Skip to content

Security in NeuroScale

This document describes the security aspects of NeuroScale beginning with the important concept of access token authorization.

Introduction

We take security and privacy concerns seriously and NeuroScale has been designed from the outset with these issues in mind. HTTPS is used to ensure bi-directional encryption of interactions between you and the NeuroScale Platform whether using the Dashboard or through the API, while TLS encryption, closed access lists and other security features are standard for the MQTT streams.

NeuroScale has three different security levels which govern various aspects of the service:

  • A username/password combination used to access your NeuroScale Dashboard and account info.
  • Access tokens which can run pipelines on your account and/or connect to a pipeline endpoint (to retrieve the results of a pipeline).
  • A set of AWS S3 credentials for accessing your NeuroScale Storage bucket for files you process using Batch Tasks and the reports / results generated.

These are independent of each other, so you may give a user one, such as an Access Token to run certain pipelines, but not give them the others (such as access to the dashboard or access to your NeuroScale Storage).

Authentication for Running Pipelines

Every API request must include a valid access token (unless stated otherwise). The access token identifies the entity on whose behalf the request is being made and is used to check that they have permission to access the requested resource. NeuroScale provides RESTful resources for fine-grain control of access tokens. When you create a NeuroScale account, you are given an access token for your account, which can be seen in the "Authorizations" tab of your Dashboard. This is all you need to use NeuroScale. However, developers may want to create additional access tokens for different applications or different user profiles running their applications which connect to NeuroScale. Access tokens are assigned scopes to allow different types of access (run, create, edit, etc.)

Access tokens are extremely sensitive — treat them just like passwords! — and should not be shared or stored in insecure places. If one ever gets compromised, you can easily revoke it in the dashboard (or via the API).

Using Access Tokens

Once an access token has been generated, subsequent API requests should authenticate by adding the access_token value of the returned response to the Authorization header and specifying type Bearer. For example, given the access token 3b8df1a4-32af-4f7b-8b02-3d0f561303b1, request headers should be set to Authorization: Bearer 3b8df1a4-32af-4f7b-8b02-3d0f561303b1. Or, using cURL:

curl -i -H "Authorization: Bearer 3b8df1a4-32af-4f7b-8b02-3d0f561303b1" https://api.neuroscale.io/v1/pipelines

Aside: cURL

cURL is a command-line tool (and library) for supporting file exchange and data transfer using URI syntax. cURL is very well suited to the process of experimentation with RESTful web services and we would encourage people to use it during their early stage exploration of NeuroScale. For a good overview of how cURL can be used with HTTP please see this link.

Throughout the tutorials and sample code you will encounter in the other sections of the NeuroScale documentation you will notice that every API request is signed with an appropriate access token with sufficient privileges (a.k.a. scopes). It is an integral part of the NeuroScale Platform API.

Access to your NeuroScale Dashboard Account

The NeuroScale Dashboard is a password protected web-based graphical interface that allows one to manage account authorizations, user settings, account password, cloud resources, data storage, and more. It is imperative to properly log out, monitor who has access, and be careful with account access information.

Security of Data Files

All the data consumed or produced by your pipelines (recordings, reports, other output files, etc.) are stored in your account's AWS S3 storage bucket by default. You can access this storage bucket from Dashboard or from your PC using a free or commercial third-party S3 desktop client. Protecting your files requires closely monitoring your Dashboard account access information and the security of your third-party S3 desktop client, if utilized.

If your organization has their own S3 storage, you can also provide a NeuroScale pipeline with temporary fine-grained access to your own storage to allow it to read and write data.