The EDGeS project receives Community research funding

Transcription

1 Desktop Grids EDGeS project Delegation for access to trusted resources The EDGeS project receives Community research funding 1

2 DG = Desktop Grid = Loose grid scavenging idle resources Unit of Work = Application + Input Data Grid User Submits input data for an application Sends back results Currently, for BOINC, both roles of Application Manager and Grid User are fulfilled by BOINC Project Owners. Requests Unit of Work Grid Server with Sends Unit Application of Work C ti R Repository Certifies Application Sends back results Accepts or Refuses an application on his resource Computing Resource (often Desktop Computer) Owns Resource Resource Owner Application Manager (often volunteer) v1.2 2

3 DG = Desktop Grid = Loose grid scavenging idle resources Computing and Storage Resources are owned by various Owners (it is often volunteer computing), but they are NOT managed and NOT authenticated. Grid Servers are authenticated by a X509 certificate. Users are authenticated by the Grid Servers, but NOT by the Computing and Storage Resources. Executables are certified by managers of the Grid Servers. So : Resource Owners have to trust the Grid Servers, BOINC sends each Work Unit to several Resource Owners, because BOINC does NOT fully trust them. Order of magnitude can be CPUs. Starving Computing Resources pull Work Units from Grid Servers. Examples : BOINC, XtremWeb, xgrid, OurGrid v1.2 3

4 Presentation of the EDGeS project New FP7 project started on 01/01/2008 Integrate Service Grids and Desktop Grids Enable very large number of computing resources (100K-1M 1M processors) Attract new scientific communities Provide a Grid application development environment Provide application repository and bridges for the execution in the SG-DG system glite () Boinc (Berkeley) ARC (NorduGrid) EDGeS Current WLCG (CERN) Future XtremWeb (INRIA/IN2P3) VDT (OSG) Xgrid (Apple) Unicore (DEISA) v1.2 4

5 Now, Interoperation : Specific security needs of Desktop Grids Presentation of the EDGeS project Ad-hoc bridges and interfaces between, BOINC and XtremWeb. A MoU between EDGeS and has been signed on 23 Sept XtremWeb users must have a X509 certificate, be registered in a VO and submit their Jobs with a VOMS proxy. BOINC Project Owners must have a X509 certificate, be registered in a VO and store a medium-term in a MyProxy server. All files must be transferred through the Input and Output sandboxes. In the future : Interoperability using OGF standards, in order to bridge more Grids. Better support of grid file access (ByteIO, GridFTP). v1.2 5

6 Bridge BOINC (WU = Work Unit) Work Unit BOINC Server Submission BOINC Handler 1 for each (BOINC server, BOINC Project Owner, VO) triple BOINC jobwrapper client (simulating a large BOINC computing resource) 3G jobwrapper DN of 3G jobwrapper Config. file Interface Job Handler EDGeS 3G bridge Queue Manager &JobDB WU i+1 Grid Ha andler Interf face Plugin 1 for each (BOINC Project Owner, VO) pair Job i+1 WMS WU i+2 Job i+1 WU i+3 Job i+2 VOMS proxy Retriever VOMS Server VOMS extensions BOINC Project Owner Medium term Short term MyProxy trusting EDGeS 3G bridge v1.2 6

7 Bridge BOINC Solution = Inside EDGeS bridge, marshalling of the BOINC Work Units into Job collections For each (BOINC server, BOINC Project Owner, VO) triple, a separate Job Handler collects the BOINC Work Units and place them in a queue. For each (BOINC Project Owner, VO) pair, a separate plugin : Retrieves a short term X509 Proxy for the BOINC Project Owner from a MyProxy server, and VOMS extensions from a VOMS server, Periodically processes new Work Units found in the queue : It converts each Work Unit into an Job, In order to reduce the usage of the WMS, it uses Collection possibili- ties of to submit many Jobs in one request described using JDL. v1.2 7

8 Bridge XtremWeb X509 proxy XtremWeb User VOMS Server VOMS proxy Submits User Job with VOMS proxy glite WMS Submits mono-user Pilot Job with VOMS proxy Gives Pilot Job Status Pushes Pilot job Gives Pilot Job Status Computing Element Job with VOMS proxy Job Status Mono-user Pilot Job XtremWeb Bridge User Job Requests User Jobs Sends back Job Status and Results Sends User Jobs with VOMS proxy Manages User Job status XtremWeb Server Requests only 1 User Job Sends 1 User Job with same VOMS proxy Sends back results directly v1.2 8

