Introduction
HiPerGator-RV is completely separate from other computing infrastructure in the data center so that compromise of nearby systems cannot lead to a compromise of the systems in the data enclave. HiPerGator-RV systems sit in separate racks, with separate network switches and connections.
The general client computer is not trusted to hold ePHI data. Users can access HiPerGator-RV only through a secure SSL network connection after GatorLink authentication and all traffic will be carried encrypted to the HiPerGator-RV gateway system over all traversed networks. The gateway system provides further authentication through a secret key created for each user upon first use of the HiPerGator-RV system. The HiPerGator-RV gateway then establishes a secure, high-performance virtual desktop session with a VM running inside the vault. The system ensures that the researcher can use applications to analyze authorized data.
Interactive work on the data is done from VMs running on infrastructure inside the vault. The size of the VM can be controlled by the developers and researchers so that applications that need multiple cores or large amounts of memory have the resources to run efficiently. Very large workloads and complex, multi-task work flows can be run interactively or asynchronously on the HPC resources inside the enclave. The HPC resources have been configured to support high-performance access to the data storage system.
The initial configuration of the HiPerGator-RV system has 200 cores from Intel E5-2670v2 processors with 6.4 GB of RAM per core. It has a fast primary storage system connected by InfiniBand of 1.2 PetaByte and a 400 TeraByte secondary storage system that keeps the second copy as a replica of all user data. User data, all encrypted, is backed up daily to the tape robot.
The system configuration is very specialized and highly locked down. The configuration of the nodes is generated automatically and changes go through a rigorous process.
File Sharing
File sharing within HiPerGator-RV is made simple and secure through the utilization of public/private key encryption.
Sharing is a simple right-click operation within the file management system for tiCrypt. The share is then managed within tyCrypt securely utilizing the encryption keys of both parties.
Secure Virtual Machines
A key component of HiPerGator-RV is the ability to launch virtual machines on behalf of users within the secure environment. All VM connections are done through in-house forwarding written directly on top of OpenSSL’s TLS functionality, which is fully FIPS 140-2 compliant and actually allows for more access control than SSH did, meaning users have access to explicitly specified VM features and nothing more.
All user interaction with VMs is monitored and logged by HiPerGator-RV just like other areas of the system. The system supports both Linux and Windows images with varying available memory and number of CPU cores. Administrators have the ability to manage VM use, but have no access to the VM itself.
Project Tagging
Projects are a security tagging mechanism that allow for any type of resource within HiPerGator-RV (file, directory, drive, VM) to be tagged and associated with one project tag. Once a resource has been tagged by a project level, the way it can be manipulated or accessed is significantly restricted. This is based on the custom security levels associated with the project.
Mailboxes
There are many situations in which researchers collaborate with those outside their internal system, leaving many opportunities for files to be exchanged insecurely during communication. HiPerGator-RV offers a simple collaboration tool that enables HiPerGator-RV users to send the address of an encrypted HiPerGator-RV folder and their public key to individuals outside the system, using the mailboxes service.
Files can then be encrypted on the outside collaborator’s computers using the public key, and the encrypted files can finally be uploaded worry-free to the mailbox, where only the user with the appropriate private key can decrypt them.
Manual for tiCrypt
The full, detailed manual for the tiCrypt software can be found at ticrypt.com, provided by Tera Insights.
Further Documentation and Help Pages
Further documentation on using HiPerGator-RV and tiCrypt as implemented at UF can be found on the help pages in the How-To Guide.