- security-area - lists.ogf.org

Security Area news
by Dane Skow 17 Mar '05

17 Mar '05

For those of you who didn't attend GGF13, I'm happy to report we had a very successful meeting and wish to acknowledge a good amount of work since last Fall. Not only were there several milestone accomplished at the meeting, there was good wireless and plentiful electrical power in every room ;-) Raises the bar for the upcoming meetings. As far as that goes: GGF14 will be in Chicago June 26-29. The datse for GGF15 are now Oct. 15-19, the location yet to be determined, but will be a major city in North America. On the work front, we seem to be very close to completing the OGSA-AuthZ specification documents (WG resolving last comments from WG last call) and there is a team beginning to step forward to talk about the next generation to take account the advances made in SAML v2.0 and XACML v2.0. There was a successful meeting of the GridPMA with agreement to form a Global Federation of 3 regional accreditation groups of CAs. These groups continue to grow and we are in a consolidation phase as Identity Providers globally are forming peer groups to simplify life for the Relying Parties. As more and more grids start interoperating, I expect we'll see more of this kind of thing. We had a number of BOFs this time and you can expect to see some traffic on this list following up on the TrustedComputing, FirewallIssues, and WS-Delegation discussions, with at least 2 of those groups intending to submit charter proposals in the near future. There was a VPN BOF held in the Data area and we are discussing with those organizers and ADs the next steps there. Finally, I'll point to the rapid progress being made in the OGSA Working Group. We discussed how best to contribute to discussions about the security portion of the Basic Profile and I will send a followup message describing the results. All the best from Seoul, Dane

