|
| 1 | +NIST SP 800-223 |
| 2 | + |
| 3 | +High-Performance Computing Security |
| 4 | +February 2024 |
| 5 | + |
| 6 | + |
| 7 | +iii |
| 8 | +Table of Contents |
| 9 | +1. Introduction ...................................................................................................................................1 |
| 10 | +2. HPC System Reference Architecture and Main Components ............................................................2 |
| 11 | +2.1.1. Components of the High-Performance Computing Zone ............................................................. 3 |
| 12 | +2.1.2. Components of the Data Storage Zone ........................................................................................ 4 |
| 13 | +2.1.3. Parallel File System ....................................................................................................................... 4 |
| 14 | +2.1.4. Archival and Campaign Storage .................................................................................................... 5 |
| 15 | +2.1.5. Burst Buffer .................................................................................................................................. 5 |
| 16 | +2.1.6. Components of the Access Zone .................................................................................................. 6 |
| 17 | +2.1.7. Components of the Management Zone ....................................................................................... 6 |
| 18 | +2.1.8. General Architecture and Characteristics .................................................................................... 6 |
| 19 | +2.1.9. Basic Services ................................................................................................................................ 7 |
| 20 | +2.1.10. Configuration Management ....................................................................................................... 7 |
| 21 | +2.1.11. HPC Scheduler and Workflow Management .............................................................................. 7 |
| 22 | +2.1.12. HPC Software .............................................................................................................................. 8 |
| 23 | +2.1.13. User Software ............................................................................................................................. 8 |
| 24 | +2.1.14. Site-Provided Software and Vendor Software ........................................................................... 8 |
| 25 | +2.1.15. Containerized Software in HPC .................................................................................................. 9 |
| 26 | +3. HPC Threat Analysis...................................................................................................................... 10 |
| 27 | +3.2.1. Access Zone Threats ................................................................................................................... 11 |
| 28 | +3.2.2. Management Zone Threats ........................................................................................................ 11 |
| 29 | +3.2.3. High-Performance Computing Zone Threats .............................................................................. 12 |
| 30 | +3.2.4. Data Storage Zone Threats ......................................................................................................... 12 |
| 31 | +4. HPC Security Posture, Challenges, and Recommendations ............................................................. 14 |
| 32 | +5. Conclusions .................................................................................................................................. 19 |
| 33 | +2.1. Main COMPONENNS..........cccccssccccssssccccssssecccssssecccsessseccessseeecsesseeceesseecsesseeesesseeecesaseecsesseeesessaeeesessaeeesD |
| 34 | +3.1. Key HPC Security Characteristics and Use REquireMent............cccsscccessccessecesssecesseecsssecesseeestessstree LO |
| 35 | +3.2. Threats to HPC FUNCTION ZONES.........cesccesscesscesscssscesecessssssssssscesscesscessssseeseesseascessssssessesssesssssessssees LO |
| 36 | +3.3. Other Threats ........cccccsccssccsscssccssecssscssscssscsseesssesssssesscesscseesesseeecessccssssssssessssssssssesessssssssssssssssesesLO |
| 37 | +4.1. HPC Access Control via Network S@gMeNtatiOn ...........ccccscccsssccessecessseceseccsssecessecessecesstecsssecesseessses LA |
| 38 | +4.2. Compute Node Sanitization ............cccccssecsssecsessccsseccsseecsseecceseecssseesseecssssesssesessssessseesssssesssessssessses |
| 39 | +LD |
| 40 | +4.3. Data Integrity Protection ............cccccccccccccessssssssccecccessessssssseecccesssesssssseescesssesssssseeesessssssstsssesesssssssesLO |
| 41 | +4.4. SECUFING CONTAINELSS ........eccesscccesssccccessseccceesscccessssecccesseeccesseeccessseeccessseccessssescessssesesssssescsssseseessLO |
| 42 | +4.5. Achieving Security While Maintaining HPC Performance. ..........cc:cccsscccessscesssecessecesssecesstcessseeesreesss LZ |
| 43 | +4.6. Challenges to HPC Security TOols..........c:ccccssccsssecceseecssseccssecessseccsseecssseecsseecssseecsssesssscssssessssssssssessse LD |
0 commit comments