knowledge · information · learning - Forschungszentrum L3S

54
INFORMATION
D-Grid Integration Project Phase 2
Toward a Reliable grid
Infrastructure in germany
The first D-grid Integration Project (DgI-1)
established a core grid infrastructure in germany.
The follow-up project, DgI-2, will establish
this infrastructure for long-term use and
sustainability. Towards these goals, the main
objectives of DgI-2 (in close collaboration with
existing e-science communities in germany)
Challenges
D-Grid allows many different communities to access distributed
high performance computing and storages resources.
The challenge of DGI-2 is to create feasible accessibility
and sound business models by ensuring suitable levels of
security and performance; in conjunction with commercial
and legal support.
Highlights
Security Management in D-Grid: The objective of security
management is to coordinate all security related activities
in D-Grid. One task is the definition of appropriate criteria
for evaluating existing and potential security levels for the
D-Grid communities. Another important task is the creation
of suitable policies for supporting the sustainable operation
of the D-Grid infrastructure. Additionally, L3S delivers
pertinent recommendations and supports enforcing each
security level while taking into account the specific applications
of each grid community.
In D-Grid, authorization is currently based solely on user
identities as represented by public key certificates. This rudimentary
approach will be replaced by a more fine-grained
one, which extends the authentication and authorization
infrastructure to additionally rely on user attributes. Authorization
decisions shall be based upon attributes managed
by the users’ Virtual Organizations (groups, roles), as well
as the so-called campus attributes which are managed by
their respective home organizations (nationality, affilia-
FORSCHUNGSZENTRUM L3S L3S RESEARCH CENTER
were precisely outlined. In phase two, emphasis
will be placed on the support and operation
of the grid infrastructure, its data management,
and security. The L3S Research Center
is responsible for security management and
development activities within DgI-2.
L3S coordinates the security and development
activities in DgI-2 with a strong focus on the sustainable
implementation of services for e-science.
For this purpose, L3S defines suitable
levels of security in D-grid, implements the
required authentication and fine-grained authorization
together with concepts for using firewalls,
and provides a comprehensive accounting
infrastructure.
tion). Further, the use of a Short-Lived Certificate Service
shall simplify the access to D-Grid for entire communities
by mapping users of existing identity management systems
to short-lived public key certificates.
The vast majority of resources in D-Grid are operated within
networks that are protected by firewalls. Firewalls need to
be correctly configured, so that unauthorized accesses are
blocked, while seamlessly allowing legitimate communications
to take place. To simplify this process, L3S delivers
a set of profiles for firewall configuration characterized
by different levels of security. Resource providers and user
communities are able to choose the configuration that best
meets their requirements. In order to verify that a given
profile is correctly implemented, a tool automatically performs
periodic checks to verify that the firewall is in compliance
with expected behavior.