CICI: SSC: Development of a Secure and Privacy-Preserving Workflow Architecture for Dynamic Data Sharing in Scientific Infrastructures

科学网络基础设施包括协作工作流程，用户可以访问和共享异构数据和计算资源，以执行研究和教育任务，从而促进科学发现。其中一个网络基础设施JetStream是由NSF资助的第一个生产云，用于通用科学和工程研究和教育。虽然Jetstream提供基本的数据存储安全性和Web身份验证，但其安全功能无法满足涉及敏感数据的严格要求，例如具有受保护健康信息（PHI）的医疗保健数据。该项目在JetStream上构建了一个安全、全面和弹性的网络安全架构，以便合作研究和教育项目可以在其用户之间安全地共享PHI。安全的基础设施通过用户身份验证、微调的数据访问控制、机密性、完整性和可追溯性，为PHI及其工作流程提供全面的多层次保护。该项目实现了基于角色的无密码认证和授权、基于密码的分级访问控制、双层密钥管理和安全的数字出处完整性保护。通过采用这些技术，JetStream VM可以保证科学工作流程和相关数据的安全性、隐私性和完整性，从而保护数据和计算资源免受内部和外部攻击。当应用于医疗保健和生命科学网络基础设施时，它可以安全地共享敏感的健康数据，这是加速生命科学研究的基本要求。该项目促进在培训中使用真实的临床数据，以产生巨大的教育影响。该奖项反映了NSF的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

Scientific cyberinfrastructures embrace collaborative workflows where users can access and share heterogeneous data and computing resources to perform research and education tasks, which catalyze scientific discovery. One such cyberinfrastructure, JetStream, is the first production cloud funded by the NSF for general-purpose science and engineering research and education. Although Jetstream provides basic data storage security and web authentication, its security features do not satisfy the strict requirements involving sensitive data, such as healthcare data with protected health information (PHI). This project builds a secure, holistic and resilient cybersecurity architecture on JetStream so that collaborative research and education projects can share PHI securely between its users.The secured infrastructure provides comprehensive multi-level protection for the PHI and its workflows through user authentication, fine-tuned data access control, confidentiality, integrity, and traceability. The project implements role-wise passwordless authentication and authorization, cryptography-based hierarchical access control, dual-level key management, and secure digital provenance integrity protection. By employing these, JetStream VMs can guarantee the security, privacy, and integrity of scientific workflows and associated data, thus protecting data and computing resources from internal and external attacks. When applied to healthcare and life-science cyberinfrastructures, it enables sensitive health data to be shared securely, which is an essential requirement for accelerating life science research. The project promotes the use of real clinical data in training to produce enormous educational impacts. The developed secure architecture is generic and applicable to other data and resource sharing environments.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.