THE CENTRAL COMPUTING CORE

中央计算核心

• 批准号: 7602352
• 负责人: ROBERT M SWEET
• 金额: $ 12.04万
• 依托单位: BROOKHAVEN SCIENCE ASSOC-BROOKHAVEN LAB
• 依托单位国家: 美国
• 财政年份: 2007
• 资助国家: 美国
• 起止时间: 2007-07-01 至 2008-06-30
• 项目状态: 已结题
• 来源: https://reporter.nih.gov/project-details/7602352
• 关键词: Accounting; Budgets; Client; Collection; Computer Retrieval of Information on Scientific Projects Database; Computer software; Computers; Data; Data Analyses; Data Storage and Retrieval; Databases; Development; Documentation; Emergency Situation; Environment; Equipment; Failure; Funding; Goals; Grant; Hand; Housing; Human Resources; Institution; Internet; Linux; Local Area Networks; Maintenance; Monitor; Names; National Center for Research Resources; Operative Surgical Procedures; Penetration; Power Sources; Procedures; Process; Rapid Access to Intervention Development; Rate; Research; Research Infrastructure; Research Personnel; Resources; Running; Scanning; Scheme; Secure; Security; Services; Side; Silver; Site; Solutions; Source; Stretching; System; Testing; Thinking; Time; United States National Institutes of Health; Weight; Work; Writing; beamline; computing resources; cost effective; day; improved; programs; research study

This subproject is one of many research subprojects utilizing the resources provided by a Center grant funded by NIH/NCRR. The subproject and investigator (PI) may have received primary funding from another NIH source, and thus could be represented in other CRISP entries. The institution listed is for the Center, which is not necessarily the institution for the investigator. Objectives  This project represents core computing support, including essentially all control and processing computers employed at five of the six beamlines within the PXRR (X8-C mostly handles its own). It includes centralized data-storage facilities and administrative servers, beamline servers and workstations at all of our experimental stations, additional processing / analysis / data-backup machines, and the networking infrastructure tying it all together. The guiding principle is to purchase small, standardized, commodity components that are inexpensive enough that they can be replaced at the end of their serviceable lifetime. There are parallel objectives of centralizing systems-management of this collection of systems, and standardizing the computing environment for users throughout our enterprise. This includes hardware, software, and naming schemes. Things are easily maintainable: since parts are interchangeable, spares can be shared, and maintenance and configuration procedures are the same. It is convenient for users to move from site to another since computing appears the same. Our original plan for the past year was for incremental improvements, with focus on storage and remote access. A storm of DOE-mandated cyber-security activity, including a day long "standdown" during which the lab was cut off from the internet, consumed a major chunk of our manpower and has delayed much of our planned work. Results  The rather unusual plan, provided by the NCRR, of having a regular annual budget for computing hardware allows us essentially to keep up with demand for raw computing resources. We organize the computing infrastructure into separate groups dedicated to beamline control, storage, processing, and administration. Each beamline has a hidden computer for overall control, one seat where the user/operator may run and monitor the experiment, and usually two seats with high power processors for data reduction. There are two sites on opposite sides of the NSLS x-ray ring, known as Cyber Caf¿s, where there are four to six processing seats. There is also an automatic DVD-writing machine in each Cyber Caf¿. Our storage resources total 15TB of disk space, divided among 11 separate RAID units. Each beamline is flexibly assigned a primary and secondary space. An equipment rack with dual un-interruptible power supplies houses all of this disk storage and the central servers for our gigabit-rate local-area network. It all provides robust service. On the other hand, because were thinly staffed throughout the PXRR, the year of delays caused by the cyber-security emergencies have delayed our work on storage improvements, remote access, and other refinements. We are forced to be reactive rather than rational. Fortunately our experimental stations rarely suffer, but we are not advancing in the way we would like. Here are some of the things weve been required to do: 1. Installed the "ordo" (auditing) client on all Linux/Unix systems. 2. All Windows systems were joined to BNL's Microsoft Windows Domain and configured with MS's Systems Management Server client as mandated. 3. Created a Cyber Security Program Plan "Subsystem" documentation for PXRR systems (a 24 page document). 4. Our system manager, Matt Cowan contributed significantly to NSLS Subsystem docs, necessary because were as a major NSLS user group. 5. Cowan worked with NSLS and BNL's Cyber Security Advisory Council to develop "variance" solutions for "deficiencies" noted during the standdown. The variance process started out as a complete duplication and expansion of all the work which went into the subsystem documentation, but recently has collapsed under it's own weight, now takes into account our existing subsystem documentation, and has become much more bearable. 6. Significant time was spent dealing with a DOE penetration-testing team (The Red Team) and it's aftermath. They were able to get into our systems through a very poorly configured system of one of a nearby research groups. 7. We still suffer occasional system failures that are owed to security scans by BNLs cyber-security teams. 8. We must make other substantial effort to satisfy DOE's demand for centralized administration of our systems. The only silver lining to this dark cloud is that it has forced us to create a new system that handles some services like the web site and our database, although these were lower priority among our operational goals. Plans  Well attempt to foresee places where incremental improvements to the systems will be useful. A serious developmental objective for next year will be to accomplish remote beamline operation, somehow being cyber-secure at the same time. Unfortunately our plans must include responding to unfunded DOE cyber-security mandates. One of these is to install a system for user authentication called Centrify, which in fact may eventually provide us with a robust means to provide easily manageable system accounts for each of our experimental groups, instead of our current practice of using a single, shared operator account. The objective will be to improve our own cybersecurity within reasonable limits while at the same time working on our own scientifically urgent objectives. Significance  Our computing infrastructure provides extremely cost effective processing, storage, and networking to the entire PXRR. The system has proven to be nicely scalable and adaptable as our needs change. Continued refinement will only make it better and something we need to think about less and less. However, with the goals we would like to achieve (too many details to mention here), and with the current, ongoing DOE security initiatives, we find our manpower stretched, and the target dates for the above items slipping further away.

