Adapting ATLAS@Home to trusted and semi-trusted resources

¹ University of Oslo, P.b. 1048 Blindern, 0316 Oslo, Norway
² Deutsches Elektronen-Synchrotron (DESY), Notkestrasse 85, 22607 Hamburg, Germany
³ University of Wisconsin-Madison, Madison, WI 53706, USA
⁴ University of Michigan, 500 S State St, Ann Arbor, MI 48109, USA

^* e-mail: david.cameron@cern.ch
^** Copyright 2020 CERN for the benefit of the ATLAS Collaboration. CC-BY-4.0 license.

Published online: 16 November 2020

Abstract

ATLAS@Home is a volunteer computing project which enables members of the public to contribute computing power to run simulations of the ATLAS experiment at CERN’s Large Hadron Collider. The computing resources provided to ATLAS@Home increasingly come not only from traditional volunteers, but also from data centres or office computers at institutes associated to ATLAS. The design of ATLAS@Home was built around not giving out sensitive credentials to volunteers, which means that a sandbox is needed to bridge data transfers between trusted and untrusted domains. As the scale of ATLAS@Home increases, this sandbox becomes a potential data management bottleneck. This paper explores solutions to this problem based on relaxing the constraints of sending credentials to trusted volunteers, allowing direct data transfer to grid storage and avoiding the intermediate sandbox. Fully trusted resources such as grid worker nodes can run with full access to grid storage, whereas semi-trusted resources such as student desktops can be provided with “macaroons”: time-limited access tokens which can only be used for specific files. The steps towards implementing these solutions as well as initial results with real ATLAS simulation tasks are discussed along with the experience gained so far and the next steps in the project.