1 0

Re: [security-area] Agenda Firewall Issues BOF - GGF13
by Dane Skow 14 Mar '05

14 Mar '05

FIG comment forwarded for Inder. D > Olle/Leon, > > I agree with the reasoning to add NAT considerations into the BOF. > Though, > when exploring requirements/solutions we should not assume that the > firewall > and NAT functions always are implemented together at points in the > network. > > Inder > > > > > -----Original Message----- > From: owner-security-area(a)ggf.org [mailto:owner-security-area@ggf.org] > On > Behalf Of Leon Gommans > Sent: Thursday, March 10, 2005 3:56 AM > To: Olle Mulmo > Cc: Mike Helm; Mike 'Mike' Jones; john.mccoy(a)pnl.gov; > security-area(a)ggf.org; > chin(a)es.net; schissel(a)fusion.gat.com > Subject: Re: [security-area] Agenda Firewall Issues BOF - GGF13 > > > Olle, > > One way I see that naturally merges the consideration of Firewall and > NAT functions, is to use RFC3303 (middelbox communication architecture > and > framework) as a basis to work from. The work the IETF > currently pursues in this area, such as the NSIS group, also mentions > Firewalls and NAT's in the same breath. From this perspective, > merging NAT's and Firewall considerations sounds a logical idea. > > Thanks for clearifying the scope issue, > > Regards .. Leon. > > > Olle Mulmo wrote: > >> Without implying that we should freeze or postpone any current >> discussions on this topic, NATs are definitely a discussion item at >> the BOF as well, I would say. >> >> I would say that in these discussions, NATs are equally important as >> firewalls, as they both are devices that are "in the way", meddling >> with the network traffic in ways that cause problems for middleware >> and application developers. Identifying (and seeking to rectify?) the >> problems that appear in Grid settings is what this BOF is about. >> >> Side remark: one can claim that NATs are (stupid) firewalls. That can >> be debated endlessly though, and I'm certain the people that build >> "real" firewalls disagree! >> >> /Olle >> >> On Mar 8, 2005, at 20:10, Leon Gommans wrote: >> >>> Mike, >>> >>> Thanks for raising the question. The answer will depend on the >>> charter discussion. Anybody is welcome to comment. >>> >>> This is my personal view: >>> >>> If you look for example the IETF Middlebox work, NATs >>> were part of the charter. >>> >>> An answer may also depend on the outcome of the question >>> if this should be a Research Group or a Working Group. >>> A WG charter needs to be very focussed and >>> our Area Directors may prefer a limited the scope with clearly >>> defined deliverables. The scope may therefore be limited to >>> Firewalls. There is also a BoF that wants to look at VPN's. A RG >>> could pursue a wider range of middlebox services such as mentioned >>> in RFC 3303. >>> >>> Kind regards .. Leon Gommans. >>> >>> >>> >>> Mike 'Mike' Jones wrote: >>> >>> Would it be useful to discuss NAT at the same time as firewalls? >>> >>> I think NAT raises some issues that are similar to firewalls. I'm >>> coming >>> from an AFS in globus2 based grids perspective and have also seen >>> clashes >>> between globus-IO and NAT. >>> >>> I'm afraid I'm not able to goto Korea to stick my hand up and ask the >>> question there, sorry! >>> >>> Cheers, >>> Mike >>> >>> On Tue, 8 Mar 2005, Mike Helm wrote: >>> >>> >>> LG, can you put me on the agenda? I'd like to mention >>> 3 things (provided the material all shows up :^) that >>> might be of interest: some MPLS work at ESnet, a PNNL localhost-based >>> firewall solution that should be grid friendly, and an interesting >>> use-case from Fusion Grid (some have seen this, at last GGF). >>> >>> Thanks, ==mwh >>> Michael Helm >>> ESnet/LBNL >>> >>> >>> >> >> > > > ------_=_NextPart_001_01C52864.CB3191D2 > Content-Type: text/html > Content-Transfer-Encoding: quoted-printable > > <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN"> > <HTML> > <HEAD> > <META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; = > charset=3Dus-ascii"> > <META NAME=3D"Generator" CONTENT=3D"MS Exchange Server version = > 5.5.2658.2"> > <TITLE>RE: [security-area] Agenda Firewall Issues BOF - GGF13</TITLE> > </HEAD> > <BODY> > > > Olle/Leon, > > > I agree with the reasoning to add NAT considerations > = > into the BOF. Though, when exploring requirements/solutions we should = > not assume that the firewall and NAT functions always are implemented = > together at points in the network. > > Inder > > > > > > -----Original Message----- > From: owner-security-area(a)ggf.org [<A = > HREF=3D"mailto:owner-security-area@ggf.org">mailto:owner-security- > area@g= > gf.org</A>] On Behalf Of Leon Gommans > Sent: Thursday, March 10, 2005 3:56 AM > To: Olle Mulmo > Cc: Mike Helm; Mike 'Mike' Jones; = > john.mccoy(a)pnl.gov; security-area(a)ggf.org; chin(a)es.net; = > schissel(a)fusion.gat.com > Subject: Re: [security-area] Agenda Firewall Issues > = > BOF - GGF13 > > > > Olle, > > > One way I see that naturally merges the > consideration = > of Firewall and > NAT functions, is to use RFC3303 (middelbox = > communication architecture and framework) as a basis to work from. The > = > work the IETF > > currently pursues in this area, such as the NSIS = > group, also mentions Firewalls and NAT's in the same breath. From this > = > perspective, > > merging NAT's and Firewall considerations sounds a = > logical idea. > > > Thanks for clearifying the scope issue, > > > Regards .. Leon. > > > > Olle Mulmo wrote: > > > > Without implying that we should freeze or = > postpone any current > > discussions on this topic, NATs are definitely > = > a discussion item at > > the BOF as well, I would say. > > > > I would say that in these discussions, NATs > are = > equally important as > > firewalls, as they both are devices that are = > "in the way", meddling > > with the network traffic in ways that cause = > problems for middleware > > and application developers. Identifying (and = > seeking to rectify?) the > > problems that appear in Grid settings is what = > this BOF is about. > > > > Side remark: one can claim that NATs are = > (stupid) firewalls. That can > > be debated endlessly though, and I'm certain = > the people that build > > "real" firewalls disagree! > > > > /Olle > > > > On Mar 8, 2005, at 20:10, Leon Gommans = > wrote: > > > >>  Mike, > >> > >>  Thanks for raising the question. The > = > answer will depend on  the > >> charter discussion. Anybody is welcome to = > comment. > >> > >>  This is my personal view: > >> > >>  If you look for example the IETF = > Middlebox work, NATs > >>  were part of the charter. > >> > >>  An answer may also depend on the = > outcome of the question > >>  if this should be a Research Group > or = > a Working Group. > >>  A WG charter needs to be very = > focussed and > >>  our Area Directors may prefer a = > limited the scope with  clearly > >> defined deliverables. The scope may = > therefore be limited  to > >> Firewalls. There is also a BoF that wants = > to look at VPN's.  A RG > >> could pursue a wider range of middlebox = > services  such as mentioned > >> in RFC 3303. > >>   > >>  Kind regards .. Leon Gommans. > >> > >>   > >> > >>  Mike 'Mike' Jones wrote: > >> > >> Would it be useful to discuss NAT at the = > same time as firewalls? > >> > >> I think NAT raises some issues that are = > similar to firewalls.  I'm > >> coming > >> from an AFS in globus2 based grids = > perspective and have also seen > >> clashes > >> between globus-IO and NAT. > >> > >> I'm afraid I'm not able to goto Korea to = > stick my hand up and ask the > >> question there, sorry! > >> > >> Cheers, > >> Mike > >> > >> On Tue, 8 Mar 2005, Mike Helm wrote: > >> > >> > >> LG, can you put me on the agenda?  > I'd = > like to mention > >> 3 things (provided the material all shows = > up :^) that > >> might be of interest: some MPLS work at = > ESnet, a PNNL localhost-based > >> firewall solution that should be grid = > friendly, and an interesting > >> use-case from Fusion Grid (some have seen = > this, at last GGF). > >> > >> Thanks, =3D=3Dmwh > >> Michael Helm > >> ESnet/LBNL > >> > >> > >> > > > > > > > </BODY> > </HTML> > ------_=_NextPart_001_01C52864.CB3191D2-- >

