CICI: RSARC: Infrastructure Support for Securing Large-Scale Scientific Workflows

科学工作流程是科学界自动化和加速数据处理和共享的重要范例。科学发现的正确性取决于科学工作流程和基础网络基础设施处理的数据的可信性和可靠性。不幸的是，现代科学工作流系统缺乏可靠的基础设施支持，无法可靠地执行科学工作流并保护由这种工作流处理的数据。科学家或学生可能伪造或更改数据集或计算，只是为了让论文被接受发表。恶意用户还可能在网站上发布伪造的工作流数据，误导其他科学家调查和发布无效结果。该项目旨在支持工程师和科学家社区使用科学工作流协作、安全地收集、分析和共享数据。该项目的成功对保障广泛科学和工程学科的科学发现过程的国家网络基础设施愿景做出了重要贡献。该项目为安全执行科学工作流程、检测异常执行流程和保护科学数据开发基础设施支持。具体来说，该项目：(1)利用Intel Software Guard扩展(SGX)为科学工作流开发可信的执行环境，以保护科学工作流的执行以及科学工作流处理的数据；(2)生成加密、防篡改和不可否认的框图，使科学家能够验证科学数据的来源，并检查数据是如何修改和分发的；以及(3)开发基于机器学习的异常检测技术，以根据底层网络基础设施收集的日志来检测异常执行流。

The scientific workflow is an important paradigm for automating and accelerating data processing and sharing in the scientific community. The correctness of scientific discoveries relies on the trustworthiness and reliability of the data processed by scientific workflows and the underlying cyberinfrastructure. Unfortunately, modern scientific workflow systems lack robust infrastructure support for the trustworthy execution of scientific workflows and for the protection of the data processed by such workflows. A scientist or student may forge or alter datasets or computation simply to get papers accepted for publication. A malicious user may also publish forged workflow data on websites, misleading other scientists into investigating and publishing invalid results. This project aims to support a community of engineers and scientists to collaboratively and securely collect, analyze, and share data using scientific workflows. The success of this project contributes significantly to the national cyberinfrastructure vision of securing the scientific discovery process for a wide range of science and engineering disciplines.This project develops infrastructure support for secure execution of scientific workflows, detection of anomalous execution flows, and protection of scientific data. In particular, this project: (1) develops a trusted execution environment for scientific workflows leveraging the Intel Software Guard Extension (SGX) to protect the execution of scientific workflows as well as the data processed by scientific workflows; (2) produces encrypted, tamper-proof, and non-repudiable block-graphs that enable scientists to verify the origin of scientific data and examine how a piece of data was modified and distributed; and (3) develops a machine-learning based anomaly detection technique to detect anomalous execution flows based on logs collected by the underlying cyberinfrastructure.