Security for dummis

Security for Dummies

Project Title: OGSA-DAI Document Title: Security for Dummies Document Identifier: SECURITY-FOR-DUMMIES-v1.2 Editor: Mike Jackson

Approval List: NCH Document History: Personnel MJJ MJJ NCH MJJ Date 29/10/03 16/10/03 17/9/03 25/07/03 Summary Revised in light of comments from Jarek Gawor Revised in light of comments from Charles Bacon Approved for external distributionVersion 1.2 1.1 1.0 0.1

SECURITY-FOR-DUMMIES-v1.2

2

Contents
1 2 Introduction.....................................................................................................................................4 Security Concepts ...........................................................................................................................5 2.1 Public Key Cryptography.........................................................................................................5 2.1.1 Securing Private Keys.......................................................................................................5 2.2 Signing......................................................................................................................................5 2.3Certificates................................................................................................................................5 2.3.1 Certificate Authorities ......................................................................................................6 2.4 MutualAuthentication..............................................................................................................6 2.5 Confidential Communication....................................................................................................6 2.6 Delegation, Single Sign-On and Proxies ..................................................................................7 2.7 Grid MapFiles..........................................................................................................................7 Globus Toolkit 3 Grid Security Infrastructure (GSI) ......................................................................8 3.1 Why? ........................................................................................................................................8 3.2 Java Authentication and Authorization Service (JAAS)...........................................................8 3.3Message Level Security............................................................................................................8 3.3.1 GSI Secure Conversation..................................................................................................9 3.3.2 GSI XML Signature..........................................................................................................9 3.4Server-side Security..................................................................................................................9 3.4.1 WS-Security Handler......................................................................................................10 3.4.2 Security Policy Handler..................................................................................................10 3.4.3Authorization Handler ....................................................................................................10 3.4.4 Service ............................................................................................................................11 3.4.5 Reply toClient................................................................................................................11 3.5 Client-side Security ................................................................................................................11 3.5.1 Outbound Client-side Security Handlers ........................................................................12 3.5.2 Inbound Client-side Handler (WS-Security Client Handler) ..........................................12 General Configuration...