Search

Over the last decade or so, multi-domain network monitoring systems frameworks such as perfSONAR have been widely deployed in high performance computing and other communities that support large-scale data movements. These frameworks allow end-to-end monitoring across domains such that performance measurements can be queried through web interfaces for interested parties to analyze the network paths for the purposes of detecting anomaly events and diagnosis of faults. perfSONAR, a web-services based infrastructure for collecting and publishing network performance monitoring data sets has made it easy for networking communities to solve end-to-end performance problems on paths crossing several networks and it has emerged as a popular network performance monitoring tool within organizations both in US as well as for communities within the European research networks. It consists of a set of services delivering performance measurements in a federated environment. The current implementation of the perfSONAR services when hosted in an enterprise network environment in the form of E-perfSONAR measurement point appliance controlled by a central intelligence system has security limitations. It also does not support policy-based access to measurement data sets. The critical issues to be addressed are - (i) Ensure that the web services instrumented into the Central Intelligence system and the measurement point appliance are robust against cyber-attacks and (ii) Allow a `selectively-open' nature of view to the measurement data that are collected by the measurement points and also a policy-driven approach to scheduling of the services. Therefore, there is a need to investigate network security issues and a need to support a policy-driven approach for Middle-ware security in E-perfSONAR deployments. The primary aim of the thesis is to identify and make steps towards resolution of network security problems of perfSONAR and also in coming up with an authentication and authorization policy that can be built into the E-perfSONAR framework. We refer to our solution as the 'Resource protection service' within the E-perfSONAR framework. Looking at existing frameworks such as Globus toolkit and integration of authentication and authorization features in perfSONAR-MDM, a flavor of perfSONAR brought to us by GEANT, we propose a 'Federated' and a 'Peer-to-Peer' model of security that leverages the features of existing industry standards such as LDAP, Kerberos and Shibboleth technologies to perform authentication mechanism that fits E-perfSONAR architecture and also leverage the open, modular and distributed features of perfSONAR. The suggestions made in this thesis towards the design of middleware security features can be utilized for the E-perfSONAR system to bring about a policy-driven approach to authentication,authorization and scheduling of the network monitoring services in a multi-domain environment. The results obtained from the thesis with respect to vulnerability testing of the web services can be extended to ensure that E-perfSONAR appliance will be a secure point of communication when deployed over an enterprise network.

Parallel distributed systems are widely used for dealing with massive data sets and high performance computing. Securing parallel distributed systems is problematic. Centralized security tools are likely to cause bottlenecks and introduce a single point of failure. In this paper, we introduce existing distributed authentication and authorization tools. We evaluate the quality of the security tools by verifying their security and performance. For security tool verification, we use process calculus and mathematical modeling languages. Casper, Communicating Sequential Process (CSP) and Failure Divergence Refinement (FDR) to test for security vulnerabilities, Petri nets and Karp Miller trees are used to find performance issues of distributed authentication and authorization methods. Kerberos, PERMIS, and Shibboleth are evaluated. Kerberos is a ticket based distributed authentication service, PERMIS is a role and attribute based distributed authorization service, and Shibboleth is an integration solution for federated single sign-on authentication. We find no critical security and performance issues.