Ian D. Alderman Computer Sciences Department University of Wisconsin-Madison alderman@cs.wisc.edu Condor Week 2007 Signed

  • View
    212

  • Download
    0

Embed Size (px)

Text of Ian D. Alderman Computer Sciences Department University of Wisconsin-Madison alderman@cs.wisc.edu ...

  • Slide 1
  • Ian D. Alderman Computer Sciences Department University of Wisconsin-Madison alderman@cs.wisc.edu http://www.cs.wisc.edu/condor Condor Week 2007 Signed ClassAds and Restricted Delegation
  • Slide 2
  • www.cs.wisc.edu/condor Condor Week 2007 2
  • Slide 3
  • www.cs.wisc.edu/condor Condor Week 2007 3 Multiple administrative domains arent well protected from each other, yet are increasingly common: Condor-C, Condor-G, flocking As cooperation between administrative domains increases, so does utilization. Can we take advantage of this without also increasing risk? Security Issues in Multiple Administrative Domains Job input and output data Execute Machines Data unrelated to the job Protect:
  • Slide 4
  • www.cs.wisc.edu/condor Condor Week 2007 4 Shoulders of Giants Principle of least privilege: Every program and every user of the system should operate using the least set of privileges necessary to complete the job. - Saltzer and Schroeder, 1975
  • Slide 5
  • www.cs.wisc.edu/condor Condor Week 2007 5 Credential Scope Jobs either carry no credentials or the full credentials of the submitting user. Jobs with credentials can impersonate the submitting user without any restriction. Intermediaries that handle credentials can lose or abuse them, or alter tasks, input, and results. Limit the scope of credentials to what the job needs and no more.
  • Slide 6
  • www.cs.wisc.edu/condor Condor Week 2007 6 Goals Make security assumptions explicit. Reduce the number and scope of assumptions that must be made about infrastructure w.r.t. security. Provide end-to-end security options in addition to point-to-point security. Provide end-to-end cryptographic audit. Alter attacker incentives. Reduce barriers to increased cooperation and utilization.
  • Slide 7
  • www.cs.wisc.edu/condor Condor Week 2007 7
  • Slide 8
  • www.cs.wisc.edu/condor Condor Week 2007 8 Framework Overview Signed ClassAds Digital signature applied to a ClassAd: altering invalidates the signature. Task-specific Proxy Certificates GSI proxy certificate with signed ClassAd embedded: links certificate to a particular task. Action Authorization Expressions Expressions within the signed ClassAd limit the usage of the proxy certificate chain.
  • Slide 9
  • www.cs.wisc.edu/condor Condor Week 2007 9 Participants U SXR U submitting user S scheduler X execute host R storage resource
  • Slide 10
  • www.cs.wisc.edu/condor Condor Week 2007 10 Actions U SXR U submitting user S scheduler X execute host R storage resource s - submit f - forward e - execute a - access sea
  • Slide 11
  • www.cs.wisc.edu/condor Condor Week 2007 11 Forwarding Action U S s - submit f - forward e - execute a - access SXR s ea U submitting user S scheduler X execute host R storage resource f
  • Slide 12
  • www.cs.wisc.edu/condor Condor Week 2007 12 Multiple Administrative Domains U S U submitting user S scheduler X execute host R storage resource SXR s - submit f - forward e - execute a - access s ea f R
  • Slide 13
  • www.cs.wisc.edu/condor Condor Week 2007 13 Authentication U S U submitting user S scheduler X execute host R storage resource SXR s - submit f - forward e - execute a - access s ea f GSI Proxy Certificates Mutual Authentication /O=Brown CS/CN=pavlo /O=Brown CS/CN=scheduler.cs.brown.edu/O=Penn CS/CN=scheduler.cs.penn.edu/O=UMD CS/CN=storage.cs.umd.edu/O=Penn CS/CN=ex0001.cs.penn.edu
  • Slide 14
  • www.cs.wisc.edu/condor Condor Week 2007 14 Authorization U S U submitting user S scheduler X execute host R storage resource SXR s - submit f - forward e - execute a - access s ea f /O=Brown CS/CN=pavlo -> pavlo@cs.brown.edu Recipient checks ACL
  • Slide 15
  • www.cs.wisc.edu/condor Condor Week 2007 15 Problems Authorization entirely in the hands of the recipients: no restrictions can be expressed by the submitter. Credential too permissive: can be used to access anything on resources, run any job on execute machine. Unnecessary reliance on schedulers to preserve confidentiality and integrity of credentials. No audit trail.
  • Slide 16
  • www.cs.wisc.edu/condor Condor Week 2007 16 Attackers Incentive to attack schedulers; compromise results in full control: Alter tasks (to attack execute hosts or cause them to attack external hosts). Access resources using credentials. Forge results returned to submitter.
  • Slide 17
  • www.cs.wisc.edu/condor Condor Week 2007 17 Framework Overview Signed ClassAds Digital signature applied to a ClassAd: altering invalidates the signature. Task-specific Proxy Certificates GSI proxy certificate with signed ClassAd embedded: links certificate to a particular task. Action Authorization Expressions Expressions within the signed ClassAd limit the usage of the proxy certificate chain.
  • Slide 18
  • www.cs.wisc.edu/condor Condor Week 2007 18 Signed ClassAds ClassAds with digital signatures. Signature made and checked using X.509 keys and certificates. Altered ClassAds are easily detected. External files can be referenced using checksums. Explicit association between a task and information about its origin and provenance. Results can be signed as well: receipts.
  • Slide 19
  • www.cs.wisc.edu/condor Condor Week 2007 19 Task-specific Proxy Certificates Proxy certificates with embedded signed ClassAds. Policy field in proxy certificate contains signed ClassAd for the associated job. Proxy delegation chain inalterably linked with particular job. TS
  • Slide 20
  • www.cs.wisc.edu/condor Condor Week 2007 20 Action Authorization Expressions ClassAd language expressions included in the signed ClassAd. Can specify conditions on actions that the proxy certificate might be used for: submit, forwarding, execute, and access. Permits the submitting user to limit how their credentials are used.
  • Slide 21
  • www.cs.wisc.edu/condor Condor Week 2007 21 U= /O=Brown CS/CN=pavlo Sa= /O=Brown CS/CN=sche Sb= /O=Penn CS/CN=sche f(U, Sa, Sb) Mutual Authorization U S U submitting user S scheduler X execute host R storage resource SXR s - submit f - forward e - execute a - access s ea f U= /O=Brown CS/CN=pavlo S= /O=Brown CS/CN=sche s(U,S) /O=Brown CS/CN=pavlo /O=Brown CS/CN=scheduler.cs.brown.edu/O=Penn CS/CN=scheduler.cs.penn.edu/O=UMD CS/CN=storage.cs.umd.edu/O=Penn CS/CN=ex0001.cs.penn.edu U= /O=Brown CS/CN=pavlo S= /O=Penn CS/CN=sche X= /O=Penn CS/CN=ex0001 e(U, S, X) U= /O=Brown CS/CN=pavlo X= /O=Penn CS/CN=ex0001 R= /O=UMD CS/CN=storage a(U, X R)
  • Slide 22
  • www.cs.wisc.edu/condor Questions? For more information, contact: Ian Alderman alderman@cs.wisc.edu

Related documents