Collaborative Research: CICI: Secure and Resilient Architecture: Creating Dynamic Superfacilities the SAFE Way

合作研究：CICI：安全和弹性架构：以安全方式创建动态超级设施

• 批准号: 1642142
• 负责人: Paul Ruth
• 金额: $ 44.87万
• 依托单位: University of North Carolina at Chapel Hill
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2016
• 资助国家: 美国
• 起止时间: 2016-12-01 至 2020-11-30
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1642142&HistoricalAwards=false
• 关键词: Collaborative; Research; CICI; Secure; Resilient

Modern computational science is becoming increasingly collaborative as scientists utilize remote shared facilities, including instruments, compute resources, and data repositories. Department of Energy (DOE) researchers have coined the term "superfacility" to describe an integration of two or more existing facilities using high-performance networks and data management software in order to increase scientific output. Currently, superfacilities are purpose-built manually for a specific scientific application or community, limiting their use to large projects that are long-lived. Recent advances in campus science networks (Science DMZs) and federated Infrastructure-as-a-Service, as in NSF GENI, provide the basic building blocks to enable construction of dynamic superfacilities on demand. Automating the creation of superfacilities reduces their cost but introduces new security challenges. By design, their dynamic network links bypass campus security appliances in order to maintain a friction-free network path; security for these paths is typically addressed by managing interconnections manually. This project creates a framework to automate, authorize, and monitor end-to-end connectivity across dynamic superfacilities, bringing this technology to a wider range of scientists.The SAFE Superfacilities project brings together researchers and IT support organizations from RENCI/UNC Chapel Hill, Duke University and DOE/ESnet. The goal of this project is to generalize support for stitching dynamic network circuits by providing the authorization and security monitoring necessary to enable general, dynamic, and safe interconnections as a foundational building block for Science DMZ, Software Defined Exchanges (SDX), and superfacilities. One element of the project focuses on using the SAFE logical trust system to authorize dynamic stitching of network links in two systems developed, deployed, and operated by the researchers and their collaborators: the ExoGENI testbed and Duke's Software-Defined Science Network (SDSN) campus network exchange. A second element addresses dynamic out-of-band security monitoring of traffic over these links. The project serves as a model for improving security while maintaining high-performance friction-free network paths between campus scientists and remote facilities.

随着科学家利用远程共享设施，包括工具，计算资源和数据存储库，现代计算科学越来越多。能源部（DOE）研究人员创造了“超级效率”一词，以使用高性能网络和数据管理软件来描述两个或多个现有设施的集成，以提高科学输出。 当前，对于特定的科学应用程序或社区，超级功能是手动构建的，将其用于长期存在的大型项目。 与NSF GENI一样，校园科学网络（Science DMZ）和联邦基础设施 - 服务的最新进展为构建动态超级实力提供了基本的基础。自动创建超级实力会降低其成本，但引入了新的安全挑战。通过设计，他们的动态网络链接绕过校园安全设备以保持无摩擦的网络路径；这些路径的安全性通常是通过手动管理互连来解决的。 该项目创建了一个框架，以自动化，授权和监视跨动态超级功能的端到端连接，从而将这项技术带入更广泛的科学家。杜克大学和DOE/ESNET。 该项目的目的是通过提供必要的授权和安全监控来概括对动态网络电路的支持，以使一般，动态和安全的互连成为科学DMZ的基础构建块，软件定义交易所（SDX）（SDX）和SuperFabilities。 该项目的一个要素着重于使用安全的逻辑信任系统来授权研究人员及其合作者开发，部署和操作网络链接的动态缝线：Exogeni Testbed和Duke的软件定义科学网络（SDSN）校园网络交换。 第二个元素解决了这些链接上流量的动态外部安全监控。 该项目是提高安全性的模型，同时保持校园科学家和远程设施之间的高性能无摩擦网络路径。