SciTokens：基于能力的远程科学数据安全访问
SciTokens: Capability-Based Secure Access to Remote Scientific Data
摘要：
安全凭证的管理（例如，密码、密钥）是科学家和信息安全官员的负担。凭证问题（例如，过期、特权不匹配）导致工作流无法获取所需的输入数据或存储有价值的科学结果，从而通过要求科学家诊断问题、重新运行他们的计算以及等待更长时间以获得他们的结果而使他们从他们的研究中分心。在本文中，我们介绍了开源软件SciTokens，以帮助科学家更可靠，更安全地管理他们的安全凭证。我们描述了SciTokens系统的架构、设计和实现，解决了激光干涉仪引力波天文台（LIGO）科学合作和大型综合巡天望远镜（LSST）项目的用例。我们还介绍了我们与广泛使用的支持分布式科学计算的软件的集成，包括HTCondor，CVMFS和XrootD。SciTokens使用IETF标准的OAuth令牌，用于基于能力的远程科学数据安全访问。访问令牌传达工作流所需的特定授权，而不是通用认证模拟凭证，以解决在包括NSF资源的分布式基础设施上运行的科学工作流的风险（例如，LIGO数据网格，开放科学网格，XSEDE）和公共云（例如，Amazon Web Services、Google Cloud、Microsoft Azure）。通过提高科学工作流程的互操作性和安全性，SciTokens 1）使分布式计算能够用于需要更大数据保护的科学领域，2）通过降低远程系统上的凭证滥用风险，使更广泛的分布式计算资源能够使用。
英文摘要：
The management of security credentials (e.g., passwords, secret keys) for computational science workflows is a burden for scientists and information security officers. Problems with credentials (e.g., expiration, privilege mismatch) cause workflows to fail to fetch needed input data or store valuable scientific results, distracting scientists from their research by requiring them to diagnose the problems, re-run their computations, and wait longer for their results. In this paper, we introduce SciTokens, open source software to help scientists manage their security credentials more reliably and securely. We describe the SciTokens system architecture, design, and implementation addressing use cases from the Laser Interferometer Gravitational-Wave Observatory (LIGO) Scientific Collaboration and the Large Synoptic Survey Telescope (LSST) projects. We also present our integration with widely-used software that supports distributed scientific computing, including HTCondor, CVMFS, and XrootD. SciTokens uses IETF-standard OAuth tokens for capability-based secure access to remote scientific data. The access tokens convey the specific authorizations needed by the workflows, rather than general-purpose authentication impersonation credentials, to address the risks of scientific workflows running on distributed infrastructure including NSF resources (e.g., LIGO Data Grid, Open Science Grid, XSEDE) and public clouds (e.g., Amazon Web Services, Google Cloud, Microsoft Azure). By improving the interoperability and security of scientific workflows, SciTokens 1) enables use of distributed computing for scientific domains that require greater data protection and 2) enables use of more widely distributed computing resources by reducing the risk of credential abuse on remote systems.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
