EAGER: ACI: Secure and Effective Policy Enforcement in Software-Defined WANs

EAGER：ACI：软件定义的 WAN 中安全有效的策略执行

• 批准号: 1446426
• 负责人: Phillip Porras
• 金额: $ 29.97万
• 依托单位: SRI International
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2014
• 资助国家: 美国
• 起止时间: 2014-10-15 至 2017-09-30
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1446426&HistoricalAwards=false
• 关键词: EAGER; ACI; Secure; Effective; Policy

Software Defined Networking (SDN) is a rapidly emerging, open source technology which decouples the network control functions from the data itself. This allows network functions to be programmed by network operators, application owners and system administrators. Instituting a dynamic network policy that constantly changes represents a strategic shift in the management of networks, which currently are static in nature. However, the flexibility in configuration has security repercussions in that SDN has no inherent security mechanisms built into its design. Permissions for configuration of the network ? both one?s own and others - as well as coordination and visibility between networks are still open technical questions. SDN has recently been adopted by a handful of major enterprise providers for limited use within their data centers, where robust security is less of an issue since the traffic stays within one network. However, as the Research and Education community and industry both look to adopt large scale SDN on their network backbones, the lack of a security framework for interdomain SDN use is a glaring vulnerability. This project defines the security architecture for large scale SDN networks and lays out a security coordination protocol for the largest use case for SDN, Wide Area Networking.

软件定义网络（SDN）是一种快速发展的开源技术，它将网络控制功能从数据本身中分离出来。这允许网络操作员、应用程序所有者和系统管理员对网络功能进行编程。制定一项不断变化的动态网络政策，是对目前静态网络管理的一种战略转变。然而，配置的灵活性具有安全影响，因为SDN在其设计中没有内置固有的安全机制。网络配置的配置文件？两个一？网络自身和其他网络之间的协调和可见性仍然是悬而未决的技术问题。SDN最近已被少数主要企业提供商采用，用于其数据中心内的有限使用，由于流量停留在一个网络内，因此强大的安全性不是问题。然而，随着研究和教育社区以及行业都希望在其网络骨干上采用大规模SDN，缺乏域间SDN使用的安全框架是一个明显的漏洞。该项目定义了大规模SDN网络的安全架构，并为SDN广域网的最大用例制定了安全协调协议。