EAGER: ACI: Secure and Effective Policy Enforcement in Software-Defined WANs

软件定义网络(SDN)是一种迅速崛起的开源技术，它将网络控制功能与数据本身分离。这允许网络操作员、应用程序所有者和系统管理员对网络功能进行编程。制定不断变化的动态网络策略代表着网络管理的战略转变，目前网络管理本质上是静态的。然而，配置的灵活性会带来安全影响，因为SDN的设计中没有内置固有的安全机制。是否具有配置网络的权限？两者？S自己和其他人-以及网络之间的协调和可见性仍然是悬而未决的技术问题。SDN最近已被几家主要企业提供商采用，用于其数据中心内的有限使用，在数据中心，强大的安全性不是问题，因为流量留在一个网络内。然而，由于研究和教育社区和行业都希望在其网络主干上采用大规模SDN，因此缺乏域间SDN使用的安全框架是一个明显的漏洞。本项目定义了大规模SDN网络的安全体系结构，并为SDN最大的用例--广域网络制定了安全协调协议。

Software Defined Networking (SDN) is a rapidly emerging, open source technology which decouples the network control functions from the data itself. This allows network functions to be programmed by network operators, application owners and system administrators. Instituting a dynamic network policy that constantly changes represents a strategic shift in the management of networks, which currently are static in nature. However, the flexibility in configuration has security repercussions in that SDN has no inherent security mechanisms built into its design. Permissions for configuration of the network ? both one?s own and others - as well as coordination and visibility between networks are still open technical questions. SDN has recently been adopted by a handful of major enterprise providers for limited use within their data centers, where robust security is less of an issue since the traffic stays within one network. However, as the Research and Education community and industry both look to adopt large scale SDN on their network backbones, the lack of a security framework for interdomain SDN use is a glaring vulnerability. This project defines the security architecture for large scale SDN networks and lays out a security coordination protocol for the largest use case for SDN, Wide Area Networking.