9 Bridge XtremWeb Solution = XtremWeb bridge : Gliding with a mono-user Pilot Job 1. A XtremWeb User submits to the XtremWeb server his User Job with a VOMS proxy. 2. At the request of the XtremWeb bridge, the XtremWeb server sends him the User Job with the VOMS proxy. 3. The XtremWeb bridge submits to a glite WMS a mono-user Pilot Job with this VOMS proxy (job description in a JDL). 4. The glite WMS pushes the Pilot Job to a Computing Element, which executes it. 5. The mono-user Pilot Job requests 1 User Job from the XtremWeb server, and stops itself if it receives none. 6. The XtremWeb server verifies that the requested User Job has a VOMS proxy, and sends the User Job and the VOMS proxy to the Pilot Job. 7. The Pilot Job verifies that the received VOMS proxy is the same as its own VOMS proxy, and executes the User Job. 8. At the end of the User Job, the Pilot Job sends the Job results directly to the XtremWeb server, then stops itself. v1.2 9

10 Bridge Desktop Grids Submits Job glite WMS Gets output User BDII Logs events LB Watches Reports resources and performance Pushes job Sends output Logs events VOMS Gets VOMS proxy Gets EXE Information provider LCG-CE for EDGeS GRAM Job Manager for EDGeS Checks EXE EDGeS Application Repository Adds job Watches job EDGeS 3G bridge Queue Manager & Job DB Generic Job WS Handler Desktop Grid plugin Desktop Grid v1.2 10

11 Bridges BOINC & XtremWeb Solution = Installation of a LCG-CECE sending the Jobs to the EDGeS bridge, which marshals them into Desktop Grid Jobs Information Provider publishes information to the BDII according to GLUE 1.3 Customized GRAM Job Manager ( producer) Gets job information from wrapper Checks if exe is validated in the EDGeS application repository (GEMLCA) Checks if exe is supported by attached BOINC Gets files from WMS Adds job to 3G bridge job Database Polls status of jobs in 3G bridge job Database Gets results from 3G bridge and uploads them to Logging & Bookkeeping EDGeS 3G bridge Manages jobs in the 3G bridge database On events, updates entries in the 3G bridge database Desktop Grid plugins BOINC plugin uses DC-API to generate BOINC Work Units XtremWeb plugin generates XtremWeb Jobs v1.2 11

12 Delegation for access to trusted resources Jobs having to access trusted Resources require delegation (through X509 proxies or SAML assertions) Is it possible to provide delegation to untrusted Computing Resources of Desktop Grids? v1.2 12

13 Delegation Current situation i : NO restriction i Full i Acceptable only with trusted computing resources Grid User Submits Job without Computing Element Full Submits Job without Trusted Worker Node Full Trusted Data Access without Trusted Storage Resource Full NOT acceptable with untrusted (DG) computing resources Grid User Submits Job without Computing Element Full Submits Job without Untrusted Worker Node Full Untrusted Data Access without Trusted Storage Resource Full v1.2 13

14 Delegation Current situation i : NO restriction i Full i By now, WITHOUT restrictions on delegation, X509 proxies permit full. Therefore, when sending jobs, it is acceptable to send along such X509 proxies : only to TRUSTED computing resources (for example Worker Nodes of local or clusters), because the storage resources must trust that the computing resource will only access to data described in the job, but NOT to UNTRUSTED computing resources (for example from a public Desktop Grid), because they could then have access to all user data. v1.2 14

15 Delegation Under development : X509 Proxies with Restrictions i Improved security with trusted computing resources Grid User Submits Job with Computing Element Restricted Submits Job with Trusted Worker Node Restricted Trusted Data Access with Trusted Storage Resource Restricted Could also be acceptable with untrusted computing resources Grid User Submits Job with Computing Element Restricted Submits Job with Untrusted Worker Node Restricted Trusted Data Access with Trusted Storage Resource Restricted v1.2 15

16 Delegation Under development : X509 Proxies with Restrictions i When sending jobs, it could be acceptable to send X509 proxies containing restriction attributes about data access to UNTRUSTED computing resources (for example from a public Desktop Grid), because : In order to get access to data, computing resources have to present to storage resources the full, INCLUDING ALL restriction attributes. Storage resources are then able to refuse data access if restriction attributes forbid it, Data that the jobs have to read are easily protected against corruption or deletion by using restriction attributes setting those data as read-only. Malicious computing resources can always corrupt data on which they have write access, but they can already write false data in the Output Sandbox of jobs anyway. If these restriction attributes are really implemented, enforced and considered secure enough, this would permit computing resources of Desktop Grids to access storage resources of Storage Elements (using SRM, GridFTP, ), with a great impact on EDGeS JRA3. v1.2 16

17 Delegation Access to untrusted Storage Resources of Desktop Grids Could access of trusted t Computing Resources to untrusted Storage Resources of Desktop Grids be acceptable? Grid User Submits Job Submits Job Trusted Untrusted Computing Worker Element NO X509 Node Data Access proxy Untrusted Storage Resource EDGeS is studying the issue. We can get advices from you and Jesus LUNA. v1.2 17