security mechanisms
play

Security Mechanisms The European DataGrid Project Team - PowerPoint PPT Presentation

Aug 20, 2023 •157 likes •360 views

Security Mechanisms The European DataGrid Project Team http://www.eu-datagrid.org Overview User side Getting a certificate Becoming a member of the VO Server side Authentication / CA Authorization / VO (with some

  1. Security Mechanisms The European DataGrid Project Team http://www.eu-datagrid.org

  2. Overview � User side � Getting a certificate � Becoming a member of the VO � Server side � Authentication / CA � Authorization / VO (with some examples) Security Tutorial - n° 2

  3. Authentication/Authorization CA’s CERN Authentication (CA Working Group) � CESNET 16 national certification authorities CNRS (3) � + CrossGrid CAs GermanGrid Grid-Ireland policies & procedures � mutual trust � INFN users identified by CA’s certificates � NIKHEF NorduGrid Authorization (Authorization Working Group) � LIP Based on Virtual Organizations (VO). � Russian DataGrid Management tools for � DATAGRID-ES VO membership lists. GridPP VO’s 6+2 Virtual Organizations US–DOE Root CA � ALICE Earth Obs. US-DOE Sub CA ATLAS Biomedical CrossGrid (*) CMS Testbed LHCb Tutorial Security Tutorial - n° 3

  4. Authentication Overview CA service user VO Security Tutorial - n° 4

  5. Certificate Request CA grid-cert-request service user cert-request once in every two- VO three years Security Tutorial - n° 5

  6. Requesting a Certificate � grid-cert-request A certificate request and private key is being created. [...] Using configuration from /usr/local/grid/globus/etc/globus-user-ssleay.conf Generating a 1024 bit RSA private key [...] A private key and a certificate request has been generated with the subject: /O=Grid/O=CERN/OU=cern.ch/CN=Akos Frohner [...] Your private key is stored in .../ .globus/userkey.pem Your request is stored in .../ .globus/usercert_request.pem Please e-mail the certificate request to the CERN CA cat .../.globus/usercert_request.pem | mail cern-globus-ca@cern.ch Your certificate will be mailed to you within two working days. Security Tutorial - n° 6

  7. Certificate Signing CA grid-cert-request cert signing service user cert-request certificate VO Security Tutorial - n° 7

  8. Preparation for Registration CA grid-cert-request cert signing service user cert-request certificate convert cert.pkcs12 VO Security Tutorial - n° 8

  9. Registration/Authorization User registration in an EDG Virtual Organisation � convert your certificate: � openssl pkcs12 –export –in ~/.globus/usercert.pem –inkey ~/.globus/userkey.pem –out user.p12 –name ’Joe Smith’ � import your certificate in your browser � sign the usage guidelines: https://marianne.in2p3.fr/cgi-bin/datagrid/register/account.pl � ask an account from your VO administrator by email -> You are registered in the VO-LDAP server and have a user account. Security Tutorial - n° 9

  10. Registration CA grid-cert-request cert signing service user cert-request certificate Account convert cert.pkcs12 Registration registration VO once for the lifetime of the VO – you may change the Usage guidelines certificate keys! Security Tutorial - n° 10

  11. Starting a Session CA grid-cert-request cert signing service user cert-request certificate convert cert.pkcs12 registration VO proxy-cert grid-proxy-init every 12/24 hours Security Tutorial - n° 11

  12. Usage You must have a valid certificate from a trusted CA! � „login”: grid-proxy-init short lifetime certificate: 24 hours Enter PEM pass phrase: ...........................+++++ ....................................+++++ � checking the proxy: grid-proxy-info -subject /O=Grid/O=CERN/OU=cern.ch/CN=Akos Frohner/CN=proxy � „logout”: grid-proxy-destroy -> use the grid services Security Tutorial - n° 12

  13. Certificate Request for a Host CA grid-cert-request grid-cert-request cert signing service user host-request cert-request certificate convert cert.pkcs12 registration VO proxy-cert grid-proxy-init once in every two- three years Security Tutorial - n° 13

