Collaborative Research: CICI: Secure and Resilient Architecture: Creating Dynamic Superfacilities the SAFE Way

随着科学家利用远程共享设施（包括仪器、计算资源和数据存储库），现代计算科学正变得越来越具有协作性。美国能源部（DOE）的研究人员创造了“超级设施”一词，用来描述使用高性能网络和数据管理软件集成两个或多个现有设施，以增加科学产出。 目前，超级设施是针对特定的科学应用或社区手动构建的，限制了它们对长期大型项目的使用。 最近在校园科学网络（科学DMZ）和联邦的分布式结构即服务（如NSF GENI）方面取得的进展，为按需构建动态超级设施提供了基本的构建模块。超级设施的自动创建降低了成本，但也带来了新的安全挑战。通过设计，他们的动态网络链接绕过校园安全设备，以保持无摩擦的网络路径;这些路径的安全性通常通过手动管理互连来解决。 SAFE Superfacilities项目汇集了来自RENCI/剑桥查佩尔山、杜克大学和DOE/ESnet的研究人员和IT支持组织。 该项目的目标是通过提供必要的授权和安全监控来推广对拼接动态网络电路的支持，以实现通用，动态和安全的互连，作为科学DMZ，软件定义交换（SDX）和超级设施的基础构建块。 该项目的一个要素重点是使用SAFE逻辑信任系统来授权研究人员及其合作者开发、部署和运营的两个系统中的网络链接的动态缝合：ExoGENI测试床和杜克的软件定义科学网络（SDSN）校园网络交换。 第二个要素解决了对这些链路上的流量进行动态带外安全监控的问题。 该项目是提高安全性的典范，同时在校园科学家和远程设施之间保持高性能的无摩擦网络路径。

Modern computational science is becoming increasingly collaborative as scientists utilize remote shared facilities, including instruments, compute resources, and data repositories. Department of Energy (DOE) researchers have coined the term "superfacility" to describe an integration of two or more existing facilities using high-performance networks and data management software in order to increase scientific output. Currently, superfacilities are purpose-built manually for a specific scientific application or community, limiting their use to large projects that are long-lived. Recent advances in campus science networks (Science DMZs) and federated Infrastructure-as-a-Service, as in NSF GENI, provide the basic building blocks to enable construction of dynamic superfacilities on demand. Automating the creation of superfacilities reduces their cost but introduces new security challenges. By design, their dynamic network links bypass campus security appliances in order to maintain a friction-free network path; security for these paths is typically addressed by managing interconnections manually. This project creates a framework to automate, authorize, and monitor end-to-end connectivity across dynamic superfacilities, bringing this technology to a wider range of scientists.The SAFE Superfacilities project brings together researchers and IT support organizations from RENCI/UNC Chapel Hill, Duke University and DOE/ESnet. The goal of this project is to generalize support for stitching dynamic network circuits by providing the authorization and security monitoring necessary to enable general, dynamic, and safe interconnections as a foundational building block for Science DMZ, Software Defined Exchanges (SDX), and superfacilities. One element of the project focuses on using the SAFE logical trust system to authorize dynamic stitching of network links in two systems developed, deployed, and operated by the researchers and their collaborators: the ExoGENI testbed and Duke's Software-Defined Science Network (SDSN) campus network exchange. A second element addresses dynamic out-of-band security monitoring of traffic over these links. The project serves as a model for improving security while maintaining high-performance friction-free network paths between campus scientists and remote facilities.