EAGER: ACI: A Software-Defined Network (SDN) WAN Security Testbed

软件定义网络（SDN）已成为解决复杂流量和拓扑管理环境（如大型数据中心、专用广域网（wan）和虚拟托管环境）中日益增长的挑战的探索主题。不幸的是，人们对支持sdn的wan带来的安全挑战知之甚少。在下一代网络的设计阶段早期，需要对对抗性挑战的频谱进行建模，这对于避免可能困扰SDN wan并阻碍其采用的新可利用漏洞的爆炸至关重要。这个项目促进了我们对跨支持sdn的WAN拓扑出现的安全挑战的理解的飞跃。它着重于为几个SDN-WAN拓扑创建多站点（和可复制的）分布式安全测试基础设施，以及针对每个拓扑开发对抗模型。该测试平台集成了强大的周界隔离和环境恢复服务。它实例化了一系列SDN WAN拓扑，并促进了对SDN基础架构本身的安全扩展的集成和评估。该项目还将在该测试平台中实例化的各种SDN-WAN拓扑的攻击面上生成一个可插拔的利用方法的软件测试框架。该项目将对具体的安全威胁和潜在解决方案进行早期评估，从而为SDN标准提供信息和影响，增强商业解决方案，推动对这些新兴网络进行更深入的威胁评估，并促进网络和信息安全（INFOSEC）研究社区的发展。

Software defined networking (SDN) has emerged as a topic of exploration for addressing the growing challenges in complex traffic and topology management in environments such as large-scale data centers, private wide-area networks (WANs), and virtual hosting environments. Unfortunately, little is understood regarding the security challenges that SDN-enabled WANs introduce. The need for modeling the spectrum of adversarial challenges early in the design stage of this next generation of networking is critical for avoiding an explosion of new exploitable vulnerabilities that will likely plague SDN WANs and hinder their adoption.This project facilitates a leap in our understanding of the security challenges that arise across SDN-enabled WAN topologies. It focuses on the creation of a multi-site (and reproducible) distributed security testing infrastructure for several SDN-WAN topologies, as well as the development of adversarial models against each topology. The testbed incorporates strong perimeter isolation and environment recovery services. It instantiates a range of SDN WAN topologies, and facilitates the integration and evaluation of security extensions to the SDN infrastructure itself. The project will also produce a pluggable software-testing framework of exploit methods across the attack surface of the various SDN-WAN topologies instantiated within this testbed. The project will result in an early assessment of concrete security threats and potential solutions that can inform and influence SDN standards, enhance commercial solutions, drive deeper threat assessments of these emerging networks, and stimulate the networking and Information Security (INFOSEC) research communities.