CICI: CE: SciTokens: Capability-Based Secure Access to Remote Scientific Data

计算科学工作流程的密码和密钥等安全凭证的管理是科学家和信息安全官员的负担。安全凭证的问题（例如，过期、权限不匹配）导致工作流无法获取所需的输入数据或存储有价值的科学结果，从而通过要求科学家诊断问题、重新运行计算并等待更长时间才得到结果来分散他们的研究注意力。为了避免这些问题，科学家们经常使用长期的、高度特权的证书（例如，使工作流程能够完全模拟其身份），增加了其账户和底层计算基础设施的风险，并导致信息安全官员管理基础设施的复杂性。SciTokens项目提供开源软件，帮助科学家更可靠、更安全地管理他们的安全凭证。该项目包括来自激光干涉仪引力波天文台（LIGO）科学合作组织和大型综合巡天望远镜（LSST）项目的参与者，以确保相关性并促进采用。与广泛使用的HTCondor软件的集成以及与开放科学网格和极限科学与工程发现环境（XSEDE）的协作有助于更广泛的科学界的采用。为了解决管理科学工作流程安全凭证的挑战和风险，SciTokens项目提供了一个开源软件基础设施，该基础设施使用IETF标准的开放授权（OAuth）令牌，远程科学数据的安全访问。SciTokens使用在提交节点上安全维护的OAuth刷新令牌，将短期的、最低权限的OAuth访问令牌委托给科学工作流，以实现其远程数据访问。访问令牌传递工作流所需的特定授权，而不是通用身份验证模拟凭据。这些最低权限授权令牌有助于解决在分布式基础设施（包括NSF资源）上运行的科学工作流的风险（例如，LIGO数据网格，开放科学网格，XSEDE）和公共云（例如，Amazon Web Services、Google Cloud、Microsoft Azure）。通过提高科学工作流程的互操作性和安全性，SciTokens项目1）使分布式计算能够用于需要更大数据保护的科学领域，2）通过降低远程系统上的凭据滥用风险，使更广泛分布的计算资源能够使用。

The management of security credentials such as passwords and secret keys for computational science workflows is a burden for scientists and information security officers. Problems with security credentials (e.g., expiration, privilege mismatch) cause the workflows to fail to fetch needed input data or store valuable scientific results, distracting scientists from their research by requiring them to diagnose the problems, re-run their computations, and wait longer for their results. In an effort to avoid these problems, scientists often use long-lived, highly-privileged credentials (e.g., enabling the workflow to fully impersonate their identity), increasing risks to their accounts and to the underlying computational infrastructure and resulting in complexity for information security officers managing the infrastructure. The SciTokens project delivers open source software to help scientists manage their security credentials more reliably and securely. The project includes participants from the Laser Interferometer Gravitational-Wave Observatory (LIGO) Scientific Collaboration and the Large Synoptic Survey Telescope (LSST) project to ensure relevance and facilitate adoption. Integration with the widely-used HTCondor software and collaboration with Open Science Grid and the Extreme Science and Engineering Discovery Environment (XSEDE) facilitates adoption by the wider scientific community.To address the challenges and risks of managing security credentials for scientific workflows, the SciTokens project delivers an open source software infrastructure that uses IETF-standard Open Authorization (OAuth) tokens for capability-based secure access to remote scientific data. SciTokens uses OAuth refresh tokens, maintained securely on the submission node, to delegate short-lived, least-privilege OAuth access tokens to scientific workflows, to enable their remote data access. The access tokens convey the specific authorizations needed by the workflows, rather than general-purpose authentication impersonation credentials. These least-privilege authorization tokens help to address the risks of scientific workflows running on distributed infrastructure including NSF resources (e.g., LIGO Data Grid, Open Science Grid, XSEDE) and public clouds (e.g., Amazon Web Services, Google Cloud, Microsoft Azure). By improving the interoperability and security of scientific workflows, the SciTokens project 1) enables use of distributed computing for scientific domains that require greater data protection and 2) enables use of more widely distributed computing resources by reducing the risk of credential abuse on remote systems.