EMI tries to pull together three different middlewares. Image courtesy EMI

John White, security team leader of EMI, discusses his work.

iSGTW: Can you explain to me what EMI stands for?

White: European Middleware Initiative. EMI unifies under one project the three middlewares that have been put together over the past six years: gLite, ARC and Unicore.

Each of these middleware do different things; for example, Unicore runs inside high-performance computing centers like a 'monster' supercomputer, while gLite typically runs over a distributed system, such as a farm of 1,000 or 2,000 batch nodes - which can be anything from a cluster of batch nodes or a group of white, 'pizza box' type home-PCs. We used to have these at CERN up until a few years ago.

iSGTW: What is your role?

White: I have a few roles; my most important is as security area leader of the security components of all three middlewares. Below that I function as the security product team leader. This is more technical as we try to put certain sets of security components together, certifying them and releasing them. Lastly, I look after some software components - so there's several vertical levels of responsibility.

iSGTW: Is EMI trying to standardize all middlewares across the grid?

White: Here at CERN it's tricky because you have big experiments, with thousands of members. They all want to do their analyses in different ways via computer components. One of our goals is to reduce the number of components across the middlewares and ensure they can all speak the same language. I'm primarily involved with security. In gLite, we primarily work in PKI (Public Key Infrastructure) using X509 certificates.

iSGTW: What is PKI?

White: Public Key Infrastructure is, without wanting to get too technical, asymmetric cryptography.

It's sort of like the padlock at the bottom of your browser when accessing your bank account online, except that in an Internet browser you don't see what goes on behind. You type in your user name and password, and all the clever stuff happens behind the scenes.

With the grid it's somewhat the same, except that the user has to actively manage their certificate and key - the public and private key pair.

Middlewares also have a more sophisticated scheme called SAML, which is Security Assertion Mark-up Language - an extremely fancy version of HTML.

Concerns about public/private key pairs are that when you have to submit your laptop to various checks by border guards, you have no idea what they do with your machine. Ideally, as soon as your laptop has been looked at by a border agency those credentials should be revoked.

"Grids are most useful when you don't notice them." Image courtesy EMI

iSGTW: Because those credentials could have been seen?

White: If somebody knew enough they could do a 'brute force attack', and extract the password and then they would become you on the grid. Right now it's not a big issue because you can't steal one million dollars off somebody on the grid. In the future it might be a problem.

iSGTW: Are you trying to make different grids talk to each other as well?

White: We're not trying to re-write the grid software. We're organizing parts that use standards to use them in the same manner; for example, a common SAML profile or all three MWs will use the same version of VOMS etc. We're use existing protocols such as SSL (Secure Socket Layer) and agreed standards like SAML and X509 certificates. The EU - who funds us - wants the grid to be easier for users to access. Security is the first thing you look at.

iSGTW: Does EMI have a standard encryption level?

White: Yes, because we go with whatever is recommended by the people who provide SSL. If the bit number moves, we move along with it. For example, we can drop from 1,024-bit to 512-bit if required.

iSGTW: On the grid one person can have different levels of access to certain projects. How does the system recognize who they are?

White: The system we use is called VOMS (Virtual Organization Membership System). It's a bit different from the business world where the managing director is the managing director and he's never just a normal worker. At CERN you can have a Nobel Prize winner who is a member of a working group project and hasn't got much access.

We basically automate the process of creating security details for a user.

iSGTW: Any last comments?

White: I think the most sensible statement I ever heard about grids was from a Finnish high-school student who said that grids are most useful when you don't notice them.

For example, when you go to a university library, you just type in your username and password - you don't realize that you that you are actually using a SAML system called Shibboleth to do all the stuff behind the scenes.

It's a nice, straightforward system. The security and simplicity of using grids should be the same.

-Adrian Giordani, for iSGTW