1 0

Draft Agenda of TC-BoF at GGF13
by Wenbo Mao 13 Mar '05

13 Mar '05

Hear is a draft agenda of TC-BoF at GGF13. The BoF will be held on Monday or Tuesday am. Time and room will be announced shortly. 1. (10 mins) Introduction and Housekeeping 2. (20 mins) Wenbo Mao, HP Labs Bristol: "Innovations for the Grid Security from the Trusted Computing" -- System behavior conformance and group-oriented security from root of trust from measurement and remote platform attestation 3. (10 mins) Andrew Martin, Oxford University: "Opportunities for using Trusted Computing Platforms with Grid/Web Services" -- Use cases: Climateprediction.net clients, Medical Informatics 4. (20 mins) Hai Jin, Huazhong University of Science and Technology and ChinaGrid: "Security Requirements for ChinaGrid" -- What the current Grid security solutions cannot do 5. (20 mins) Michael Helm, ESnet: DOEGrids: "Trusted Computing vs Certificate Authorities" -- TC-like service in existing CA's Could TC help existing CA's? Can Grid CA's make TC more useful at the end user / server? 6. (30 mins) Charter Discussion Best regards, Wenbo Mao and Andrew Martin -- Dr Wenbo Mao Principal Engineer Tel: +44 (0)117 312 9528 Hewlett-Packard Labs. Fax: +44 (0)117 312 9285 Filton Road, Bristol Email: wenbo.mao(a)hp.com United Kingdom BS34 8QZ http://www.hpl.hp.com/personal/wm

1 1

Life Sciences RG looking for collaboration
by Olle Mulmo 11 Mar '05

11 Mar '05

FYI: The Life Sciences RG will have a workshop on Sunday. The whole health sector have strong requirements on privacy, auditability, data protection, and legal constraints, which current Grids do not adequately address. In case anyone is interested, the LSG-RG have their agenda here: https://forge.gridforum.org/projects/lsg-rg/document/GGF13-Agenda Some of the requirements from their application domain are really application specific. Other requirements touch the heart of our security architecture and provide plenty of opportunity for people to do something useful in those areas. The Life Sciences people would most likely be interested in getting some help on these issues (if nothing else to sort out what's domain specific and not). Initiating discussions across communities might be worthwhile. /Olle

1 0

GGF13 schedule (important changes!)
by Olle Mulmo 10 Mar '05

10 Mar '05

All, There were some unfortunate clashes in the schedules for the security area sessions. Therefore, the CAOPS#1 meeting HAS MOVED to Tuesday. There's an additional clash between CAOPS#2 and the ad-hoc delegation BOF, but nothing could be done about that. We will see if summaries of those sessions can be prepared and presented at the Security area meeting, which follows directly after. Various security related sessions that may be of interest: Monday, March 14: 1pm-2:30pm OGSA-AuthZ, Sapphire 3 5pm-6:30pm Firewall Issues Group BOF, Emerald 1&2 Tuesday, March 15 1pm-2:30pm Town Hall meeting, Crystal 3pm-4:30pm CAOPS#1, Onyx 5pm-6:30pm WS Delegation ADHOC BOF, Sapphire 1 5pm-6:30pm CAOPS#2, Crystal 3 7pm-8:30pm Security Area meeting, Sapphire 2 Wednesday, March 16 11am-12:30pm Grid VPN-RG BOF, Crystal 3 Not yet scheduled: Trusted Computing BOF See you in Seoul, /Olle

1 0

Re: [security-area] Agenda Firewall Issues BOF - GGF13
by Leon Gommans 10 Mar '05

10 Mar '05

Mike, Thanks for raising the question. The answer will depend on the charter discussion. Anybody is welcome to comment. This is my personal view: If you look for example the IETF Middlebox work, NATs were part of the charter. An answer may also depend on the outcome of the question if this should be a Research Group or a Working Group. A WG charter needs to be very focussed and our Area Directors may prefer a limited the scope with clearly defined deliverables. The scope may therefore be limited to Firewalls. There is also a BoF that wants to look at VPN's. A RG could pursue a wider range of middlebox services such as mentioned in RFC 3303. Kind regards .. Leon Gommans. Mike 'Mike' Jones wrote: >Would it be useful to discuss NAT at the same time as firewalls? > >I think NAT raises some issues that are similar to firewalls. I'm coming >from an AFS in globus2 based grids perspective and have also seen clashes >between globus-IO and NAT. > >I'm afraid I'm not able to goto Korea to stick my hand up and ask the >question there, sorry! > >Cheers, >Mike > >On Tue, 8 Mar 2005, Mike Helm wrote: > > > >>LG, can you put me on the agenda? I'd like to mention >>3 things (provided the material all shows up :^) that >>might be of interest: some MPLS work at ESnet, a PNNL localhost-based >>firewall solution that should be grid friendly, and >>an interesting use-case from Fusion Grid (some have seen >>this, at last GGF). >> >>Thanks, ==mwh >>Michael Helm >>ESnet/LBNL >> >> >> > > >

