CICI: SSC: Securing Science Gateway Cyberinfrastructure with Custos

科学网关是科学家、教育工作者和学生轻松访问先进计算基础设施、执行可重复研究和共享科学数据的基于Web的门户。科学网关被全世界成千上万的研究人员使用;因此，网关成为越来越有吸引力的网络安全攻击目标。在网络安全方面，科学网关是一组丰富资产的集合和集成，包括用户身份，对广泛的第三方计算和存储资源的访问，敏感数据，许可或其他限制软件以及生成的科学结果。对科学网关的妥协的后果是广泛的，包括未经授权访问计算资源和数据，以及更微妙的攻击，如修改计算结果，可能需要撤回出版物，否则会破坏科学事业的完整性。 通过集成和扩展最佳软件，Custos项目提供了一个单一的开源软件解决方案，改善了科学网关对用户身份、秘密（如用于访问科学研究所需的各种资源的安全令牌）以及科学网关用户创建的数字研究对象的组和共享权限的管理。Custos软件用于为科学网关社区提供安全的在线服务，该服务具有独立于语言的编程接口，为研究多租户，以科学为重点的网络基础设施提供操作平台和试验场。整个Custos环境，包括配置和操作工具，都遵循Apache软件基金会的精英管理和多样性原则进行公开管理。该奖项反映了NSF的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

Science gateways are web-based portals for scientists, educators, and students to easily access advanced computing infrastructure, perform reproducible research, and share scientific data. Science gateways are used by tens of thousands of researchers worldwide; thus, gateways are an increasingly attractive target for a wide range of cybersecurity attacks. In cybersecurity terms, science gateways are a collection and integration of a rich set of assets, including user identities, access to a wide range of third party computing and storage resources, sensitive data, licensed or otherwise restricted software, and generated scientific results. The consequences of compromises to science gateways are wide ranging, including unauthorized access to computing resources and data as well as more subtle attacks such as alterations of computed results that may require retraction of publications and otherwise undermine the integrity of the scientific enterprise. Through the integration and extension of best-of-breed software, the Custos project provides a single, open source software solution that improves science gateways' management of users identities, secrets such as security tokens used to access a wide range of resources needed for scientific research, and groups and sharing permissions on digital research objects created by science gateway users. Custos software is used to operate a secure, online service with a language-independent programming interface for the science gateway community, providing both an operational platform and a proving ground for research into multi-tenanted, science-focused cyberinfrastructure. The entire Custos environment, including provisioning and operations tools, is openly governed following the meritocracy and diversity principles of the Apache Software Foundation.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.