HECURA: Exploiting Asymmetry in Performance and Security Requirements for I/O in High-end Computing

HECURA：利​​用高端计算中 I/O 性能和安全要求的不对称性

• 批准号: 0621429
• 负责人: Anand Sivasubramaniam
• 金额: $ 69.97万
• 依托单位: Pennsylvania State Univ University Park
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2006
• 资助国家: 美国
• 起止时间: 2006-08-15 至 2010-07-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=0621429&HistoricalAwards=false
• 关键词: HECURA; Exploiting; Asymmetry; Performance; Security

The growing disparity between processing speeds and I/O performance continues to be a limiting factor in the scalability of large scientific applications. Applications are becoming more data intensive, requiring large storage capacities and high bandwidth access to this storage. Further, application sciences are more collaborative, with sharing of data sets becoming prevalent not just between users/applications of a single organization, but across organizations as well placing even higher performance requirements on the storage system. Given the sensitive nature of many of these applications, in addition to the performance demands, there is an impending need to secure such data from adversarial attacks. The consequences of security breaches can have far reaching consequences, over and beyond the costs of detecting and investigating such breaches. At the same time, one cannot fully confine the data physically since these need to be shared by collaborative applications from different administrative domains. Regulations are also mandating the maintenance of audit records and provenance of data.The motivation for this research is driven by the need to secure storage systems which cater to the demands of high-end applications, while meeting their stringent performance requirements. These two goals - performance and security - are often contradictory, with the mechanisms for optimizing one usually coming at the expense of the other. In the proposed DataVault framework, it is recognized that different environments: (i) have diverse storage architectures, (ii) need to guard against different kinds of threats, and may (iii) have different tolerances for the associated performance overheads when implementing the security mechanisms. Rather than have a one-solution-fits-all approach, The PIs propose to investigate the rich design space - threats, storage architecture, enforcement mechanism, performance - to offer insightful choices that can be useful when deploying/customizing storage systems. DataVault will also include a usable objective-driven policy interface to configure the system for a given set of security and performance needs, while offering a convenient visualization dashboard for security management.

处理速度和I/O性能之间日益增长的差距仍然是大型科学应用程序可扩展性的限制因素。应用程序变得越来越数据密集，需要大存储容量和高带宽访问此存储。此外，应用科学更具协作性，数据集的共享不仅在单个组织的用户/应用程序之间变得普遍，而且跨组织也对存储系统提出了更高的性能要求。考虑到许多这些应用程序的敏感性，除了性能需求外，还迫切需要保护这些数据免受对抗性攻击。安全漏洞的后果可能会产生深远的影响，超出检测和调查此类漏洞的成本。与此同时，人们不能完全限制物理数据，因为这些数据需要由来自不同管理域的协作应用程序共享。法规还强制要求维护审计记录和数据来源。这项研究的动机是为了满足高端应用需求的安全存储系统，同时满足其严格的性能要求。性能和安全这两个目标通常是矛盾的，优化一个目标的机制通常是以牺牲另一个目标为代价的。在所提出的DataVault框架中，认识到不同的环境：（i）具有不同的存储架构，（ii）需要防范不同种类的威胁，并且可能（iii）在实现安全机制时对相关联的性能开销具有不同的容限。PI建议调查丰富的设计空间（威胁、存储体系结构、实施机制、性能），而不是采用一种适合所有情况的解决方案，以便在部署/定制存储系统时提供有用的有见地的选择。DataVault还将包括一个可用的目标驱动的策略界面，用于为给定的安全和性能需求配置系统，同时为安全管理提供方便的可视化仪表板。