Certificate authority

It is critical to ensure the highest levels of security in a grid because the grid is designed to execute code and not just share data. Thus, it can be fertile ground for viruses, trojan horses, and other attacks if the grid system is compromised in any way. The Certificate Authority is one of the most important aspects of maintaining strong grid security. An organization may choose to use an external Certificate Authority or operate one itself. You must be able to trust the Certificate Authority to strictly adhere to its responsibilities.

The primary responsibilities of a Certificate Authority are:

·       Positively identifying entities requesting certificates

·       Issuing, removing, and archiving certificates

·       Protecting the Certificate Authority server

·       Maintaining a namespace of unique names for certificate owners

·       Serving signed certificates to those needing to authenticate entities

·       Logging activity

Briefly, a Certificate Authority is based on the public key encryption system. In this system, keys are generated in pairs, a public key and a private key. Either one can be used to encrypt some data such that the other is needed to decrypt it.

The private key is guarded by the owner and never revealed to anyone. The public one is given to anyone needing it. A Certificate Authority is used to hold these public keys and to guarantee who they belong to. When a user uses his private key to encrypt something, the receiver uses the corresponding public key to decrypt it. The receiver knows that only that user’s public key can decrypt the message correctly. However, anyone could intercept this message and decrypt it because anyone can get the originator’s public key. If the originator instead doubly encrypts the message with his private key and the intended recipient’s public key, a secure communication link is formed. The receiver uses his private key to decrypt the message and then uses the sender’s public key for the second decryption. Now the recipient knows that if the message decrypts properly, then only the sender could have sent it and, furthermore, the sender knows that only the intended receiver can decrypt it. The beauty of all of this is that nobody had to securely carry an encryption key from the sender to the receiver, as must be done for conventional encryption systems, and any tampering with the communication is revealed. A similar exchange is used to get anyone’s public key from the Certificate Authority, so that the user knows that he has received an unaltered public key for the desired user.