Collaborative Research: CICI: Secure and Resilient Architecture: Creating Dynamic Superfacilities the SAFE Way

随着科学家利用远程共享设施，包括仪器、计算资源和数据存储库，现代计算科学正变得越来越协作。美国能源部(DOE)的研究人员创造了“超级设施”一词，用来描述使用高性能网络和数据管理软件将两个或更多现有设施整合在一起，以增加科学产出。目前，超级设施是专门为特定的科学应用或社区而手工建造的，仅限于使用寿命较长的大型项目。校园科学网络(Science DMZ)和联合基础设施即服务(Federal Infrastructure-as-a-Service)的最新进展，如NSF Geni，提供了基本的构建块，使按需构建动态超级设施成为可能。自动创建超级设施降低了它们的成本，但也带来了新的安全挑战。根据设计，它们的动态网络链路绕过园区安全设备，以维护无摩擦的网络路径；这些路径的安全性通常通过手动管理互连来解决。该项目创建了一个框架来自动化、授权和监控动态超级设施之间的端到端连接，将这项技术带给更广泛的科学家。安全超级设施项目汇集了来自RENI/UNC教堂山、杜克大学和美国能源部/ESnet的研究人员和IT支持组织。该项目的目标是通过提供必要的授权和安全监控来实现作为Science DMZ、软件定义交换(SDX)和超级设施的基本构建块的通用、动态和安全互连，从而推广对连接动态网络电路的支持。该项目的一个要素是使用安全的逻辑信任系统来授权由研究人员及其合作者开发、部署和操作的两个系统中的网络链接的动态缝合：ExoGENI试验床和杜克大学的软件定义科学网络(SDSN)校园网络交换。第二个元素用于对这些链路上的流量进行动态带外安全监控。该项目作为提高安全性的典范，同时维护校园科学家和远程设施之间的高性能无摩擦网络路径。

Modern computational science is becoming increasingly collaborative as scientists utilize remote shared facilities, including instruments, compute resources, and data repositories. Department of Energy (DOE) researchers have coined the term "superfacility" to describe an integration of two or more existing facilities using high-performance networks and data management software in order to increase scientific output. Currently, superfacilities are purpose-built manually for a specific scientific application or community, limiting their use to large projects that are long-lived. Recent advances in campus science networks (Science DMZs) and federated Infrastructure-as-a-Service, as in NSF GENI, provide the basic building blocks to enable construction of dynamic superfacilities on demand. Automating the creation of superfacilities reduces their cost but introduces new security challenges. By design, their dynamic network links bypass campus security appliances in order to maintain a friction-free network path; security for these paths is typically addressed by managing interconnections manually. This project creates a framework to automate, authorize, and monitor end-to-end connectivity across dynamic superfacilities, bringing this technology to a wider range of scientists.The SAFE Superfacilities project brings together researchers and IT support organizations from RENCI/UNC Chapel Hill, Duke University and DOE/ESnet. The goal of this project is to generalize support for stitching dynamic network circuits by providing the authorization and security monitoring necessary to enable general, dynamic, and safe interconnections as a foundational building block for Science DMZ, Software Defined Exchanges (SDX), and superfacilities. One element of the project focuses on using the SAFE logical trust system to authorize dynamic stitching of network links in two systems developed, deployed, and operated by the researchers and their collaborators: the ExoGENI testbed and Duke's Software-Defined Science Network (SDSN) campus network exchange. A second element addresses dynamic out-of-band security monitoring of traffic over these links. The project serves as a model for improving security while maintaining high-performance friction-free network paths between campus scientists and remote facilities.