CICI: RSARC: Infrastructure Support for Securing Large-Scale Scientific Workflows

CICI：RSARC：确保大规模科学工作流程安全的基础设施支持

• 批准号: 1738929
• 负责人: Ping Yang
• 金额: $ 100万
• 依托单位: SUNY at Binghamton
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2017
• 资助国家: 美国
• 起止时间: 2017-09-01 至 2022-08-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1738929&HistoricalAwards=false
• 关键词: CICI; RSARC; Infrastructure; Support; Securing; CICI; RSARC; Infrastructure; Support; Securing

The scientific workflow is an important paradigm for automating and accelerating data processing and sharing in the scientific community. The correctness of scientific discoveries relies on the trustworthiness and reliability of the data processed by scientific workflows and the underlying cyberinfrastructure. Unfortunately, modern scientific workflow systems lack robust infrastructure support for the trustworthy execution of scientific workflows and for the protection of the data processed by such workflows. A scientist or student may forge or alter datasets or computation simply to get papers accepted for publication. A malicious user may also publish forged workflow data on websites, misleading other scientists into investigating and publishing invalid results. This project aims to support a community of engineers and scientists to collaboratively and securely collect, analyze, and share data using scientific workflows. The success of this project contributes significantly to the national cyberinfrastructure vision of securing the scientific discovery process for a wide range of science and engineering disciplines.This project develops infrastructure support for secure execution of scientific workflows, detection of anomalous execution flows, and protection of scientific data. In particular, this project: (1) develops a trusted execution environment for scientific workflows leveraging the Intel Software Guard Extension (SGX) to protect the execution of scientific workflows as well as the data processed by scientific workflows; (2) produces encrypted, tamper-proof, and non-repudiable block-graphs that enable scientists to verify the origin of scientific data and examine how a piece of data was modified and distributed; and (3) develops a machine-learning based anomaly detection technique to detect anomalous execution flows based on logs collected by the underlying cyberinfrastructure.

科学工作流程是在科学界自动化和加速数据处理和共享的重要范式。科学发现的正确性取决于科学工作流和基础网络基础设施处理数据的可信度和可靠性。不幸的是，现代科学工作流系统缺乏对可信赖的科学工作流程执行和保护此类工作流程处理的数据的强大基础架构的支持。科学家或学生可以伪造或更改数据集或计算，只是为了获得论文的出版。恶意用户还可以在网站上发布伪造的工作流数据，从而误导其他科学家调查和发布无效的结果。该项目旨在支持工程师和科学家的社区，以合作，安全地收集，分析和共享数据。 该项目的成功极大地促进了国家网络基础设施的愿景，即保护科学和工程学科的科学发现过程。该项目为安全执行科学工作流程，检测异常执行流量以及对科学数据的保护提供了基础设施支持。 特别是该项目：（1）为科学工作流提供了一个值得信赖的执行环境，利用Intel软件守卫扩展（SGX）来保护科学工作流的执行以及科学工作流程处理的数据； （2）产生加密，防篡改和不可申请的块图，使科学家能够验证科学数据的起源并研究如何修改和分布一块数据； （3）开发一种基于机器学习的异常检测技术，以根据基础网络基础结构收集的对数检测异常执行流。