CC*IIE IAM: Data at the Speed of Trust: Matching Computational Resources to Researchers using Sensitive Data

CC*IIE IAM：以信任的速度获取数据：使用敏感数据将计算资源与研究人员相匹配

• 批准号: 1440588
• 负责人: Tracy Futhey
• 金额: $ 30万
• 依托单位: Duke University
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2014
• 资助国家: 美国
• 起止时间: 2014-09-01 至 2016-08-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1440588&HistoricalAwards=false
• 关键词: CC; IIE; IAM; Data; Speed

Increasingly, scientists use data that are considered sensitive as they conduct research, and protecting these sensitive data significantly adds to the complexity of doing research. This project reduces that complexity. Sensitive data requires strict security and confidentiality, complicating scientific collaboration vital to conducting research. Secure computing environments that protect data also tend to be inflexible, burdensome to use, and difficult to expand, reducing research efficiency. To safeguard sensitive data while supporting scientific collaborations, the project uses software-defined networking (SDN) technologies that allow researchers to establish customized network routes with special provisions for security and performance, creating (for example) a high-speed, secure, and exclusive data connection between distant computers and storage devices. Attribute-based access control systems allow facts (as certified by a trusted entity) about a potential user to determine whether and what access should be granted to the user. This project combines emerging SDN networking technologies and the attribute-based access control systems arising from Internet2's Scalable Privacy initiative. Together, they secure data while also simplifying the granting of data access to collaborators from different organizations federated by a trusted attribute registry. Duke's existing protected network for sensitive research data serves as the project testbed, leveraging Duke's past experience with SDN and open source identity and access management tools widely deployed in academic research institutions. Thus, the project expects to safely enable research collaborations across institutions that use sensitive data, while providing an easy-to-use means to network powerful, diverse, and even geographically remote computational resources necessary to analyze the sensitive data.

科学家在进行研究时越来越多地使用被视为敏感的数据，而保护这些敏感数据显着增加了研究的复杂性。该项目降低了这种复杂性。敏感数据需要严格的安全性和保密性，这使得对开展研究至关重要的科学协作变得复杂化。保护数据的安全计算环境也往往不灵活、使用繁琐且难以扩展，从而降低了研究效率。 为了在支持科学合作的同时保护敏感数据，该项目使用软件定义网络（SDN）技术，允许研究人员建立具有特殊安全和性能规定的定制网络路由，在远程计算机和存储设备之间创建（例如）高速、安全和专有的数据连接。基于属性的访问控制系统允许有关潜在用户的事实（由可信实体认证）来确定是否应向该用户授予访问权限以及何种访问权限。该项目结合了新兴的 SDN 网络技术和来自 Internet2 的可扩展隐私计划的基于属性的访问控制系统。它们共同保护数据，同时还简化了向来自不同组织（由可信属性注册表联合）的协作者授予数据访问权限。杜克大学现有的敏感研究数据受保护网络作为项目测试平台，利用杜克大学过去在学术研究机构广泛部署的 SDN 和开源身份和访问管理工具方面的经验。因此，该项目期望能够安全地实现使用敏感数据的机构之间的研究合作，同时提供一种易于使用的方法来连接分析敏感数据所需的强大、多样化甚至地理位置遥远的计算资源。