Use of a hardware token for Grid authentication by the MICE data distribution framework

Abstract

The international Muon Ionization Cooling Experiment (MICE) is designed to demonstrate the principle of muon ionisation cooling for the first time. Data distribution and archiving, batch reprocessing, and simulation are all carried out using the EGI Grid infrastructure, in particular the facilities provided by GridPP in the UK. To prevent interference - especially accidental data deletion - these activities are separated by different VOMS roles. Data acquisition, in particular, can involve 24/7 operation for a number of weeks and so for moving the data out of the MICE Local Control Room at the experiment a valid, VOMS-enabled, Grid proxy must be made available continuously over that time. The MICE "Data Mover" agent is now using a robot certificate stored on a hardware token (Feitian ePass2003) from which a cron job generates a “plain” proxy to which the VOMS authorisation extensions are added in a separate transaction. A valid short-lifetime proxy is thus continuously available to the Data Mover process. The Feitian ePass2003 was chosen because it was both significantly cheaper and easier to actually purchase than the token commonly referred to in the community at that time; however there was no software support for the hardware. This paper describes the software packages, process and commands used to deploy the token into production.