提高BaBar探测器控制系统的安全性和性能
Improving the Security and Performance of the BaBar Detector Controls System
摘要：
它开始的时候很无辜-用户希望监视在线数据，因此在办公室和家里运行他们自己的检测器控制GUI副本。但随着时间的推移，请求在GUI、网页和条形图上显示值的进程数量可能会增加，并影响输入/输出控制器（IOC）的性能，使其无法响应来自对数据采集至关重要的请求的请求。在最坏的情况下，IOC会挂起，因为它的CPU已经被分配了100%来响应网络请求。对于BaBar在线检测器控制系统，我们能够消除这个问题，并通过将所有IOC移动到非路由的虚拟LAN，并通过使用带有两个网络接口卡的工作站作为虚拟LAN和公共BaBar网络之间的接口，在安全性方面取得了很大的进步。在接口机上，我们运行实验物理工业控制系统（EPICS）通道访问（CA）网关软件（源自高级光子源）。该软件接受所有IOC上加载到EPICS数据库中的所有通道作为输入。它轮询它们以更新其值的副本。它通过向应用程序发送当前缓存的值来应答来自应用程序的请求。我们采用的要求是，数据采集将独立于网关，这样，在网关故障的情况下，数据采集将不中断。通过这种方式，我们避免了在数据采集中引入任何新的风险因素。IOC已经使用的安全规则被传播到网关自己的安全规则中，IOC本身的安全性通过将其从公共BaBar网络中删除而得到改善。
英文摘要：
It starts out innocently enough - users want to monitor Online data and so run their own copies of the detector control GUIs in their offices and at home. But over time, the number of processes making requests for values to display on GUIs, webpages and stripcharts can grow, and affect the performance of an Input/Output Controller (IOC) such that it is unable to respond to requests from requests critical to data-taking. At worst, an IOC can hang, its CPU having been allocated 100% to responding to network requests. For the BaBar Online Detector Control System, we were able to eliminate this problem and make great gains in security by moving all of the IOCs to a non-routed, virtual LAN and by enlisting a workstation with two network interface cards to act as the interface between the virtual LAN and the public BaBar network. On the interface machine, we run the Experimental Physics Industrial Control System (EPICS) Channel Access (CA) gateway software (originating from Advanced Photon Source). This software accepts as inputs, all the channels which are loaded into the EPICS databases on all the IOCs. It polls them to update its copy of the values. It answers requests from applications by sending them the currently cached value. We adopted the requirement that data-taking would be independent of the gateway, so that, in the event of a gateway failure, data-taking would be uninterrupted. In this way, we avoided introducing any new risk elements to data-taking. Security rules already in use by the IOC were propagated to the gateway's own security rules and the security of the IOCs themselves was improved by removing them from the public BaBar network.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