  14. Signing the Certificate CA grid-cert-request grid-cert-request cert signing cert signing service user host-request cert-request host-cert certificate convert cert.pkcs12 registration VO proxy-cert grid-proxy-init Security Tutorial - n° 14

  15. Configuration on the Server CA grid-cert-request grid-cert-request cert signing cert signing service user host-request cert-request cert/crl update host-cert certificate convert ca-certificate cert.pkcs12 registration crl VO-LDAP proxy-cert grid-proxy-init automatically updated every night/week Security Tutorial - n° 15

  16. Authorization Information CA grid-cert-request grid-cert-request cert signing cert signing service user host-request cert-request cert/crl update host-cert certificate convert ca-certificate cert.pkcs12 registration crl gridmap VO-LDAP mkgridmap proxy-cert grid-proxy-init automatically updated every night/week Security Tutorial - n° 16

  17. Using a Service CA grid-cert-request grid-cert-request cert signing cert signing service user host-request cert-request cert/crl update host-cert certificate convert ca-certificate cert.pkcs12 registration crl gridmap VO-LDAP mkgridmap proxy-cert grid-proxy-init host/proxy certs exchanged Security Tutorial - n° 17

  18. Summary Obtaining a certificate from a CA see http://marianne.in2p3.fr/datagrid/ca/ for CAs � new certificate: grid-cert-request � new files in ~/.globus: usercert_request.pem userkey.pem � mail it to the appropriate CA (e.g. cern-globus-ca@cern.ch) � save the answer � ~/.globus/usercert.pem � new proxy certificate: grid-proxy-init � /tmp/x509up_u<uid> -> You have a certificate signed by an EDG CA. Security Tutorial - n° 18

  19. Further Information Grid � EDG CAs: http://marianne.in2p3.fr/datagrid/ca � Globus Security: http://www.globus.org/security/ � EDG WP2: http://grid-data-management.web.cern.ch/grid-data- management/security/ � EDG D7.5: http://edms.cern.ch/document/340234 Background � GGF Security: http://www.gridforum.org/security/ � GSS-API: http://www.faqs.org/faqs/kerberos-faq/general/section- 84.html � IETF PKIX charter: http://www.ietf.org/html.charters/pkix- charter.html � PKCS: http://www.rsasecurity.com/rsalabs/pkcs/index.html Security Tutorial - n° 19

Recommend

Security Overview Security Goals The Attack Space Security Mechanisms

Security Overview Security Goals The Attack Space Security Mechanisms

CSCE Intro to Computer Systems Security Security Overview Security Goals The Attack Space Security Mechanisms Introduction to Cryptography Authentication Authorization Confidentiality Case Studies Security

472 views • 20 slides
Security Overview Security Goals The Attack Space Security Mechanisms

Security Overview Security Goals The Attack Space Security Mechanisms

CPSC 410/611 Operating Systems Security Security Overview Security Goals The Attack Space Security Mechanisms Introduction to Cryptography Authentication Authorization Confidentiality Case Studies

419 views • 19 slides
Security Security with Distributed Systems Why Security? The need for security mechanisms in

Security Security with Distributed Systems Why Security? The need for security mechanisms in

Security Security with Distributed Systems Why Security? The need for security mechanisms in distributed systems arises from the desire to share resources Resources must be protected against unauthorized access, as enemies (attackers)

1.16k views • 67 slides
Security Overview Different aspects of security User authentication Protection mechanisms

Security Overview Different aspects of security User authentication Protection mechanisms

CS399 New Beginnings Jonathan Walpole Security Overview Different aspects of security User authentication Protection mechanisms Attacks: - trojan horses, spoofing, logic bombs, trap doors, buffer overflow attacks, viruses, worms, mobile

825 views • 59 slides
Introduction to Security Attacks Services Mechanisms CSS441: Security and Cryptography

Introduction to Security Attacks Services Mechanisms CSS441: Security and Cryptography

CSS441 Introduction Concepts Architecture Introduction to Security Attacks Services Mechanisms CSS441: Security and Cryptography Sirindhorn International Institute of Technology Thammasat University Prepared by Steven Gordon on 20

