relevant to the PKI space in areas of security management, identity, trust, policy, authentication, authorization and encryption (e.g., supporting privacy requirements). CALL FOR PAPERS: We solicit papers, case studies, panel proposals, and participation from researchers, systems architects, vendor engineers, and users. Submitted works should address one or more critical areas of inquiry. Topics include (but are not limited to): * Federated versus Non-Federated trust models * Standards related to PKI and security decision systems, such as X.509, SPKI/SDSI, PGP, XKMS, XACML, XRML, XML signatures and SAML * Cryptographic and alternative methods for supporting security decisions, including the characterization and encoding of data * Intersection of assertion-based systems and PKI * Human-Computer Interaction (HCI) advances that improve usability of PKI for users and administrators * Privacy protection and implications * Use of PKI in emerging technologies (i.e., sensor networks) * Scalability of security systems * Security of the components of PKI systems * Security infrastructures for constrained environments * Improved human factor designs for security-related interfaces including authorization and policy management, naming, use of multiple private keys, and selective disclosure * New paradigms in PKI architectures * Reports of real-world experience with the use and deployment of PKI, including the use of digital certificates with major off-the- shelf application programs, how best to integrate such usage into legacy systems, and future research directions. Deadlines for conference paper and panel submissions are: * Papers and Proposals: Due: October 14, 2005 * Authors Notified: December 2, 2005 * Final Materials Due: February 3, 2006 Submissions should be provided electronically, in PDF, for standard US letter-size paper (8.5 x 11 inches). Paper submissions must not exceed 15 pages (single space, two column format with 1" margins using a 10 pt or larger font) and have no header or footer text (e.g., no page numbers). Proposals for panels should be no longer than five pages and include possible panelists and an indication of which panelists have confirmed participation. Please submit the following information to pkichairs(a)internet2.edu: * Name, affiliation, email, phone, postal address for the primary contact author * First name, last name, and affiliation of each co-author * The finished paper in PDF format as an attachment All submissions will be acknowledged. Submissions of papers must not substantially duplicate work that any of the authors have published elsewhere or have submitted in parallel to any other conferences or journals. Accepted papers will be published in a proceedings of the workshop. REGISTRATION The registration fee of $125 per person includes workshop materials, coffee breaks, lunches, and a dinner. There will be no on-site registration. Please pre-register by March 17, 2006 at https:// rproxy.nist.gov/CRS/conf_ext.cfm?conf_id=1491 or by contacting: Teresa Vicente NIST Phone: (301) 975-3883 Fax: (301) 948-2067 email: teresa.vicente(a)nist.gov An agenda will be available in late December at http://middleware.internet2.edu/pki06/ ACCOMMODATIONS A block of rooms has been reserved at the Gaithersburg Hilton, (301) 977-8900, at a special rate of $109, single or double, plus 12% tax. Reservations must be received by March 17, 2006, in order to receive the special rate. Please mention you are attending the "NIST/PKI Workshop".

1 0

Slides from Monday are on-line
by Von Welch 05 Oct '05

05 Oct '05

With many thanks to the GGF webmaster, the slides from the "Leveraging Site Infrastructute for Multi-Site Grids" Community Activity are now all posted: http://www.ggf.org/GGF15/ggf_events_schedule_MultiSite.htm Von

1 0

Important: Security area meeting and BOF have been rescheduled
by Olle Mulmo 05 Oct '05

05 Oct '05

All, - The security area meeting will take place on THURSDAY at 11:00, replacing the Middleware Security BOF (room Whittier) - The Middleware Security BOF will move on WEDNESDAY at 12:30, i.e. during lunch (room St James). Go pick up your lunch bag prior to the meeting starts. See you around, /Olle

3 2

Reminder: Leveraging Site Infrastructute for Multi-Site Grids
by Von Welch 28 Sep '05

