Home | About

End-to-end Security in a Federation Pattern

Members of a federation must be able to identify one another, identify messages as coming from other members of the federation, and identify the truth of claims made by other parties in the federation. For example, Partner B receives a request from Partner A to perform a unit of work on a grid server. Partner B needs to identify that the message comes from Partner A and that it is a member of a federation.

There can be two different types of STS. The partner-level STS implementation is targeted to VO participant organizations, i.e., a partner-level STS is responsible for issuing security tokens that are used to secure messages that originate in this VO participant organization. The second type is the VO-wide STS. Its purpose is to issue VO-internal security tokens and claims, in particular membership claims. This VO-wide STS is tightly coupled to the VO membership database in order to testify membership information in the form of claims.

It is also possible to have partner STSs talk directly to each other. Algorithms exist for performing token exchange without the third party.

  1.  A client wishes to send a message to a service. The message is passed to the PEP.
  2. The PEP checks with the PDP if the message is allowed to be sent.
  3. The PEP asks the STS to validate and sign the claims of the message, and to encrypt the message.
  4. The claims are sent to the VO-level STS to be signed by the VO-level STS .
  5. The signed claims are returned to the PEP.
  6. Message with signed, attached claims sent to the PEP of the service.
  7. The receiving PEP checks the claim via its own STS and the STS will decrypt the message.
  8. The service STS checks the claims via the VO-level STS which returns a result.
  9. The service STS confirms the validity of the claims back to the service PEP and also sends back the decrypted message.
  10. The message is checked with the PDP of the service.
  11. The message is sent onto the service.

Note that the above sequence would obviously change where a VO-level STS is not used. The two partner STSs (client and service) would communicate directly.