Secure Research Computing with VergeOS
Secure enclaves for research and remote learning, with compliance and standardization that keep pace with researchers
Summary
Research computing teams have to serve hundreds or thousands of groups with different datasets, grants and regulations. Building separate infrastructure for each one is slow and expensive, and it leaves central IT with dozens of environments to secure and audit. VergeOS, the Private Cloud OS, turns a pool of x86 servers into one system that IT carves into secure, compliant enclaves in minutes. Each grant or project gets its own resources, billing, security and compliance settings, and researchers reach their data from anywhere.
Compliance and standardization for IT. Speed and freedom for researchers.
Research Needs Agility, Regulators Need Control
Research groups move fast. A new grant arrives, a dataset doubles, a collaborator at another institution needs access next week. At the same time, much of that data comes with strict rules. Health data falls under HIPAA. Defense work comes with Controlled Unclassified Information (CUI) requirements. Federal projects bring FISMA. Data about children falls under COPPA.
Most institutions answer those rules with separate builds. Each regulated group gets its own servers, its own storage and its own audit. The result is slow to stand up, expensive to keep running and hard for a small central team to govern. Researchers wait, and many end up trimming datasets to fit whatever hardware sits under their desk.
VergeOS takes a different path. It brings compute, storage and networking into one piece of software that runs on standard x86 servers, then lets IT divide that system into isolated environments with their own policies. IT keeps compliance and standardization. Researchers get the agility their work demands.
A Tenant for Every Grant
Grants come with their own budgets, their own reporting and often their own compliance terms. VergeOS lets IT create a separate tenant for each research grant, segregating resources, billing, security and compliance requirements. Every tenant runs on the same shared hardware, and none of them can see or reach another.
That model maps infrastructure to the way research is funded. When a grant ends, its tenant can be archived or retired. When a new grant starts, IT provisions a tenant from a template in place of buying and certifying another stack.
Nested Secure Enclaves with Delegated Control
VergeOS builds isolation with Virtual Data Centers (VDCs). Each VDC is a complete logical data center with its own compute, storage and network domains. VDCs can nest, so a college or department can run its own VDC and create secure enclaves inside it for individual projects.
Central IT sets global policy once and delegates day-to-day administration to the people closest to the research. Departments manage their own enclaves, and VergeFabric, the platform’s software-defined networking layer, keeps each environment’s networks and firewall rules separate. Isolation comes from the architecture, not from a patchwork of separate tools.
“VergeIO allowed us to solve the secure research needs at Arizona State University in an astoundingly fast manner, with visibility and security that makes supporting a large number of unique use cases as easy as following a recipe.”
Chris Kurtz, Arizona State University
Compliant Enclaves in Minutes
With VergeOS, IT creates secure enclaves in minutes that are compliant with standards such as HIPAA, CUI and FISMA. Each enclave runs with its own set of automatically enforced policies. Security controls such as two-factor authentication, next-generation firewalls and intrusion detection let researchers reach their data safely over the internet.
The University of Michigan shows what that means in practice. Its Advanced Research Computing, Technology Services group (ARC-TS) built a VergeOS research cloud for 2,600 independent research groups. Its Secure Enclave Service became the first generally accessible enclave service on campus for unrestricted, HIPAA and CUI data. ARC-TS no longer has to go through data center recertification and compliance for HIPAA and CUI, saving time and resources.
“I used to be locked to my desk. And if I had to do something big, it was like, do I have to drive in on the weekend… or if you’re away on a trip, you can’t. This is huge. This is a gamechanger.”
Dr. Bryant Oliphant, U-M researcher, orthopedic trauma health services
Scale Compute, Memory and Storage Independently
Research workloads rarely grow evenly. A modeling project needs more processors and memory. An imaging archive needs more capacity. With VergeOS, IT scales compute, memory and storage independently by adding commodity x86 servers, so each resource grows on its own schedule and budget.
The infrastructure reconfigures automatically as nodes join, with no hardware redesign and no new round of capacity planning. At the University of Michigan, the research cloud runs on 60 nodes: 40 compute nodes and 20 storage nodes. VergeOS can also mix vendors and CPU generations in the same system, so servers that still have useful life stay in service.
Global deduplication in VergeFS stretches that hardware further. Every VergeOS installation uses the least amount of hardware for the data it holds, and deduplicated snapshots consume space only when unique data appears.
Generalist Staff, Built-In Recovery
Research computing teams are small compared with the communities they serve. VergeOS automates hardware monitoring, patching and much of the routine work of IT management, so generalist IT staff can run the entire environment. At U-M, system auditing and updates are automated, and consultants and support staff share a common platform.
Disaster recovery is part of the architecture, not an add-on. ioClone snapshots and ioReplicate multi-site synchronization are built into VergeOS. If a site goes down, IT can fail over an entire Virtual Data Center, including its public IP addresses, to a second location. ioGuardian adds inline protection against multiple drive or node failures, so research keeps running through hardware problems.
Secure Environments for Teaching and Learning
The same enclave model serves classrooms and labs. Instructors can give each course or cohort an isolated environment with its own desktops, servers and networks, reachable from anywhere. Students work on real infrastructure without touching production systems or each other’s work.
At Pfeiffer University, a small IT department moved to VergeOS on servers it already owned and saved 85 percent. Students did more than study the infrastructure. They built it, from installing hardware components to configuring network aggregation, and documented the process for their careers.
“Verge was the only product I looked at that didn’t need hardware. Others told me to buy new, but I had good servers with life left. Verge let me use them.”
Ryan Conte, CIO, Pfeiffer University
The University of Michigan Research Cloud
ARC-TS supports 2,600 independent research groups, many of them under HIPAA, COPPA or CUI requirements. Before VergeOS, a separate IT build for each group was time consuming and expensive. Researchers such as Dr. Bryant Oliphant spent much of their time modifying, appending and merging datasets just to fit under the RAM limit of a desktop computer.
On VergeOS, ARC-TS delivers five research services from one platform: the Secure Enclave Service, On Demand container services, research virtual desktops, database hosting and data pipelining tools. Administrators spin up complete virtual enclaves quickly, and researchers reach restricted data securely through a virtual private network.
Read the full University of Michigan story.
Traditional Research IT Compared with VergeOS
| Area | Traditional approach | With VergeOS |
|---|---|---|
| New regulated environment | Separate hardware and certification per group | Secure enclave in minutes on a certified system |
| Grant accounting | Shared clusters with manual chargeback | A tenant per grant with its own resources and billing |
| Isolation | Physical separation or many point tools | Nested Virtual Data Centers and VergeFabric networks |
| Growth | Scale everything together, replan capacity | Add compute or storage nodes independently |
| Operations | Specialists for each layer | Generalist staff, automated monitoring and patching |
| Recovery | Separate backup and DR products | ioClone, ioReplicate and whole-VDC failover built in |
A Foundation for Data-Intensive Research
Research institutions need infrastructure that keeps regulated data under control and still lets researchers move at the speed of their work. VergeOS gives IT one system to secure, audit and grow, and gives every grant, project and course its own secure enclave. The same platform runs private AI through VergeIQ on GPUs the institution already owns, which keeps sensitive research data on premises as AI moves into the lab.
Explore more customer stories, or see how institutions are planning their VMware exit on the same platform.
Plan Your Research Cloud
The University of Michigan, Arizona State University and Pfeiffer University use VergeOS to deliver secure computing to researchers and students. Talk with a VergeIO engineer about your research environment.