CAREER: Transforming Residential Networks into Security Assets

住宅计算机网络通常是不安全的，因为它们无法应用企业网络中采用的最佳实践。通常负责管理这些网络的普通公众可能缺乏部署最先进的网络安全系统的财务资源或计算专业知识。因此，住宅网络通常对欺诈和妥协几乎没有抵抗力。此外，当用户将他们的移动的设备从家中带到公司网络时，这些网络能够实现对公司网络的渗透。家用电器和电源开关等支持互联网的嵌入式设备的兴起可能会加剧这些问题，因为妥协可能会影响住宅的物理环境。为了应对这些风险，该项目将探索新的机制，通过位于住宅外的安全执行系统发送网络流量，以仔细筛选传统计算机和支持互联网的嵌入式设备的攻击。该项目的目标是创造新技术，以提高美国数百万家庭计算机网络的安全性。研究人员将创建一个系统，以回答有关将网络安全决策委托给外部第三方安全提供商的有效性、效率、性能、可扩展性、成本和激励的研究问题。研究人员将使用一系列云托管的安全中间盒，在将流量发送到目的地之前，测量网络延迟以及对通过这些中间盒隧道传输住宅网络流量的带宽相关影响。研究人员将评估如何在这些中间盒中引入新的安全机制，以及如何在该模型中加强现有的安全协议。该项目将进一步探索如何检测和创建自定义的安全过滤器，用于支持Internet的嵌入式设备，以保护他们试图利用可能存在于设备上的漏洞。研究人员将探索适用于具有类似网络交互模式的嵌入式设备的通用模型，以支持大量设备。最后，研究人员将探索可部署住宅网络安全的新子领域的潜力。研究人员将研究哪些类型的技术与外部第三方安全提供商兼容，以及哪些技术需要现场安全解决方案才可行。

Residential computer networks are often insecure because they are unable to apply the best practices employed in corporate networks. The general public, who are often responsible for administering these networks, may lack the financial resources or computing expertise to deploy state-of-the-art network security systems. As a result, residential networks often offer little resistance to fraud and compromise. Further, these networks can enable infiltrations into corporate networks when users bring their mobile devices from the home to the corporate network. The rise of Internet-enabled embedded devices, such as household appliances and electrical power switches, can exacerbate these problems since a compromise can affect the residence's physical environment. To address these risks, this project will explore new mechanisms to send network traffic through security enforcement systems located outside the residence to carefully screen for attacks, both to traditional computers and to Internet-enabled embedded devices. The project's goal is to create new techniques that can improve security for the millions of residential computer networks in the United States.The researchers will create a system to answer research questions surrounding the effectiveness, efficiency, performance, scalability, costs and incentives of delegating network security decisions to an external third-party security provider. Using an array of cloud-hosted security middleboxes, the researchers will measure the network latency and impact on bandwidth associated tunneling residential network traffic through these middleboxes before sending the traffic to its destination. The researchers will evaluate how new security mechanisms can be introduced at these middleboxes and how existing security protocols can be fortified in this model. The project will further explore how to detect and create custom security filters for Internet-enabled embedded devices to protect them attempts to exploit vulnerabilities that may be present on the devices. The researchers will explore generalizable models that can apply to embedded devices that have similar network interaction patterns to enable support for a large number of devices. Finally, the researchers will explore the potential for a new subfield of deployable residential network security. The researchers will examine which types of techniques are compatible with external third-party security providers and which techniques require an on-site security solution to be viable.