SDCI Sec: Distributed Web Security for Science Gateways

科学网关通过为学生和研究人员提供基于Web的协作、分析、数据管理和其他工具的接口，扩大和简化了对网络基础设施（CI）的访问。在最近对5，000名NSF PI的调查中，NSF的校园桥接工作组发现，“在整个供应商层面上访问CI的最常见方法是通过Web浏览器/门户。“随着这些网络基础设施的科学网关接口越来越受欢迎，Web门户开发人员采用特别的方法来应对身份验证、授权和委托的安全挑战。科学网关代表研究人员整合网络基础设施资源，即，访问数据、计算周期、仪器和其他宝贵资源。资源访问通常需要使用研究人员的安全凭证，在某些情况下，研究人员的长期密码可能会在科学网关处受到损害。对于研究人员来说，没有标准的方法来控制和限制科学网关对他或她的资源的访问。因此，研究人员在使用科学网关时必须承担不必要的高风险。“科学网关的分布式网络安全”项目将直接解决这些风险，为科学网关提供符合互联网工程任务组标准OAuth协议的授权和委托软件，该协议已被广泛应用于Web 2.0、云和社交网络世界。该项目将提供1）一个强大的，文档齐全的OAuth服务器实现，支持科学网关用例，2）一组客户端库和身份验证模块，使当前和未来的网关能够与服务器实现进行交互，开箱即用，具有通用的Web平台，和3）与流行网关和网络基础设施提供商完全集成。该项目将通过以下方式加强研究和教育的网络基础设施：为科学网关安全提供通用软件构建块。这些构件将促进网关和其他网络基础设施之间的安全连接，增加科学家和资源提供者对基于网络的界面的信任。目前正在进行的从命令行到基于网络的界面的迁移有望扩大研究人员和学生对网络基础设施的使用，提高教育影响和研究人员的生产力。安全往往是网络基础设施部署和使用的绊脚石。通过解决常见的安全用例，该项目将提供标准方法，以促进安全的网络基础设施访问。

Science gateways broaden and simplify access to cyberinfrastructure (CI) by providing Web-based interfaces to collaboration, analysis, data management, and other tools for students and researchers. In a recent survey of 5,000 NSF PIs, NSF's Campus Bridging Task Force found that "the most common method of accessing CI across the entire dimension of providers is via Web browser/portal." As these science gateway interfaces to cyberinfrastructure grow in popularity, Web portal developers adopt ad hoc approaches to the security challenges of authentication, authorization, and delegation. Science gateways integrate cyberinfrastructure resources on the researcher's behalf, i.e., accessing data, compute cycles, instruments, and other valuable resources. Resource access often requires use of the researcher's security credentials, in some cases exposing the researcher's long-lived password to potential compromise at the science gateway. There is no standard approach for a researcher to control and limit a science gateway's access to his or her resources. Thus, researchers are required to accept an unnecessarily high risk when using science gateways.The "Distributed Web Security for Science Gateways" project will directly address these risks by providing authorization and delegation software for science gateways that complies with the Internet Engineering Task Force's standard OAuth protocol, which has been widely adopted in the Web 2.0, cloud, and social networking worlds. The project will deliver 1) a robust, well-documented OAuth server implementation supporting science gateway use cases, 2) a set of client libraries and authentication modules to enable current and future gateways to interact with the server implementation out of the box with common Web platforms, and 3) full integration with popular gateways and cyberinfrastructure providers.The project will enhance cyberinfrastructure for research and education by providing common software building blocks for science gateway security. These building blocks will facilitate secure connections between gateways and other cyberinfrastructure, increasing the trust in Web-based interfaces by scientists and resource providers. The ongoing migration from command-line to Web-based interfaces promises to broaden the use of cyberinfrastructure by researchers and students, enhancing educational impact and researcher productivity. Too often security is a stumbling block for cyberinfrastructure deployment and use. By addressing common security use cases, the project will provide standard methods to facilitate secure cyberinfrastructure access.