Cybersecurity for Scientific High-Performance Computing

The Office of Science (SC) provides world-class research infrastructure to accelerate scientific discovery within the DOE mission space. DOE SC ASCR user facilities include a highperformance network (HPN) and three high-performance computing (HPC) systems dedicated to open science research.

Each user facility is uniquely designed for the science it serves. For instance, HPC systems offer a massively parallel computing environment with numerous distributed nodes—login, compute, and data transfer nodes; high-speed interconnects; thousands of heterogeneous advanced processers such as CPUs and GPUs; and sophisticated schedulers, highly distributed file systems, and data storage systems. Scientific research infrastructure requires tailored cybersecurity approaches that accommodate specialized computational platforms and networks and respect an open science paradigm.

HPC platforms are different from enterprise systems in ways that require tailored cybersecurity solutions. Operating system level tools traditionally used for enterprise systems may be inapplicable to distributed HPC operating systems. The balance between performance and cybersecurity, as well as cybersecurity benchmarking, may be more challenging on HPC systems that are designed to deliver unprecedented performance. In addition, HPC software infrastructures evolve more rapidly than commercial counterparts while at the same time some HPC practitioners are actively investigating deployment of approaches more common in conventional server environments, such as, but not limited to, container software architectures.

Goals and Metrics • This topic area seeks applications that are tailored specifically to the unique needs of HPC systems. The narrative must convey a clear understanding of how HPC system architectures differ from enterprise platforms and consequently require tailored cybersecurity solutions, and how the applicant’s proposed solution meets these unique needs. For instance, but not limited to, the narrative must describe the applicant’s plan to ensure that the proposed HPC cybersecurity tool or technology does not impede HPC performance. • Applications for this topic area must clearly propose a cybersecurity solution that specifically reduces the cyberattack surface of HPC systems or component technology unique to HPC platforms. Component technologies unique to HPC platforms are not used in enterprise platforms. • The narrative must clearly articulate how the proposed cybersecurity solution will not impede HPC performance and must include an estimate of the performance overhead that will be introduced on target HPC workloads. Performance means the average execution time over the HPC target workloads specified in the narrative. • This topic area seeks tools or technologies to strengthen isolation of distinct jobs running on the same HPC node. Proposed solutions must improve user or project isolation, specifically in the context of either the HPC scheduler or the HPC filesystem. This could include, but is not limited to, a tool or technology that ensures an HPC node allocated to an authenticated user can only mount parts of the HPC file system to which the authenticated user has authorized access and ensures compute node sanitation following completion of one project and prior to the start of the next, as well as isolation of distinct jobs running simultaneously on a shared node. • This topic area also seeks SI-enabled tools or technologies that improve the observability of HPC system-level operations by 1) revealing anomalous behavior at the

system-level and 2) distinguishing anomalous behaviors that are legitimate although unexpected, from those that indicate malicious compromise. The SI tool or technology can be tailored to one or more of the zones – high-performance computing, data storage, access, and management – that comprise the HPC system reference architecture as described in the NIST Special Publication NIST SP 800 223 (Reference 1). It can be developed for runtime use or for offline static analysis, or both. This could include, but is not limited to, an SI tool or technology that analyzes the aggregated behavior of individual HPC constituent components such as, but not limited to, processors, nodes, interconnects, and distributed file systems, to reveal larger patterns of malicious behavior at the HPC system-level that may not be apparent at the individual component-level.

Not of Interest Proposed work is out of scope that: fails to identify target HPC workloads and provide an estimate of the performance overhead on those workloads; or is estimated to impede performance on HPC target workloads by more than 3%; or does not specifically address HPC systems or component technology unique to HPC platforms.

References 1. National Institute of Standards and Technology, High Performance Computing (HPC) Security: Architectures, Threat Analysis and Security Posture, NIST Special Publication 800-223, 2024, https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800- 223.pdf. 2. National Institute of Standards and Technology, High-Performance Computing (HPC) Security Overlay, NIST Special Publication 800-234, 2026, https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-234.pdf. 3. U.S. Department of Energy, Office of Science, ASCR Cybersecurity for Scientific Computing Integrity, DOE Workshop Report, 2015, https://www.energy.gov/sites/default/files/2015/08/f25/ASCR%20Cybersecurity%20for% 20Scientific%20Computing%20Integrity%20Workshop%20Report.pdf. 4. National Academies Press, Cyber Hard Problems: Focused Steps Toward a Resilient Digital Future, 2025, https://nap.nationalacademies.org/catalog/12345/cyber-hardproblems-focused-steps-toward-a-resilient-digital-future.