2 2

Announcement of TC BoF in GGF13, SEC Area
by Wenbo Mao 09 Mar '05

09 Mar '05

Dear Colleagues, Upon approval of the SEC Area Chairs Olle Mulmo and Dane Skow, we would like to announce that at GGF13 next week in Seoul there will be a SEC Area BoF session entitled "Trusted Computing for Grid Security". This TC-BoF will be chaird by Wenbo Mao of HP Labs., Bristol and Andrew Martin of Oxford University. Attached is a draft Charter for a Research Group (TC-RG for short) and draft paper providing the background information. There will be another paper to be distributed shortly. The exact time of this TC-BoF session will be available in Seoul to be announced on Sunday evening or Monday morning. We look forward to meeting and discussing with you next week at GGF13. Best regards, Wenbo Mao -- Dr Wenbo Mao Principal Engineer Tel: +44 (0)117 312 9528 Hewlett-Packard Labs. Fax: +44 (0)117 312 9285 Filton Road, Bristol Email: wenbo.mao(a)hp.com United Kingdom BS34 8QZ http://www.hpl.hp.com/personal/wm

2 1

Agenda Firewall Issues BOF - GGF13
by Leon Gommans 09 Mar '05

09 Mar '05

Michael Helm offered to do a small presentation on their firewall related work within ESNET and the FusionGrid project. Please find therefore below the revised agenda of the Security Area Birds of Feather meeting on Firewall Issues: The meeting will be held on Monday 5-6:30PM Emerald room 1&2. 5:00 Agenda bashing, find note-taker, sign-up sheets. 5:05 Introduction: Expressed interest and work already done - Leon Gommans 5:20 Example: Soap Routing Issues - Frank Siebenlist. 5:35 Example: Securing Grid Services - Thijs Metsch. 6:50 Example: ESNET, PNNL and FusionGrid - Micheal Helm. 6:05 Charter discussion. 6:25 Voting on the charter, including decision on RG vs WG. Kind Regards, Inder Monga, Leon Gommans.

1 0

Agenda Firewall Issues BOF - GGF13
by Leon Gommans 08 Mar '05

08 Mar '05

Please find below a more detailed agenda of the Security Area Birds of Feather meeting on Firewall Issues: The meeting will be held on Monday 5-6:30PM Emerald room 1&2. 5:00 Agenda bashing, find note-taker, sign-up sheets. 5:10 Introduction: Expressed interest and work already done - Leon Gommans 5:30 Example: Soap Routing Issues - Frank Siebenlist 5:45 Example: Securing Grid Services - Thijs Metsch 6:00 Charter discussion. 6:25 Voting on the charter, including decision on RG vs WG. Kind Regards, Inder Monga, Leon Gommans.

2 1

Authority Recognition document re-instated into public comment
by Olle Mulmo 01 Mar '05

01 Mar '05

All, Please take some moment of your valuable time and aid in the finalization of the ARRG group by posting a short public comment indicating your like/dislike of their final output. Note: the authors themselves are encouraged to post a comment as well! See http://www.ggf.org/documents/ and the section "Drafts Currently Available for Public Comment". Regards, /Olle Begin forwarded message: > Description: > Final output of the Authority Recognition Resarch Group (ARRG-RG) in > advance of the closure of that group. > ----------------------------------------------------------------- > Comment By: Greg Newby (2005-02-26 13:15:46) > Because there were zero public comments, I do not feel > comfortable that stakeholders in this document have studied > it, and support it. I urge the document authors and WG > members to enter public comments, and to seek others > to enter public comments, that support the readiness > of this document for publication. > > Please email, or post a comment to this tracker, if you > think my impression is erroneous. I recognize that a > stricter outlook on the need for public comments is relatively > new for GGF, but believe it is well supported by the GFSG > and by our own GFD-1. > > Thanks, and sorry for this additional delay. > > ----------------------------------------------------------------- > Comment By: Stacey Giannese (2005-02-25 12:06:19) > This document has now finished its 30 day public comment period. > Comments can be viewed at > https://forge.gridforum.org/forum/forum.php?forum_id=463 > ----------------------------------------------------------------- > Comment By: Stacey Giannese (2005-01-24 08:37:37) > This document will now enter a 30 day public comment period. > > Due date: 2-24-05

1 0