Encryption at Rest for Research Data on Unencrypted High Performance Computing Infrastructure: Implementation using gocryptfs

Le résumé fourni par la source

This document describes the technical solution implemented to achieve encryption at rest for sensitive research data stored and processed on Isambard AI Phase 1 or 2 or Isambard 3, high performance computing (HPC) facilities hosted by the University of Bristol, Bristol Centre for Supercomputing (BriCS). The solution is designed to meet NHS data controller requirements for the protection of identifiable or potentially re-identifiable clinical data.The approach uses gocryptfs, https://nuetzlich.net/gocryptfs/, an open-source encrypted overlay filesystem, to ensure that research datasets are stored in encrypted form on the HPC filesystem at all times. Decryption occurs exclusively in memory during authorised compute jobs via a FUSE (Filesystem in Userspace) mount. No plaintext data is ever written to persistent storage.Key properties of the solution:• Data is encrypted using AES-256-GCM, a NIST (National Institute of Standards and Technology) approved authenticated encryption algorithm.• Plaintext exists only transiently in memory during compute jobs and is never persisted to disk.• The decrypted view is scoped to the process owner and compute job; it cannot be accessed by other users or jobs on the system.• When the compute job ends, the FUSE mount is destroyed and the decrypted view ceases to exist.• The encrypted data on disk is additionally protected by POSIX filesystem permissions (mode 700).An example repository containing a demo: https://github.com/grpEHR/enc-at-rest-example

Ce résumé expose les affirmations des auteurs. BNTIC ne l’interprète pas comme une validation indépendante des résultats.