Collaborative Research: CICI: Secure and Resilient Architecture: Creating Dynamic Superfacilities the SAFE Way

现代计算科学正变得越来越协作，因为科学家们利用远程共享设施，包括仪器、计算资源和数据存储库。美国能源部（DOE）的研究人员创造了“超级设施”一词，用来描述使用高性能网络和数据管理软件将两个或多个现有设施集成在一起，以增加科学产出。目前，超级设施是专门为特定的科学应用或社区手工建造的，限制了它们的使用，这些项目的寿命很长。校园科学网络（科学DMZs）和联邦基础设施即服务的最新进展，如NSF GENI，提供了基本的构建模块，使动态超级设施的建设成为可能。超级设施的自动化创建降低了成本，但也带来了新的安全挑战。通过设计，它们的动态网络链路绕过校园安全设备，以保持无摩擦的网络路径；这些路径的安全性通常通过手动管理互连来解决。该项目创建了一个框架，用于自动化、授权和监控跨动态超级设施的端到端连接，将这项技术带给更广泛的科学家。SAFE超级设施项目汇集了来自RENCI/UNC Chapel Hill、杜克大学和DOE/ESnet的研究人员和IT支持组织。这个项目的目标是通过提供必要的授权和安全监控来推广对拼接动态网络电路的支持，从而使通用、动态和安全的互连成为Science DMZ、软件定义交换（SDX）和超级设施的基础构建块。该项目的一个重点是使用SAFE逻辑信任系统，授权由研究人员及其合作者开发、部署和运营的两个系统（ExoGENI测试平台和杜克大学的软件定义科学网络（SDSN）校园网交换）中的网络链接的动态缝合线。第二个元素处理这些链路上流量的动态带外安全监控。该项目作为提高安全性的典范，同时在校园科学家和远程设施之间保持高性能的无摩擦网络路径。

Modern computational science is becoming increasingly collaborative as scientists utilize remote shared facilities, including instruments, compute resources, and data repositories. Department of Energy (DOE) researchers have coined the term "superfacility" to describe an integration of two or more existing facilities using high-performance networks and data management software in order to increase scientific output. Currently, superfacilities are purpose-built manually for a specific scientific application or community, limiting their use to large projects that are long-lived. Recent advances in campus science networks (Science DMZs) and federated Infrastructure-as-a-Service, as in NSF GENI, provide the basic building blocks to enable construction of dynamic superfacilities on demand. Automating the creation of superfacilities reduces their cost but introduces new security challenges. By design, their dynamic network links bypass campus security appliances in order to maintain a friction-free network path; security for these paths is typically addressed by managing interconnections manually. This project creates a framework to automate, authorize, and monitor end-to-end connectivity across dynamic superfacilities, bringing this technology to a wider range of scientists.The SAFE Superfacilities project brings together researchers and IT support organizations from RENCI/UNC Chapel Hill, Duke University and DOE/ESnet. The goal of this project is to generalize support for stitching dynamic network circuits by providing the authorization and security monitoring necessary to enable general, dynamic, and safe interconnections as a foundational building block for Science DMZ, Software Defined Exchanges (SDX), and superfacilities. One element of the project focuses on using the SAFE logical trust system to authorize dynamic stitching of network links in two systems developed, deployed, and operated by the researchers and their collaborators: the ExoGENI testbed and Duke's Software-Defined Science Network (SDSN) campus network exchange. A second element addresses dynamic out-of-band security monitoring of traffic over these links. The project serves as a model for improving security while maintaining high-performance friction-free network paths between campus scientists and remote facilities.