该子项目是利用该技术的众多研究子项目之一 资源由 NIH/NCRR 资助的中心拨款提供。子项目和 研究者 (PI) 可能已从 NIH 的另一个来源获得主要资金， 因此可以在其他 CRISP 条目中表示。列出的机构是 对于中心来说，它不一定是研究者的机构。 目标 该项目代表核心计算支持，基本上包括 PXRR 内 6 条光束线中的 5 条所使用的所有控制和处理计算机（X8-C 主要处理它自己的）。 它包括集中数据存储设施和管理服务器、我们所有实验站的光束线服务器和工作站、额外的处理/分析/数据备份机器以及将它们连接在一起的网络基础设施。 指导原则是购买足够便宜的小型标准化商品组件，以便在使用寿命结束时进行更换。 并行的目标是集中系统管理这组系统，并为整个企业的用户标准化计算环境。 这包括硬件、软件和命名方案。 易于维护：由于零件可以互换，因此可以共享备件，并且维护和配置程序相同。 由于计算看起来是相同的，因此用户可以很方便地从一个站点移动到另一个站点。 我们去年的最初计划是渐进式改进，重点是存储和远程访问。 美国能源部授权的一系列网络安全活动，包括实验室与互联网断开连接的长达一天的“停工”，消耗了我们大量的人力，并推迟了我们计划的大部分工作。 结果 NCRR 提供的相当不寻常的计划是为计算硬件制定定期年度预算，使我们基本上能够满足对原始计算资源的需求。 我们将计算基础设施组织成单独的组，专门用于光束线控制、存储、处理和管理。 每条光束线都有一台用于整体控制的隐藏计算机，一个用户/操作员可以运行和监控实验的座位，通常还有两个带有高功率处理器的座位，用于数据缩减。 NSLS X 射线环的两侧有两个站点，称为网吧，其中有四到六个处理座位。 每个网吧还设有自动 DVD 刻录机。 我们的存储资源总计 15TB 磁盘空间，分为 11 个独立的 RAID 单元。 每条光束线都被灵活地分配主空间和次空间。 具有双不间断电源的设备机架容纳了所有这些磁盘存储和我们千兆位速率局域网的中央服务器。 这一切都提供了强大的服务。 另一方面，由于我们整个 PXRR 的人员很少，一年来因网络安全紧急情况而造成的延误推迟了我们在存储改进、远程访问和其他改进方面的工作。 我们被迫做出反应而不是理性。 幸运的是，我们的实验站很少受到影响，但我们并没有按照我们希望的方式前进。 以下是我们被要求做的一些事情： 1. 在所有 Linux/Unix 系统上安装“ordo”（审计）客户端。 2. 所有Windows 系统均已加入BNL 的Microsoft Windows 域，并按要求配置了MS 的系统管理服务器客户端。 3. 为 PXRR 系统创建网络安全计划计划“子系统”文档（24 页文档）。 4. 我们的系统经理 Matt Cowan 对 NSLS 子系统文档做出了重大贡献，这是必要的，因为我们是主要的 NSLS 用户组。 5. Cowan 与 NSLS 和 BNL 的网络安全咨询委员会合作，针对停工期间发现的“缺陷”制定“差异”解决方案。 差异过程最初是对子系统文档中所有工作的完全复制和扩展，但最近在其自身的重量下崩溃了，现在考虑到了我们现有的子系统文档，并且变得更加容易忍受。 6. 花费了大量时间与 DOE 渗透测试团队（红队）打交道及其后果。 他们能够通过附近一个研究小组的一个配置非常糟糕的系统进入我们的系统。 7. 由于 BNL 网络安全团队的安全扫描，我们仍然偶尔会遇到系统故障。 8. 我们必须做出其他实质性的努力来满足能源部对我们系统的集中管理的要求。 这片乌云的唯一一线希望是，它迫使我们创建一个新系统来处理网站和数据库等一些服务，尽管这些服务在我们的运营目标中优先级较低。 计划 我们将尝试预见对系统进行增量改进将有用的地方。 明年的一个重要发展目标将是完成远程光束线操作，同时以某种方式保证网络安全。 不幸的是，我们的计划必须包括响应能源部没有资金支持的网络安全任务。 其中之一是安装一个名为 Centrify 的用户身份验证系统，它实际上可能最终为我们提供一种强大的方法，为每个实验组提供易于管理的系统帐户，而不是我们目前使用单个共享操作员帐户的做法。 目标是在合理范围内改善我们自己的网络安全，同时努力实现我们自己的科学紧迫目标。 意义 我们的计算基础设施为整个 PXRR 提供了极具成本效益的处理、存储和网络。 事实证明，该系统具有良好的可扩展性和适应性，可以随着我们需求的变化而变化。 不断的完善只会让它变得更好，我们需要思考的事情会越来越少。 然而，随着我们想要实现的目标（这里有太多细节无法提及），以及能源部当前正在进行的安全举措，我们发现我们的人力捉襟见肘，并且上述项目的目标日期越来越远。