untitled

Size: px

Start display at page:

Download "untitled"

つかさいざわ
5 years ago
Views:

1 PKI NEC 1 Agenda Grid Computing Globus Tool Kit GGF GSI(Proxy Cert), GRAM, MDS OGSA OGSA OGSA-Security MyProxy / VOMS MyProxy VOMS NAREGI NAREGI NAREGI CA NAREGI CA AP Grid PMA 2 1

2 Grid Computing 3 Grid Computing Computing PC HPC High Performance Computing 4 2

3 HPC High Performance Computing PC Globus Tool Kit PC PC Personal Computer PC P2P SETI home Cell Computing PC 5 DB IBM OracleOGSA-DAI Open Grid Services Architecture Data Access and Integration 6 3

4 MPI PC PC OGSA WEB -MPICH -SCORE -PVM etc.. - Globus -MPICH-G2 -Ninf-G etc.. - Globus - Web Service etc.. 7 Globus Tool Kit 8 4

Globus Tool Kit GGF GGF Global Grid Forum GGF 2000 11 GGF 13 WG RG Standards Function Groups Infrastructore Data Compute Architecture Applications Management Security Liaison Community Function

5 Globus Tool Kit GGF GGF Global Grid Forum GGF GGF 13 WG RG Standards Function Groups Infrastructore Data Compute Architecture Applications Management Security Liaison Community Function Groups Research Applications Industry Applications Grid Operations Technology Innovators Community Affairs 9 Globus Tool Kit Globus Tool Kit IBM etc PC Globus Tool Kit 2.x GT2 GGF OGSA Open Grid Services Architecture Globus Tool Kit 4 GT4 GT4 10 5

6 Globus Tool Kit GT2 Application / Grid Portal High Level Middleware Cactus MPICH-G2 Condor-G globusrun NetSolve Ninf-G Low Level Middleware GridFTP (FTP) MDS (LDAP) GSI () GRAM (HTTP) OS, Platforms Hardware UNIX Windows 11 Globus Tool Kit GSI (GT2) GSI(Grid Security Infrastructure) Grid SSL Proxy Cert 12 6

7 Globus Tool Kit GSI (GT2) Proxy Cert Proxy Cert Sub-CA Proxy Cert 12 SSOSSL Scheduler (gatekeeper) A SSL B Proxy Cert & C Proxy Cert & SSL gatekeeper 13 Globus Tool Kit GRAM (GT2) GRAM(Grid Resource Allocation Manager) gatekeeper jobmanager grid-proxy-init & globusrun SSL Job Job gatekeeper jobmanager grid-mapfile DN Local ID fork(), LSF, MPICH, etc 14 7

8 Globus Tool Kit MDS (GT2) MDS(Monitoring and Discovery Service) Information Provider, GRIS:Grid Resource Information Service GIIS:Grid Index Information Service GIIS LDAP Server Job Or LDAP GRIS LDAP Server GRIS LDAP Server Information Provider Information Provider 15 Globus Tool Kit GridFTP (GT2) GridFTP FTP SSL Grid GASS Global Access to Secondary Storage HTTP GRAM 16 8

9 Globus Tool Kit PC MPI Message Passign Interface MPIMPICH-G2 Globus MPICH-G2 PC Globus Toolkit MPICH-G2 master PC slave PC 17 Globus Tool Kit PC MPI Message Passign Interface MPIMPICH-G2 MPI mpicc master PC slave PC master slave PC PC 18 9

10 Globus Tool Kit PC MPI Message Passign Interface MPIMPICH-G2 MPI PC grid-proxy-init & mpirun SSL gatekeeper gatekeeper PC Delegate & Single Sign On PC 19 OGSA 20 10

11 OGSA OGSA OGSA(Open Grid Services Architecture) GGF4 IBM SOAP WSDL WEB OGSAOGSI Open Grid Services Infrastructure Globus Tool Kit 3.x GT3 UNICORE OGSA Globus Tool Kit 4.x GT4OGSI WSRF Web Service Resource Framework 21 OGSA Service Groups and Discovery Service Domain Security Policy Data Management Message & Queuing Event Distributed Logging Metering and Accounting Administration Transaction Grid Service Orchestration OGSA 22 11

