NeTS-FIND: Collaborative Research: Designing Secure Networks from the Ground Up

该项目旨在开发一种全新的互联网体系结构，其中保护免受恶意网络攻击是一个基本设计目标。这一目标是通过要求所有流量在一开始就明确地向网络发送其来源和意图来实现的。以此为指导原则，主要调查人员计划为专用网络(例如企业)以及公共服务器(例如电子商务网站)开发量身定制的安全体系结构，这些网络通常对谁可以与谁通信实施严格控制，公共服务器更“开放”并希望在全球范围内可见。建议的专用网络解决方案要求在称为域控制器的单个位置指定所有网络范围的策略。如果策略允许，域控制器将明确授予用户通信权限。相比之下，这种针对公共环境的解决方案主张修改终端主机API，以允许终端主机向广域互联网和其他公共服务器发出其意图的信号。广泛的影响：这项研究将最终形成专用网络的原型安全架构和公共服务的安全机制的全面蓝图。在这两种情况下，这种方法都是激进的，代表着与现有思维的重大智力背离。

This project aims to develop a clean-slate Internet architecture where protection from malicious network-based attacks is a fundamental design goal. This goal is to be achieved by requiring all traffic to explicitly signal its origin as well as intent to the network at the very outset. Using this as a guiding principle, the principal investigators plan to develop tailor-made security architectures for private networks (e.g., enterprises) which often enforce tight controls on who can communicate with whom, as well as for public servers (e.g., e-commerce sites) which are more "open" and desire to be globally visible. The proposed solution for private networks requires all network-wide policies to be specified at a single location called the domain controller. If the policy allows it, the domain controller grants explicit permission for users to communicate. In contrast, this solution for the public setting argues for modifications to end-host APIs to allow end-hosts to signal their intent to the wide-area Internet and to other public servers.Broader Impact: The research will culminate in a prototype security architecture for private networks and a comprehensive blue-print of security mechanisms for public services. This approach in either case is radical, and represents a substantial intellectual departure from existing thinking.