CICI:UCSS:Securing an Open and Trustworthy Ecosystem for Research Infrastructure and Applications (SOTERIA)

点击翻译按钮获取中文摘要

Managing a secure software environment is essential to a trustworthy cyberinfrastructure.Software supply chain attacks may be a top concern for IT departments, but they are also anaspect of scientific computing. The threat to scientific reputation caused by problematic softwarecan be just as dangerous as an environment contaminated with malware. The issue ofmanaging environments affects any individual researcher performing computational researchbut is more acute for multi-institution scientific collaborations as they often preside over complexsoftware stacks and must manage software environments across many distributed computingresources. Increasingly, these collaborations and individual investigators have turned to Linuxcontainer images (packing application software, operating system and other needed librariesinto one entity) for their platform portability and scientific reproducibility advantages. However, indoing so new software sources from both public and private repositories are introduced into thesupply chain, thus bringing new risks. The Securing an Open and Trustworthy Ecosystem forResearch Infrastructure and Applications (SOTERIA) project is an element within NSF's fabric ofcoordinated Cyberinfrastructure that helps collaborations avoid security pitfalls while reducingthe burden of scientific software management. SOTERIA aims to provide researchers withimproved discoverability, visibility, and traceability of their software environments.SOTERIA operates a container registry for open science. The registry has been customized tomeet the unique needs of the scientific environment, including associating the researcher’sidentity with container images, providing image security scanning and introspection (visibility),and integration with other digital object identification and archiving services. SOTERIA alsooperates a container distribution service with tools to trace image provenance through theecosystem. Finally, as the challenge of managing secure software environments goes farbeyond container security, SOTERIA provides training and education on best practices tailoredto researchers.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.