Cici:TCR:software supply chain security in high-performance computing: understanding, evaluation and transition

The National Science Foundation's Computer and Information Science and Engineering program (CFDA 47.070) awarded the University of Utah $1.199 million under the Cybersecurity, Cloud Computing and Internet of Things (CICI): Trusted Cyberinfrastructure (TCR) initiative to address software supply chain security threats in high-performance computing (HPC) environments. The three-year project, initiated January 1, 2026 and concluding December 31, 2028, delivers three primary products: (1) a comprehensive risk characterization and taxonomy framework identifying security risks specific to HPC software supply chains; (2) realistic testbeds and attack benchmarks leveraging the developed taxonomy; and (3) practical transition mechanisms to enable adoption of security techniques within HPC environments. This research responds to the critical vulnerability of HPC infrastructures—which support scientific discovery across seismic imaging, epidemiology, drug discovery, and nuclear engineering—to software supply chain threats inherent in open-source software ecosystems.

The award supports collaborative research across multiple institutions. Sub-awardees include the Regents of the University of California at Riverside and Deepbits Technology Inc., a small disadvantaged business specializing in AI-driven cybersecurity and software analysis. These partners contribute specialized expertise in evaluating and implementing security solutions tailored to the distinctive operational characteristics and challenges of HPC environments, enabling the project to bridge the gap between conventional software supply chain security approaches and the specific requirements of high-performance computing infrastructures.

Abstract

Computational infrastructures have become a foundational enabler of scientific discovery across a range of critical domains, including seismic imaging, air quality monitoring, epidemiology, drug discovery, and nuclear engineering. As a result, ensuring the security of these infrastructures is paramount. Scientific computing ecosystems rely heavily on open-source software to develop, port, deploy, schedule, and manage computational codes. However, the open-source model inherently exposes projects to software supply chain threats. Real-world incidents have shown that adversaries can exploit this model by injecting malicious code into compromised repositories, thereby affecting downstream users. Even in the absence of malicious actors, open-source components may contain latent vulnerabilities that introduce significant security risks. Although extensive research has been conducted on understanding and mitigating software supply chain risks, their implications in the high-performance computing (HPC) context remain largely understudied. HPC environments?including their infrastructures, applications, and operational models?present distinct characteristics and challenges that may render conventional security approaches ineffective. This award, hpcsafechain, addresses a pressing question: how can current security techniques be applied or adapted to confront software supply chain threats in the HPC domain? To this end, this project undertakes the following three key tasks. (1) risk characterization and taxonomy development: the hpcsafechain project systematically identifies security risks specific to HPC software supply chains, analyzes the underlying challenges in mitigating them, and constructs a comprehensive taxonomy tailored to HPC. (2) testbeds and benchmarks: leveraging the constructed taxonomy, hpcsafechain develops realistic testbeds and an attack benchmark to rigorously assess the effectiveness and limitations of existing security tools within HPC settings. (3) technique adaptation and enhancement: hpcsafechain investigates how existing software supply chain security techniques can be refined or extended to address the unique requirements and operational constraints of HPC environments. This project offers valuable insights into the security challenges faced by real-world HPC systems and creates distinctive research and educational opportunities for both undergraduate and graduate students. This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the foundation's intellectual merit and broader impacts review criteria.- subawards are planned for this award.