CICI: SSC: Horizon: Secure Large-Scale Scientific Cloud Computing

在过去的十年中，公共云和私有云成为计算密集型科学任务的事实上的平台。今天，大量的许多类型的科学数据被定期上传到云端。这些数据中的很大一部分是隐私和/或安全敏感的。不幸的是，尽管在网络和企业安全方面取得了许多进步，但现代云仍然存在固有的不安全性。最近的经验表明，资金充足的有针对性的攻击可以突破公共云和私有云的网络边界。Horizon是一种新颖的云架构，旨在科学云内提供数据和计算安全性。Horizon基于三个前提：（1）终端主机上的强隔离，（2）云网络中的细粒度隔离，以及（3）云范围的信息流控制。为了保护终端主机，Horizon开发了一个新的分层虚拟机管理程序和分散的虚拟化堆栈，其主要功能包括：语言安全，软件故障隔离和集成的软件验证。为了提供安全的云网络环境，Horizon依赖于新的网络架构，并实现了分布式网络防火墙，其中所有网络通信和权限交换都由对象能力系统的规则进行调解和控制。为了保护云数据，Horizon开发了一组抽象和机制来实施云范围的信息流控制。在Horizon中，所有数据都被标记。Horizon旨在为开发安全的云基础设施提供一个实用的基础，该基础设施适用于同时要求速度和安全性的大规模研究工作流。Horizon将使用完全开源的组件开发，并将向学术界和工业界的广大科学家社区开放。该奖项反映了NSF的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

Over the last decade, public and private clouds emerged as de facto platforms for computationally intensive scientific tasks. Today, huge volumes of many types of scientific data are routinely uploaded to the cloud. A large fraction of this data is privacy and/or security sensitive. Unfortunately, despite numerous advances in network and enterprise security, modern clouds remain inherently insecure. Recent experience shows that well-funded, targeted attacks manage to breach network perimeters of both public and private clouds. Horizon is a novel cloud architecture aimed at providing data and computation security within a scientific cloud. Horizon builds upon three premises: (1) strong isolation on end-hosts, (2) fine-grained isolation in the cloud network, and (3) cloud-wide information flow control. To protect the end-hosts, Horizon develops a new layered hypervisor, and disaggregated virtualization stack with key features of: language safety, software fault isolation, and integrated software verification. To provide secure cloud network environment, Horizon relies on a new network architecture and implements a distributed network firewall, where all network communication and exchange of rights are mediated and controlled by the rules of the object capability system. To protect the cloud data, Horizon develops a set of abstractions and mechanisms to enforce cloud-wide information flow control. In Horizon all data is labeled. The hypervisor mediates all communication of each virtual machine and enforces propagation of labels and security checks for each cloud computation.Horizon aims to provide a practical foundation for developing secure cloud infrastructure suitable for large-scale research workflows that require both speed and security. Horizon will be developed using entirely open-source components, and will be openly available to a broad community of scientists in academia and industry.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.