12 OGSA OGSI WSRF OGSI 1 Web WSDL1.1 OGSI WSRF Web 23 OGSA WS-Resource Resource Home Client call.invoke() SOAP Service Resource/ UserService.method() Resource Object Object Web WS-Resource GT4 Container Stateful Resource (Object) 24 12

13 OGSA Security OGSA-Security OGSAWeb WS-Security WS-Security XML Signature XML Encryption SOAP XML SSL SOAP / HTTP RPC WS-Security ( ) OGSA 25 OGSA WS-Security Security WS-Secure Conversation WS-Policy WS-Federation WS-Trust WS-Security WS-Authorization () WS-Privacy () SOAP WS-Security WS-SecureConversation WS-Trust WS-Policy WS-Federation WS-Security,WS-Policy,WS-Trust, WS-Secure Conversation WS-Authorization WS-Privacy Web 26 13

14 OGSA Single Sign On OGSA-Security Single Sign On Web SAML PKI SSO WS-Security SOAP PKI SOAP SAML Authentication-Authority XKMS X-KISS XKMSX-KRSS X-KISS 27 OGSA Secure Grid Computing RA Server SAML CA Server LCMP XKMS (X-KRSS) SSO XKMS (X-KISS) Authentication Authority Attribute Authority VO Policy Decision Point XACML SOAP / HTTP RPC WS-Security ( ) WSRF, OGSA Factory (scheduler) WSRF, OGSA CPU Resource WSRF, OGSA Grid DATA Resource 28 14

15 OGSA GT4 Client Java Client C Client Python Client Java Client C Client Python Client Web Service SOAP messaging X.509 Java Service GRAM RFT Delegation Index Trigger Archiver CAS OGSA-DAI GTCP Python Service pyglobus WS Core C Service C WS Core GridFTP SimpleCA MyProxy RLS Pre-WS GRAM Pre-WS MDS Server Apache Axis Java Service GT Python GT C 29 OGSA GT4 WS-Security Handler Security Policy Handler Authorization Handler Client Secure Conversation Handler Secure Message Handler WS-Resource Service () GSI Secure Conversation Service Secure Secure Context Resource GT4 Container 30 15

16 OGSA GT4 Security Message-level Security with X.509 Credentials Message-level Security with ID/Password Transport-level Security with X.509 Credential Authorization SAML and grid-mapfile grid-mapfile grid-mapfile Delegation X.509 Proxy Cert WS-Trust X.509 Proxy Cert WS-Trust Authentication Message Protection Message format X.509 End Entity Certificate WS-Security WS-SecureConversation SOAP Username/ Password WS-Security SOAP X.509 End Entity Certificate TLS (HTTPS) SOAP Supported, But Slow Supported, But insecure Fastest, So default / (msec) (msec) GetRP() GT4 Java GetRP() GT4 C OGSA GT4 Security Authz Callout : SAML, XACML SSL / WS-Security With Proxy Certificate Access Services Grid Compute Center Local policy on VO identity or Attribute Authority CAS or VOMS issuing SAML or X.509 ACs VO MyProxy CA 32 16

17 MyProxy / VOMS 33 MyProxy MyProxy 2002 Proxy GlobusJOB(delegation) Proxy JOB MyProxy Ver3.2 Proxy CA Proxy Kerberos, PAM, LDAP, SASL, OneTime Passowrds 34 17

18 MyProxy Server MyProxy Proxy Cert myproxy-init UID,Pass myproxy-logon ( myproxy-get-delegation) UID,Pass User Client login Proxy Cert Web Portal Site SSL JOB GateKeeper GridFTP Globus Grid Site myproxy-init MyProxyServer ProxyCert(UID,Password) PortalSite login myproxy-get-delegation UID,Password ProxyCert ProxyCert Globus GridSite 35 grid-proxy proxy-init Proxy Proxy Public_A Public_B Public_B Private A Private B Private B Public_A Chain 36 18

