CICI: SSC: Securing Science Gateway Cyberinfrastructure with Custos

科学网关是基于web的门户，供科学家、教育工作者和学生方便地访问先进的计算基础设施、执行可重复的研究和共享科学数据。科学门户被全世界数以万计的研究人员使用；因此，网关越来越成为各种网络安全攻击的目标。在网络安全方面，科学网关是一组丰富资产的集合和集成，包括用户身份，对广泛的第三方计算和存储资源的访问，敏感数据，许可或其他限制软件，以及生成的科学结果。对科学门户的妥协的后果是广泛的，包括对计算资源和数据的未经授权的访问，以及更微妙的攻击，如改变计算结果，这可能需要撤回出版物，否则会破坏科学事业的完整性。通过对同类最佳软件的集成和扩展，customs项目提供了一个单一的开源软件解决方案，可以改善科学网关对用户身份、用于访问科学研究所需的广泛资源的安全令牌等秘密以及科学网关用户创建的数字研究对象的分组和共享权限的管理。客户软件用于运行安全的在线服务，为科学门户社区提供独立于语言的编程接口，为研究多租户、以科学为重点的网络基础设施提供操作平台和试验场。整个客户环境，包括供应和操作工具，都遵循Apache软件基金会的精英管理和多样性原则进行公开管理。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

Science gateways are web-based portals for scientists, educators, and students to easily access advanced computing infrastructure, perform reproducible research, and share scientific data. Science gateways are used by tens of thousands of researchers worldwide; thus, gateways are an increasingly attractive target for a wide range of cybersecurity attacks. In cybersecurity terms, science gateways are a collection and integration of a rich set of assets, including user identities, access to a wide range of third party computing and storage resources, sensitive data, licensed or otherwise restricted software, and generated scientific results. The consequences of compromises to science gateways are wide ranging, including unauthorized access to computing resources and data as well as more subtle attacks such as alterations of computed results that may require retraction of publications and otherwise undermine the integrity of the scientific enterprise. Through the integration and extension of best-of-breed software, the Custos project provides a single, open source software solution that improves science gateways' management of users identities, secrets such as security tokens used to access a wide range of resources needed for scientific research, and groups and sharing permissions on digital research objects created by science gateway users. Custos software is used to operate a secure, online service with a language-independent programming interface for the science gateway community, providing both an operational platform and a proving ground for research into multi-tenanted, science-focused cyberinfrastructure. The entire Custos environment, including provisioning and operations tools, is openly governed following the meritocracy and diversity principles of the Apache Software Foundation.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.