Grid Security - Grid Computing: Infrastructure, Service, and Applications - page 302

12.2.1 Public Key Infrastructure

Cryptography is one of the main tools available to support secure infra-
structures. Using cryptographic technology, coni dentiality can be estab-
lished by encrypting and decrypting messages and their contents. Encryption
and decryption are done using keys. When these keys are the same, this is
called symmetric-key cryptography.
Public-key cryptography uses different keys: private and public keys.
Messages encrypted with a public key can only be read by an individual
who possesses the private key. Any user can direct a message to a known
destination, knowing that it cannot be read by anyone else, simply by
encrypting it using the public key of that destination. The owner of the
private key can encrypt messages with that key, and the receiver of the
message can be sure that it was sent by the owner of the private key. Both
public key agreement and public key transport need to know who the
remote public key belongs to; that is, who has associated private key.
The public key certii cate is the mechanism used for connecting the public
key to the user with the corresponding private key. Public key certii cates
include a distinguished name (DN) that can be used for identifying a
given user.
A PKI is responsible for deciding policy, managing, and enforcing
certii cate validity checks. The central component of a PKI is a certii cation
authority (CA). A CA is a root of trust that holders of public and private
keys agree upon. CAs have numerous responsibilities including issuing
of certii cates, often requiring delegation to a local registration authority
(RA) used to prove the identity of users requesting certii cates. CAs are
also required, among other things, to revoke older or compromised cer-
tii cates through issuing certii cate revocation lists (CRL). A CA must have
well-documented processes and practices that must be followed to ensure
identity management. Various PKI architectures are possible, the selec-
tion of which depends upon numerous factors. Are numerous CAs to be
trusted? How important is it to be able to add new CAs? What kind of
trust relationships exist between CAs?
The simplest PKI involves a single CA that is trusted by all users and
service/resource providers. This model has been chosen for UK e-Science
and is based on a statically dei ned centralized CA with direct single hier-
archy to users. Getting a certii cate can be seen as the starting point in
accessing and using grid-based resources such as the UK e-Science National
Grid Service (NGS) [4]. The typical scenario for getting a certii cate is as
follows: researchers wishing to gain access to grid resources such as the
NGS apply to the centralized CA at Rutherford Appleton Laboratory (RAL)
[5]. The CA will then contact their local RA, who will in turn contact
the user and request some form of photographic identii cation (such as a
passport photo or a university card) to ensure that they are legitimate. Once
the identity of the user has been ratii ed, the RA contacts the CA, who
subsequently informs the user (via email) that their certii cate is available