Paper Info
Title
Enhancing HPC security with a user-based firewall
Abstract
High Performance Computing (HPC) systems traditionally allow their users unrestricted use of their internal network. While this network is normally controlled enough to guarantee privacy without the need for encryption, it does not provide a method to authenticate peer connections. Protocols built upon this internal network, such as those used in MPI, Lustre, Hadoop, or Accumulo, must provide their own authentication at the application layer. Many methods have been employed to perform this authentication, such as operating system privileged ports, Kerberos, munge, TLS, and PKI certificates. However, support for all of these methods requires the HPC application developer to include support and the user to configure and enable these services. The user-based firewall capability we have prototyped enables a set of rules governing connections across the HPC internal network to be put into place using Linux netfilter. By using an operating system-level capability, the system is not reliant on any developer or user actions to enable security. The rules we have chosen and implemented are crafted to not impact the vast majority of users and be completely invisible to them. Additionally, we have measured the performance impact of this system under various workloads.
Year
DOI
Venue
2016
10.1109/HPEC.2016.7761641
2016 IEEE High Performance Extreme Computing Conference (HPEC)
Keywords
DocType
Volume
Security,Firewall,HPC,netfilter,MIT SuperCloud
Conference
abs/1607.02982
ISSN
ISBN
Citations 
2377-6943
978-1-5090-3526-7
4
PageRank 
References 
Authors
0.43
7
16
Name
Order
Citations
PageRank
Andrew Prout118218.78
William Arcand217517.77
David Bestor318119.08
Bill Bergeron416816.57
Chansup Byun518019.21
Vijay Gadepally644950.53
Matthew Hubbell719220.93
Michael Houle86310.42
Michael J. Jones911341927.21
Peter Michaleas1020120.93
Lauren Milechin1110216.45
Julie Mullen1213815.22
Antonio Rosa1317017.67
Siddharth Samsi1420124.09
Albert Reuther1533537.32
Jeremy Kepner1660661.58