CICI: CE: SciTokens: Capability-Based Secure Access to Remote Scientific Data

管理计算科学工作流程的密码和密钥等安全凭证是科学家和信息安全官员的负担。安全凭据的问题(例如，过期、权限不匹配)会导致工作流无法获取所需的输入数据或存储有价值的科学结果，这会分散科学家的研究注意力，因为他们需要诊断问题、重新运行计算并等待更长时间的结果。为了避免这些问题，科学家通常使用寿命长、特权很高的凭据(例如，使工作流完全模拟他们的身份)，这增加了他们的帐户和基础计算基础设施的风险，并导致信息安全官员管理基础设施的复杂性。SciTokens项目提供开源软件，帮助科学家更可靠、更安全地管理他们的安全凭证。该项目包括激光干涉仪引力波天文台科学协作和大型天文观测望远镜项目的参与者，以确保相关性和促进采用。与广泛使用的HTCondor软件的集成以及与Open Science Grid和Extreme Science and Engineering Discovery Environment(XSEDE)的协作促进了更广泛的科学界的采用。为了应对管理科学工作流安全凭据的挑战和风险，SciTokens项目提供了一个开源软件基础设施，该基础设施使用IETF标准的开放授权(OAuth)令牌来基于能力的安全访问远程科学数据。SciTokens使用在提交节点上安全维护的OAuth刷新令牌，将短期、最低权限的OAuth访问令牌委托给科学工作流，以实现其远程数据访问。访问令牌传递工作流所需的特定授权，而不是通用身份验证模拟凭据。这些最低权限授权令牌有助于解决在包括NSF资源(例如，LIGO数据网格、开放科学网格、XSEDE)和公共云(例如，Amazon Web Services、Google Cloud、Microsoft Azure)的分布式基础设施上运行的科学工作流的风险。通过提高科学工作流程的互操作性和安全性，本科学令牌项目1)能够在需要更多数据保护的科学领域使用分布式计算，2)通过降低远程系统上证书滥用的风险，能够使用更广泛的分布式计算资源。

The management of security credentials such as passwords and secret keys for computational science workflows is a burden for scientists and information security officers. Problems with security credentials (e.g., expiration, privilege mismatch) cause the workflows to fail to fetch needed input data or store valuable scientific results, distracting scientists from their research by requiring them to diagnose the problems, re-run their computations, and wait longer for their results. In an effort to avoid these problems, scientists often use long-lived, highly-privileged credentials (e.g., enabling the workflow to fully impersonate their identity), increasing risks to their accounts and to the underlying computational infrastructure and resulting in complexity for information security officers managing the infrastructure. The SciTokens project delivers open source software to help scientists manage their security credentials more reliably and securely. The project includes participants from the Laser Interferometer Gravitational-Wave Observatory (LIGO) Scientific Collaboration and the Large Synoptic Survey Telescope (LSST) project to ensure relevance and facilitate adoption. Integration with the widely-used HTCondor software and collaboration with Open Science Grid and the Extreme Science and Engineering Discovery Environment (XSEDE) facilitates adoption by the wider scientific community.To address the challenges and risks of managing security credentials for scientific workflows, the SciTokens project delivers an open source software infrastructure that uses IETF-standard Open Authorization (OAuth) tokens for capability-based secure access to remote scientific data. SciTokens uses OAuth refresh tokens, maintained securely on the submission node, to delegate short-lived, least-privilege OAuth access tokens to scientific workflows, to enable their remote data access. The access tokens convey the specific authorizations needed by the workflows, rather than general-purpose authentication impersonation credentials. These least-privilege authorization tokens help to address the risks of scientific workflows running on distributed infrastructure including NSF resources (e.g., LIGO Data Grid, Open Science Grid, XSEDE) and public clouds (e.g., Amazon Web Services, Google Cloud, Microsoft Azure). By improving the interoperability and security of scientific workflows, the SciTokens project 1) enables use of distributed computing for scientific domains that require greater data protection and 2) enables use of more widely distributed computing resources by reducing the risk of credential abuse on remote systems.