CICI: UCSS: SciAuth: Deploying Interoperable and Usable Authorization Tokens to Enable Scientific Collaborations

The SciAuth project facilitates a cybersecurity transformation for NSF cyberinfrastructure, which is the scientific computing infrastructure across the nation that enables scientific productivity. The transformation at the heart of the project is a migration from cybersecurity technologies from 20-years ago to the cybersecurity standards of the modern Web.

SciAuth provides needed leadership and coordination for this critical transformation through community engagement, coordinated adoption of community standards, integration with software cyberinfrastructure, security analysis and threat modeling, training, and workforce development. The project helps the community realize the benefits of an interoperable, modern cybersecurity ecosystem when transitioning between technologies, while maintaining the reliable and secure cyberinfrastructure upon which the scientific community depends.

This transition to modern cybersecurity mechanisms is critical for enabling productive scientific collaborations across a diverse and distributed scientific cyberinfrastructure ecosystem. SciAuth builds on prior work by the NSF SciTokens project, in partnership with domain science projects and cyberinfrastructure providers, to realize this cybersecurity breakthrough across NSF cyberinfrastructure.

SciAuth also supports the development of a diverse, globally competitive STEM workforce through a fellows program that pairs students across the country with mentors from the project to collaborate on student-led projects on the topic of cyberinfrastructure security.

The migration from X.509 user certificates to JSON Web Tokens is in progress across NSF cyberinfrastructure. This migration has facilitated a re-thinking of authentication and authorization among cyberinfrastructure providers: enabling federated authentication as a core capability, improving support for attribute, role, and capability-based authorization, and reducing reliance on prior identity-based authorization methods that created security and usability problems.

Achieving the benefits of a fundamentally new security credential ecosystem in NSF cyberinfrastructure, while avoiding the temptation to simply re-implement old X.509 methods, requires leadership and coordination. SciAuth provides the needed leadership and coordination to make these breakthrough technologies usable by scientists across disciplines, project sizes, and software ecosystems by enabling coordinated deployments across cyberinfrastructures in active use today.

This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.