利用OpenStack和Ceph构建访问受控的数据云
Leveraging OpenStack and Ceph for a Controlled-Access Data Cloud
摘要：
虽然传统的HPC已经并将继续满足大多数工作流程，但新一代的研究人员正在寻找在云环境中对计算基础设施进行复杂、可扩展、按需和自助式控制。许多企业还寻求安全港，以便在高容量环境中操作或存储敏感和/或访问受控的数据。为了满足这些现代用户的需求，明尼苏达超级计算研究所设计并部署了Stratus，这是一个由OpenStack平台提供支持并由Ceph存储支持的本地托管云环境。基于订阅的服务通过满足用户的以下未满足的需求来补充现有HPC系统：a）计算资源的按需可用性，b）长时间运行的作业（即，$> 30$天），c）使用Docker进行基于容器的计算，以及d）充分的安全控制以符合受控访问数据要求。本文档深入介绍了Stratus在安全性和遵守NIH受控访问数据政策方面的设计。重点是在将OpenStack和Ceph功能集成到所谓的“围墙花园”中时吸取的经验教训，以及这些技术如何影响安全设计。Stratus的许多功能，包括引入受控访问数据“缓存”的分层安全存储、容错实时迁移和完全集成的双因素身份验证，都依赖于最近的OpenStack和Ceph功能。
英文摘要：
While traditional HPC has and continues to satisfy most workflows, a new generation of researchers has emerged looking for sophisticated, scalable, on-demand, and self-service control of compute infrastructure in a cloud-like environment. Many also seek safe harbors to operate on or store sensitive and/or controlled-access data in a high capacity environment. To cater to these modern users, the Minnesota Supercomputing Institute designed and deployed Stratus, a locally-hosted cloud environment powered by the OpenStack platform, and backed by Ceph storage. The subscription-based service complements existing HPC systems by satisfying the following unmet needs of our users: a) on-demand availability of compute resources, b) long-running jobs (i.e., $> 30$ days), c) container-based computing with Docker, and d) adequate security controls to comply with controlled-access data requirements. This document provides an in-depth look at the design of Stratus with respect to security and compliance with the NIH's controlled-access data policy. Emphasis is placed on lessons learned while integrating OpenStack and Ceph features into a so-called "walled garden", and how those technologies influenced the security design. Many features of Stratus, including tiered secure storage with the introduction of a controlled-access data "cache", fault-tolerant live-migrations, and fully integrated two-factor authentication, depend on recent OpenStack and Ceph features.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
