CICI:UCSS:Securing an Open and Trustworthy Ecosystem for Research Infrastructure and Applications (SOTERIA)

管理安全的软件环境对可信的网络基础设施至关重要。软件供应链攻击可能是IT部门最关心的问题，但它们也是科学计算的一个方面。有问题的软件对科学声誉的威胁可能与被恶意软件污染的环境一样危险。管理环境的问题影响到执行计算研究的任何个人研究人员，但对于多机构的科学协作来说更为尖锐，因为他们经常主持复杂的软件堆栈，并且必须跨许多分布式计算资源管理软件环境。越来越多地，这些合作和个人调查人员转向Linux容器映像(将应用程序软件、操作系统和其他所需的库打包到一个实体中)，以获得平台可移植性和科学重现性优势。然而，在这样做的过程中，来自公共和私有存储库的新软件来源被引入供应链，从而带来了新的风险。为研究基础设施和应用程序确保开放和值得信赖的生态系统(Soteria)项目是NSF协调的网络基础设施结构中的一个元素，有助于合作避免安全隐患，同时减轻科学软件管理的负担。SOTERIA的目标是为研究人员提供更好的软件环境的可发现性、可见性和可追溯性。SOTERIA为开放科学运营一个容器注册。登记处是为满足科学环境的独特需要而定制的，包括将研究人员的身份实体与集装箱图像相关联，提供图像安全扫描和自省(可见性)，以及与其他数字物体识别和存档服务相结合。Soteria还运营着集装箱配送服务，通过工具追踪整个生态系统的图像来源。最后，随着管理安全软件环境的挑战远超Beyond集装箱安全，Soteria为研究人员提供关于最佳实践的培训和教育。该奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

Managing a secure software environment is essential to a trustworthy cyberinfrastructure.Software supply chain attacks may be a top concern for IT departments, but they are also anaspect of scientific computing. The threat to scientific reputation caused by problematic softwarecan be just as dangerous as an environment contaminated with malware. The issue ofmanaging environments affects any individual researcher performing computational researchbut is more acute for multi-institution scientific collaborations as they often preside over complexsoftware stacks and must manage software environments across many distributed computingresources. Increasingly, these collaborations and individual investigators have turned to Linuxcontainer images (packing application software, operating system and other needed librariesinto one entity) for their platform portability and scientific reproducibility advantages. However, indoing so new software sources from both public and private repositories are introduced into thesupply chain, thus bringing new risks. The Securing an Open and Trustworthy Ecosystem forResearch Infrastructure and Applications (SOTERIA) project is an element within NSF's fabric ofcoordinated Cyberinfrastructure that helps collaborations avoid security pitfalls while reducingthe burden of scientific software management. SOTERIA aims to provide researchers withimproved discoverability, visibility, and traceability of their software environments.SOTERIA operates a container registry for open science. The registry has been customized tomeet the unique needs of the scientific environment, including associating the researcher’sidentity with container images, providing image security scanning and introspection (visibility),and integration with other digital object identification and archiving services. SOTERIA alsooperates a container distribution service with tools to trace image provenance through theecosystem. Finally, as the challenge of managing secure software environments goes farbeyond container security, SOTERIA provides training and education on best practices tailoredto researchers.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.