678 views • 23 slides
Survey on Security Threats and Protection Mechanisms in Embedded Automotive Networks Ivan

Survey on Security Threats and Protection Mechanisms in Embedded Automotive Networks Ivan

The Automotive Network Threats Protection mechanisms Conclusion Survey on Security Threats and Protection Mechanisms in Embedded Automotive Networks Ivan Studnia Vincent Nicomette Eric Alata Yves Deswarte Mohamed Ka aniche Renault

752 views • 40 slides
SCADA deep inside: protocols and security mechanisms Aleksandr Timorin

SCADA deep inside: protocols and security mechanisms Aleksandr Timorin

SCADA deep inside: protocols and security mechanisms Aleksandr Timorin 05|06|07 September 2014 # whoami penetration tester at Positive Technologies SCADA security researcher, main specialisation -

1.03k views • 81 slides
Security Assessment of Authentication and Authorization Mechanisms in Ethereum, Quorum,

Security Assessment of Authentication and Authorization Mechanisms in Ethereum, Quorum,

Security Assessment of Authentication and Authorization Mechanisms in Ethereum, Quorum, Hyperledger Fabric and Corda Marie-Jeanne Lagarde, Master's thesis 2018-2019 Agenda Introduction Motivation 1. Scope 2. Research Questions 3.

467 views • 35 slides
Experimentation with network-based security mechanisms GENI Security Workshop UC Davis G.

Experimentation with network-based security mechanisms GENI Security Workshop UC Davis G.

Experimentation with network-based security mechanisms GENI Security Workshop UC Davis G. Kesidis January 22-23, 2009 EE and CSE Depts Penn State kesidis@engr.psu.edu . George Kesidis, Penn State University GENI Security Workshop 01/22/09

277 views • 12 slides
Bunshin: Compositing Security Mechanisms through Diversification Meng Xu, Kangjie Lu, Taesoo Kim,

Bunshin: Compositing Security Mechanisms through Diversification Meng Xu, Kangjie Lu, Taesoo Kim,

Bunshin: Compositing Security Mechanisms through Diversification Meng Xu, Kangjie Lu, Taesoo Kim, Wenke Lee Georgia Institute of Technology 1 Memory Corruptions Are Costly 2 3 4 Name your phone Nexus 5X %x.%x 5 Battle against

698 views • 56 slides
Presentations Evaluating the Effectiveness of Security Mechanisms at Scale David Nicol

Presentations Evaluating the Effectiveness of Security Mechanisms at Scale David Nicol

Trustworthy Cyber Infrastructure for the Power Grid Presentations Evaluating the Effectiveness of Security Mechanisms at Scale David Nicol University of Illinois Dartmouth College Cornell University Washington State

335 views • 7 slides
Security Protocols Security protocols are the intellectual core of security engineering

Security Protocols Security protocols are the intellectual core of security engineering

Security Protocols Security protocols are the intellectual core of security engineering They are where cryptography and system mechanisms meet They allow trust to be taken from where it exists to where it s needed But they are

942 views • 67 slides
CS-527 Software Security Defense Mechanisms Asst. Prof. Mathias Payer Department of Computer

CS-527 Software Security Defense Mechanisms Asst. Prof. Mathias Payer Department of Computer

CS-527 Software Security Defense Mechanisms Asst. Prof. Mathias Payer Department of Computer Science Purdue University TA: Kyriakos Ispoglou https://nebelwelt.net/teaching/17-527-SoftSec/ Spring 2017 A model for Control-Flow Hijack attacks

673 views • 41 slides
I know what you did last summer: New persistent tracking mechanisms in the wild Stefano Belloro

I know what you did last summer: New persistent tracking mechanisms in the wild Stefano Belloro

I know what you did last summer: New persistent tracking mechanisms in the wild Stefano Belloro &amp; Dr Alexios Mylonas $whoami Currently: Lecturer, Cyber Security @BU Previously: PhD in Cyber Security &amp; BSc @AUEB MSc

576 views • 31 slides
Chapter7. Security 7.1 Introduction 7.2 Overview of security techniques 7.3 Cryptographic