19 myproxy-init MyProxy Proxy Public_B Private_B Public C Private C Private B Public_A Public C Public_C CSR CSR Public C DelegationProxy Public_C Public_C Proxy A B) Private C Public_B Public_A chain 37 ( ) myproxy-logon MyProxy Public D Private_C Proxy Public_C Private D CSR Public D Public D Private C DelegationProxy Public_D Public_D Public_B Public_A Private D chain Public_C Public_B Public_A Public_D Proxy A B C) 38 19

20 VO (Virtual Organization) VO IT. OGSA VO IT Real Organization ID Federation Virtual Organization Virtual Organization Virtual Organization Real Organization Real Organization PKI Real Organization PKI EE 39 OGSA Security Architecture VO VO VO VO ( ) 1 VO IT 1 () VO 40 20

21 OGSA Security Architecture VO Policy Management VO VO Policy Service Specification 1 OGSA VO Push Pull VO VO 41 Functional Capabilities Hypothetical OGSA version 2.0 documents schedule Security Services :WG draft publication GGF17( 06/6) Credential Validation Services Authentication Trust Services Identity Mapping Attribute Services Bridge/ Translation Services Credential Conversion Authorization Services VO Policy Audit/Source- Logging Services Privacy Services The Open Grid Services Architecture, Version

22 VOMS VOMSEU-DataGrid Project VOVirtual Organization Membersip Service VO voms-proxy-init VOMS Proxy VOProxy X.509v3 43 CA/RA VOMS Server VOMS Server VO VO User cert. voms-proxy-init voms VO MyProxy Data GVS PSE WFT myproxyinit getdelegation MyProxy+ Proxy (User, Gridmap {VO, roles, groups}) Gridmap DataGrid VO VO VO WS GRAM Super Scheduler Agreement GridVM Local Scheduler Information Service User VO VO UsageRecords (GlobalUserName User, VO ) 44 O 2 22

23 NAREGI 45 NAREGI ( National Research Grid Initiative)

24 NAREGI Grid Grid NII,IMS Tflops SINET 24

25 NAREGI-CA NAREGI-CANAREGI(National Research Grid Initiative) CA 2004 NAREGI 2000 CA CA CP/CPS 49 NAREGI-CA VO UI Web UI LCMP RA: Web(Java API) AICA CP/CPS ) ( ) NAS(NAREGI AUTHENTICATION SERVICE) NW Infrastructure PMA

26 NAREGI-CA CA Server LDAP Server aicrlpub aicad LDAP LCMP RA Server aienroll airad enroll (apache CGI) LCMP Grid Web etc HTTP certreq WEB LCMP CA management tools aica PKI utilities certview certconv CA NaReGi 51 NAREGI-CA NAREGI CA ID ID ID 52 26

27 27 53 ID ID ID ID CA Web NAREGI ID ID 54 ID ID URL ID 18 ID hrep0d73nsuw71lfke zzz BBB : : AAA xxx.jp ksm8etq7p2lmdje0su XXX AAA : : : ID DB ( ID ID )

28 Web IE ID ID ID CA IE CA HTTPS SSL ID ID ID 18 NAREGI Web CA ID 55 IE SSL IE SSL NAREGI Web CA 56 28

29 ID 57 APGrid PMA AP Grid PMAAsia Pacific Grid Policy Management Authority Web: Australia, China, Hong Kong, India, Japan, Korea, Malaysia, Singapore, Taiwan, USA CA KISTI, AIST, ASGCC, IHEP, NAREGI Production-level CA NAREGI CA APGrid PMA CA 58 29

30 NAREGI-CA XKMS CA VO VOMS EGEE VOMSMyProxy 59 Introduction to GT4, ro.pdf Globus Project, GGF, MPICH-G2, Apache Tomcat, Apache AXIS, Special Features: Grid Computing, IPSJ Magazine, Vol.44 No.6, June 2003, pp , JAVA PRESS Vol.30, Web, Globus, OGSA 60 30

untitled

untitled 1 6. 2 NAREGIWP5 3 Packaging Grid Programming (WP2) -Grid RPC -Grid MPI Grid-Enabled Nano-Applications (WP6) Grid Visualization Grid Workflow (WFML (Unicore+ WF)) Super Scheduler WP3 WP1 Grid PSE WSRF