28 Sep '05

[Please note this is Monday, not Wednesday.] Community Activity: Leveraging Site Infrastructute for Multi-Site Grids Monday, 03-October 11:00a – 7:30p http://www.ggf.org/GGF15/ggf_events_schedule_MultiSite.htm Tentative Agenda 11:00-11:45 Ken Klingstein "Overview of Campus IT" 11:45-12:30 Arnie Miles "Exposing Computational Resources Across Administrative Domains: Condor Shibboleth Integration" 12:30-2pm Lunch 2:00-2:30 Jim Basney "Integrating MyProxy with Site Authentication" 2:30-3:00 Marty Humphrey "MyProxy integration with Pubcookie" 3:00-3:30 Von Welch "GridShib: Campus/Grid RBAC Integration" 3:30-4pm Coffee Break/GridShib Demo 4:00-4:30 David Chadwick "X.509 Privilege Management Infrastructures for Dynamic Delegation of Authority between Sites" 4:30-5:00 Rana/Wuerthwein "Multi-Site VOs and Multi-VO Sites in Open Science Grid" 5:00-5:30 Tom Barton "Signet and Grouper for Distributed Attribute Administration" 5:30-6:00 Break (Signet/Grouper Demo) 6:00-6:30 Dane Skow "KCA Experiences at Fermilab" 6:30-7:30 Panel Discussion (all presenters; Von Welch moderator) 7:30 Adjourn

1 0

CFP: 5th Annual PKI R&D Workshop: Making PKI Easy to Use
by Von Welch 16 Sep '05

16 Sep '05

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ CALL FOR PAPERS: ** Papers and Proposals Due: October 14, 2005 ** (see below for additional information) 5th Annual PKI R&D Workshop: Making PKI Easy to Use April 4-6, 2006 NIST -- Gaithersburg, MD Website: http://middleware.internet2.edu/pki06/ Registration Fee: $125.00 This workshop considers the full range of public key technology used for security decisions and supporting functionalities, including authentication, authorization, identity (syndication, federation, and aggregation), and trust. This year, the workshop has a particular interest in novel approaches to simplifying the use and management of X.509 digital certificates, both within and across enterprises. This workshop has three goals: 1. Explore the current state of public key technology and emerging trust mechanisms in different domains including web services; grid technologies; encryption functionality; authentication systems, et al., in academia, government and the private sector. 2. Share & discuss lessons learned and scenarios from vendors and practitioners on current deployments. 3. Provide a forum for leading security researchers to explore the issues relevant to the PKI space in areas of security management, identity, trust, policy, authentication, authorization and encryption (e.g., supporting privacy requirements). CALL FOR PAPERS: We solicit papers, case studies, panel proposals, and participation from researchers, systems architects, vendor engineers, and users. Submitted works should address one or more critical areas of inquiry. Topics include (but are not limited to): * Federated versus Non-Federated trust models * Standards related to PKI and security decision systems, such as X.509, SPKI/SDSI, PGP, XKMS, XACML, XRML, XML signatures and SAML * Cryptographic and alternative methods for supporting security decisions, including the characterization and encoding of data * Intersection of assertion-based systems and PKI * Human-Computer Interaction (HCI) advances that improve usability of PKI for users and administrators * Privacy protection and implications * Use of PKI in emerging technologies (i.e., sensor networks) * Scalability of security systems * Security of the components of PKI systems * Security infrastructures for constrained environments * Improved human factor designs for security-related interfaces including authorization and policy management, naming, use of multiple private keys, and selective disclosure * New paradigms in PKI architectures * Reports of real-world experience with the use and deployment of PKI, including the use of digital certificates with major off-the- shelf application programs, how best to integrate such usage into legacy systems, and future research directions. Deadlines for conference paper and panel submissions are: * Papers and Proposals: Due: October 14, 2005 * Authors Notified: December 2, 2005 * Final Materials Due: February 3, 2006 Submissions should be provided electronically, in PDF, for standard US letter-size paper (8.5 x 11 inches). Paper submissions must not exceed 15 pages (single space, two column format with 1" margins using a 10 pt or larger font) and have no header or footer text (e.g., no page numbers). Proposals for panels should be no longer than five pages and include possible panelists and an indication of which panelists have confirmed participation. Please submit the following information to pkichairs(a)internet2.edu: * Name, affiliation, email, phone, postal address for the primary contact author * First name, last name, and affiliation of each co-author * The finished paper in PDF format as an attachment All submissions will be acknowledged. Submissions of papers must not substantially duplicate work that any of the authors have published elsewhere or have submitted in parallel to any other conferences or journals. Accepted papers will be published in a proceedings of the workshop. REGISTRATION The registration fee of $125 per person includes workshop materials, coffee breaks, lunches, and a dinner. There will be no on-site registration. Please pre-register by March 17, 2006 at https:// rproxy.nist.gov/CRS/conf_ext.cfm?conf_id=1491 or by contacting: Teresa Vicente NIST Phone: (301) 975-3883 Fax: (301) 948-2067 email: teresa.vicente(a)nist.gov An agenda will be available in late December at http://middleware.internet2.edu/pki06/ ACCOMMODATIONS A block of rooms has been reserved at the Gaithersburg Hilton, (301) 977-8900, at a special rate of $109, single or double, plus 12% tax. Reservations must be received by March 17, 2006, in order to receive the special rate. Please mention you are attending the "NIST/PKI Workshop".

