1   Abstract¶

Proprietary Rubin Observatory astronomical data must be transferred from the summit facility where the data is captured to the USDF (United States Data Facility) for processing. This document delineates a data transfer implementation strategy to maintain confidentiality of the data in transit. This strategy addresses the concerns identified in DMTN-108.

2   Problem statement¶

Data captured by the camera attached to the Charles Simonyi Survey Telescope on Cerro Pachón in Chile will be transferred from the summit facility to the USDF for processing. That processing includes quickly analyzing the images for transient phenomena of interest to the astronomy research community (alert production, part of Prompt Processing), and slower and more comprehensive processing for yearly data releases (Data Release Processing). The alerts produced as a result of Prompt Processing will be immediately made available to the public but will not contain detailed images. See LPM-231 and LPM-163 for more information about LSST Data Products.

Alerts must be released within sixty seconds after the close of the shutter. Both the data transfer to the USDF and the processing done at the USDF must complete within those sixty seconds.

The raw images and other data, prior to processing, are proprietary and not intended for public release as discussed in DMTN-108. This implies a requirement for confidentiality in data transfer from the summit to the USDF.

As discussed in LPM-121, security controls for the Vera C. Rubin Observatory are selected from the NIST SP 800-171 controls catalog based on the risk level of the relevant system. Confidentiality of data transfer to the USDF corresponds to control 3.13.8 in NIST SP 800-171 Rev. 2: “Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.” This document describes how this control will be implemented.

NIST SP 800-172 documents additional security measures for protecting Controlled Unclassified Information in some situations. We believe this document does not apply to Rubin Observatory because it is neither a “critical program” nor a “high value asset” in the sense defined by NIST SP 800-171 and OMB M-19-03.

3   Proposed implementation¶

Data transfer from the summit facility, or the base facility in La Serena, to the USDF will use TLS version 1.2 or later. TLS will be configured on the server and client according to the guidelines in the applicable NIST standard (NIST SP 800-52 Rev. 2), with one exception noted below. This includes the following requirements:

• TLS 1.2 or 1.3 required by both client and server
• Server TLS certificate issued by a CA that publishes revocation information via OCSP
• Cipher suites restricted to NIST-approved algorithms
• TLS extensions implemented as described

The client may authenticate to the server inside the TLS-protected request via a mechanism other than mutual certificate authentication. Client certificate authentication is not required. However, the client must verify the server certificate as described in the NIST guidance.

The one exception from the NIST SP 800-52 Rev. 2 guidelines is that FIPS 140 validation of the cryptographic modules used by the client and server will not be required. However, both the client and server must use either a FIPS-140-validated cryptographic module or a cryptographic module from a widely-used and generally-respected cryptographic implementation of TLS that receives active security support, such as OpenSSL. This exception has been made because formal FIPS 140 validation is often not available for commercial and financial reasons unrelated to the quality of the cryptographic implementation, so this requirement could otherwise unnecessarily constrain the choice of software without a meaningful improvement in security for this application.

We do not currently anticipate transfering the data discussed here from the summit facility to the base facility in La Serena as an intermediate hop. Instead, we expect to use a direct TCP and TLS connection from the summit to the USDF. However, if there is a need for a separate transfer from the summit facility to the base facility, it is permitted to forgo encryption if that encryption could interfere with the requirements for Prompt Processing (in particular, the 60 second bound on elapsed time from shutter close to alert production). This is permissible because the connection from the summit facility to the base facility is over dedicated private fiber and the networking equipment at both ends is under the control of Vera C. Rubin Observatory.

Communication from the DAQ on the telescope to its client need not be (and is not) encrypted since this communication happens entirely within the summit facility. Only Rubin Observatory staff will have access to the summit facility or any of the systems running there.

4   Project impact¶

Data transfer has previously been tested using bbcp, a data transfer program for scientific data that is optimized for transfer speed. It encrypts the control channel (via SSH) but not the data channel, and therefore does not meet this requirement. Data transfer will have to be reimplemented using TLS.

Encryption has some additional compute processing overhead in both the client and server. TLS uses AES encryption, which is highly optimized in modern processors, but it is still more expensive to encrypt and decrypt the data than to transfer it unencrypted. In order to meet the 60 second window for Prompt Processing, this may require more processing power at both ends of the transfer. However, this additional processing is expected to be a small fraction of the processing required to compress the images before transfer, a generally more expensive operation.

5   Cost impact¶

6   Additional analysis¶