CC*IIE IAM: Data at the Speed of Trust: Matching Computational Resources to Researchers using Sensitive Data

越来越多的科学家在进行研究时使用被认为是敏感的数据，保护这些敏感数据大大增加了研究的复杂性。该项目降低了这种复杂性。敏感数据需要严格的安全性和保密性，这使得开展研究至关重要的科学合作复杂化。保护数据的安全计算环境也往往不灵活，使用繁琐，难以扩展，降低了研究效率。 为了在支持科学合作的同时保护敏感数据，该项目使用软件定义网络（SDN）技术，允许研究人员建立具有特殊安全和性能规定的定制网络路由，在远程计算机和存储设备之间创建（例如）高速，安全和专有的数据连接。基于属性的访问控制系统允许关于潜在用户的事实（如由可信实体认证的）来确定是否应该授予用户访问权以及应该授予用户什么访问权。该项目结合了新兴的SDN网络技术和基于属性的访问控制系统，这些系统源于Internet 2的可扩展隐私计划。它们一起保护数据，同时还简化了对来自由可信属性注册表联合的不同组织的协作者的数据访问权限的授予。杜克现有的敏感研究数据保护网络将作为项目测试平台，利用杜克过去在SDN和开源身份和访问管理工具方面的经验，这些工具广泛部署在学术研究机构中。因此，该项目希望能够安全地实现使用敏感数据的机构之间的研究合作，同时提供一种易于使用的方法，将分析敏感数据所需的强大，多样化，甚至地理位置偏远的计算资源联网。

Increasingly, scientists use data that are considered sensitive as they conduct research, and protecting these sensitive data significantly adds to the complexity of doing research. This project reduces that complexity. Sensitive data requires strict security and confidentiality, complicating scientific collaboration vital to conducting research. Secure computing environments that protect data also tend to be inflexible, burdensome to use, and difficult to expand, reducing research efficiency. To safeguard sensitive data while supporting scientific collaborations, the project uses software-defined networking (SDN) technologies that allow researchers to establish customized network routes with special provisions for security and performance, creating (for example) a high-speed, secure, and exclusive data connection between distant computers and storage devices. Attribute-based access control systems allow facts (as certified by a trusted entity) about a potential user to determine whether and what access should be granted to the user. This project combines emerging SDN networking technologies and the attribute-based access control systems arising from Internet2's Scalable Privacy initiative. Together, they secure data while also simplifying the granting of data access to collaborators from different organizations federated by a trusted attribute registry. Duke's existing protected network for sensitive research data serves as the project testbed, leveraging Duke's past experience with SDN and open source identity and access management tools widely deployed in academic research institutions. Thus, the project expects to safely enable research collaborations across institutions that use sensitive data, while providing an easy-to-use means to network powerful, diverse, and even geographically remote computational resources necessary to analyze the sensitive data.