1 0

Fwd: CFP: GGF-15 Workshop on Site Infrastructure for Multi-Site Grids
by Von Welch 01 Sep '05

01 Sep '05

[Wrong address on first sending - Von] Hello, this is to announce a workshop GGF15 on leveraging site infrastructure for multi-site grids. This results from a number of us wanted to follow up on previous workshops and discussions and an I2 workshop on how Grids could be taking better advantage of existing site infrastructure with a workshop to discussion issues more. Note that we currently have time on the agenda for more speakers if anyone has something to present (see end of announcement for details). Please forward to others who would be interested. Thanks - Von Announcement and Call for Participation GGF15 Workshop: Leveraging Site Infrastructure for Multi-Site Grids Tuesday, October 3rd @ GGF 15 in Boston (11am - 7:30pm) Virtual organizations (VOs) need a variety of information services to provide their structure. For example, it is typical for a Grid to have a certificate authority to provide identity information, an attribute authority to provide information regarding the roles of their users and a resource directory that provides an enumeration of the resources available to the VO. When a VO spans a number of underlying organizations (as opposed to a Grid deployed at a single campus), the best practice today is for the VO to establish their own services to enable its day-to-day functioning. Deploying and operating these services in a security, reliable manner is non- trivial, especially for small to medium virtual organizations, particularly when one considers that these services have a number of security implications in terms of being consulted as part of authorization decisions by end resources. However, there have been some steps in the Grid community to allow for these services to be provided by leveraging and federation the services already provided by the sites on which the VO is based. For example, Fermilab provides a Kerberos CA allowing other sites in a VO to base their Grid authentication on the Kerberos authentication infrastructure already deployed at Fermilab. And campus infrastructures are increasingly deploying outward-facing infrastructure such as Shibboleth, which has several initial efforts focusing on interoperability with existing Grid technologies (Condor and the Globus Toolkit). In this workshop we will explore the how VOs spanning multiple sites can benefit from increased leveraging of the infrastructure of those sites. We will consider both traditional high-performance computing sites as well as other types of institutions such as academic campuses. We will also explore some of the challenges involved in this model, for example: There are no ubiquitous standards for site authentication, attribute, directory, etc. infrastructure. This implies that we need translation mechanisms to achieve interoperability. What translation mechanisms exist today and how well to they work? While some information that sites can provide, such as identifiers for authentication, is generic and can be easily consumed by a VO, the VO may need to define other structure, such as roles for its users, which is not something sites possess today. How can a VO define this information, while still using the site infrastructures to propagate it? Many sites have privacy concerns regarding information about their users. How can sites share information with VOs while addressing these concerns? The workshop plans to produce an informational document capturing the following: List of current success stories for leveraging site infrastructure to form multi-site VOs; Enumeration of existing tools, APIs, standards and technologies for leveraging site infrastructure; Current barriers to leveraging of multiple site infrastructures by VOs. Call for Participation: There is still time on the agenda for several speakers. If you would like to make a presentation related to the above, please send a brief (1-2 paragraph) abstract to Von Welch vwelch(a)ncsa.uiuc.edu by September 9th. If accepted, full slides would be due by September 23rd. Confirmed Speakers: Ken Klingensten (Internet2) – Campus IT Von Welch (NCSA) – Shibboleth and Globus Jim Basney (NCSA) – MyProxy Integration with local Authentication Tom Barton (U. Chicago)– Signet and Grouper for Distributed Attribute Management Arnie Miles (Georgetown U.) – Shibboleth and Condor Workshop organizers: Tom Barton, Jim Basney, Steven Carmody, Ken Klingensten, Arnie Miles, Frank Siebenlist, Von Welch. For the latest agenda, please see: http://www.ggf.org/GGF15/ggf_events_schedule_MultiSite.htm

1 0

Fwd: [ggf-editor | Submit GGF Draft - 1589] MyProxy Protocol version 2
by Olle Mulmo 19 Aug '05

19 Aug '05

All, Please note that we have a first individual submission successfully accepted in the editor pipeline. For those of you interested in following progress more closely, go to https://forge.gridforum.org/tracker/?aid=1589 and select "Monitor" at the top of the page (you may have to log in first). You will then automatically receive notification emails whenever there is a status change or a comment is made. /Olle

1 0