Collaborative Research: CICI: Secure and Resilient Architecture: Creating Dynamic Superfacilities the SAFE Way

合作研究：CICI：安全和弹性架构：以安全方式创建动态超级设施

• 批准号: 1642142
• 负责人: Paul Ruth
• 金额: $ 44.87万
• 依托单位: University of North Carolina at Chapel Hill
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2016
• 资助国家: 美国
• 起止时间: 2016-12-01 至 2020-11-30
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1642142&HistoricalAwards=false
• 关键词: Collaborative; Research; CICI; Secure; Resilient

Modern computational science is becoming increasingly collaborative as scientists utilize remote shared facilities, including instruments, compute resources, and data repositories. Department of Energy (DOE) researchers have coined the term "superfacility" to describe an integration of two or more existing facilities using high-performance networks and data management software in order to increase scientific output. Currently, superfacilities are purpose-built manually for a specific scientific application or community, limiting their use to large projects that are long-lived. Recent advances in campus science networks (Science DMZs) and federated Infrastructure-as-a-Service, as in NSF GENI, provide the basic building blocks to enable construction of dynamic superfacilities on demand. Automating the creation of superfacilities reduces their cost but introduces new security challenges. By design, their dynamic network links bypass campus security appliances in order to maintain a friction-free network path; security for these paths is typically addressed by managing interconnections manually. This project creates a framework to automate, authorize, and monitor end-to-end connectivity across dynamic superfacilities, bringing this technology to a wider range of scientists.The SAFE Superfacilities project brings together researchers and IT support organizations from RENCI/UNC Chapel Hill, Duke University and DOE/ESnet. The goal of this project is to generalize support for stitching dynamic network circuits by providing the authorization and security monitoring necessary to enable general, dynamic, and safe interconnections as a foundational building block for Science DMZ, Software Defined Exchanges (SDX), and superfacilities. One element of the project focuses on using the SAFE logical trust system to authorize dynamic stitching of network links in two systems developed, deployed, and operated by the researchers and their collaborators: the ExoGENI testbed and Duke's Software-Defined Science Network (SDSN) campus network exchange. A second element addresses dynamic out-of-band security monitoring of traffic over these links. The project serves as a model for improving security while maintaining high-performance friction-free network paths between campus scientists and remote facilities.

随着科学家利用远程共享设施（包括仪器、计算资源和数据存储库），现代计算科学变得越来越协作。能源部 (DOE) 研究人员创造了“超级设施”一词来描述使用高性能网络和数据管理软件集成两个或多个现有设施，以提高科学产出。 目前，超级设施是为特定的科学应用或社区手动建造的，仅限于长期的大型项目。 校园科学网络（科学 DMZ）和联合基础设施即服务（如 NSF GENI）的最新进展，为按需构建动态超级设施提供了基本构建块。自动化创建超级设施降低了成本，但带来了新的安全挑战。按照设计，它们的动态网络链接绕过校园安全设备，以保持无摩擦的网络路径；这些路径的安全性通常通过手动管理互连来解决。 该项目创建了一个框架，用于自动化、授权和监控动态超级设施之间的端到端连接，从而将该技术带给更广泛的科学家。SAFE 超级设施项目汇集了来自 RENCI/UNC Chapel Hill、杜克大学和 DOE/ESnet。 该项目的目标是通过提供必要的授权和安全监控来普遍支持拼接动态网络电路，以实现通用、动态和安全的互连，作为科学 DMZ、软件定义交换 (SDX) 和超级设施的基础构建块。 该项目的一个重点是使用 SAFE 逻辑信任系统来授权研究人员及其合作者开发、部署和运营的两个系统中网络链路的动态拼接：ExoGENI 测试床和杜克大学软件定义科学网络 (SDSN) 园区网络交换。 第二个元素解决了对这些链路上流量的动态带外安全监控。 该项目是提高安全性的典范，同时保持校园科学家和远程设施之间的高性能无摩擦网络路径。