Chapter7. Security 7.1 Introduction 7.2 Overview of security techniques 7.3 Cryptographic

Chapter7. Security 7.1 Introduction 7.2 Overview of security techniques 7.3 Cryptographic algorithms 7.4 Digital signatures 7.5 Cryptography pragmatics 7.1. Introduction Why need security mechanisms in DS? Share of resources

364 views • 24 slides
Security Mechanisms Rahul Hiran , Niklas Carlsson, Nahid Shahmehri Linkping University, Sweden

Security Mechanisms Rahul Hiran , Niklas Carlsson, Nahid Shahmehri Linkping University, Sweden

Does Scale, Size, and Locality Matter? Evaluation of Collaborative BGP Security Mechanisms Rahul Hiran , Niklas Carlsson, Nahid Shahmehri Linkping University, Sweden 1 Routing attacks increasingly common Each day there are large numbers of

894 views • 58 slides
Software Security Ge Zhang Security: When is it software problem Network Problem: caused by

Software Security Ge Zhang Security: When is it software problem Network Problem: caused by

Software Security Ge Zhang Security: When is it software problem Network Problem: caused by the flaws in networking mechanisms such as network protocols. OS Problem: caused by the flaws in OS mechanisms such OS resource management

976 views • 64 slides
Chapter 9: Security Security The security environment Basics of cryptography User

Chapter 9: Security Security The security environment Basics of cryptography User

Chapter 9: Security Security The security environment Basics of cryptography User authentication Attacks from inside the system Attacks from outside the system Protection mechanisms Trusted systems Chapter 9: Security

801 views • 65 slides
Secure System Development Mechanisms CS460 Cyber Security Lab Spring 2010 Reading Material

Secure System Development Mechanisms CS460 Cyber Security Lab Spring 2010 Reading Material

Secure System Development Mechanisms CS460 Cyber Security Lab Spring 2010 Reading Material Web sites Microsoft links from last lecture Linux Capabilities - man 7 capabilities or http://www.linuxjournal.com/article/5737

1.17k views • 29 slides
1 Cryptography basics Secret-key encryption Algorithms (E, D) are widely known Also

1 Cryptography basics Secret-key encryption Algorithms (E, D) are widely known Also

Security The security environment Basics of cryptography User authentication Chapter 9: Security Attacks from inside the system Attacks from outside the system Protection mechanisms Trusted systems CS 1550, cs.pitt.edu

538 views • 11 slides
Objectives Goals of Cryptography Security Services Security Mechanisms Relationship

Objectives Goals of Cryptography Security Services Security Mechanisms Relationship

Overview on Modern Cryptography Debdeep Mukhopadhyay Assistant Professor Department of Computer Science and Engineering Indian Institute of Technology Kharagpur INDIA -721302 Objectives Goals of Cryptography Security Services

658 views • 16 slides
Network Security Computer Security Peter Reiher November 4, 2014 Lecture 9 Page 1 CS 136,

Network Security Computer Security Peter Reiher November 4, 2014 Lecture 9 Page 1 CS 136,

Network Security Computer Security Peter Reiher November 4, 2014 Lecture 9 Page 1 CS 136, Fall 2014 Outline Network security characteristics and threats Denial of service attacks Traffic control mechanisms Firewalls

797 views • 67 slides
Improving Application Software Security in Linux Sebastian Neubauer Technische Universitt

Improving Application Software Security in Linux Sebastian Neubauer Technische Universitt

Improving Application Software Security in Linux Sebastian Neubauer Technische Universitt Mnchen Computer Science Department July 19, 2017 1 Improve C/C++ applications contain bugs Security Existing security mechanisms Still

367 views • 32 slides
Model-based Security Engineering: Models vs. Code Jan Jrjens Department of Computing The

Model-based Security Engineering: Models vs. Code Jan Jrjens Department of Computing The

Model-based Security Engineering: Models vs. Code Jan Jrjens Department of Computing The Open University, GB http://www.umlsec.org Challenge: Security Security is holistic property: Attackers often circumvent (not: break) mechanisms.

639 views • 36 slides

More recommend