EAGER: ACI: Secure and Effective Policy Enforcement in Software-Defined WANs

软件定义网络（SDN）是一种迅速兴起的开源技术，它将网络控制功能与数据本身解耦。这允许网络操作员、应用程序所有者和系统管理员对网络功能进行编程。建立一个动态的、不断变化的网络策略代表了网络管理的战略转变，目前网络是静态的。然而，配置的灵活性会对安全性产生影响，因为SDN在其设计中没有内置固有的安全机制。配置网络的权限？两个吗?以及网络之间的协调和可见性仍然是悬而未决的技术问题。SDN最近被一些主要的企业提供商采用，在他们的数据中心内有限地使用，在那里，强大的安全性不是一个问题，因为流量停留在一个网络内。然而，由于研究和教育社区和行业都希望在他们的网络骨干网上采用大规模SDN，缺乏域间SDN使用的安全框架是一个明显的漏洞。该项目定义了大规模SDN网络的安全架构，并为SDN最大的用例广域网（Wide Area Networking）制定了安全协调协议。

Software Defined Networking (SDN) is a rapidly emerging, open source technology which decouples the network control functions from the data itself. This allows network functions to be programmed by network operators, application owners and system administrators. Instituting a dynamic network policy that constantly changes represents a strategic shift in the management of networks, which currently are static in nature. However, the flexibility in configuration has security repercussions in that SDN has no inherent security mechanisms built into its design. Permissions for configuration of the network ? both one?s own and others - as well as coordination and visibility between networks are still open technical questions. SDN has recently been adopted by a handful of major enterprise providers for limited use within their data centers, where robust security is less of an issue since the traffic stays within one network. However, as the Research and Education community and industry both look to adopt large scale SDN on their network backbones, the lack of a security framework for interdomain SDN use is a glaring vulnerability. This project defines the security architecture for large scale SDN networks and lays out a security coordination protocol for the largest use case for SDN, Wide Area Networking.