CC*Networking Infrastructure: Scalable Secure Science DMZ for Academic and Clinical Research at the University of Virginia

弗吉尼亚大学（University of Virginia，UVA）校园网络基础设施的性能受到多层防火墙等传统安全方法的阻碍。 认识到研究界需要越来越高的性能和更安全的数据存储和传输能力，UVA正在对其研究计算基础设施进行雄心勃勃的升级。可扩展的安全科学DMZ项目通过两个主要活动在校园内的多个终端节点之间实现更高效、灵活和安全的数据传输。 首先，构建多级网络基础设施，以实现安全数据和传统非安全数据的快速数据传输和高效数据共享。其次，通过网络升级、网络配置更改和科学DMZ功能的实现，增强了现有的数据传输基础设施。新的研究网络基础设施利用虚拟局域网（VLAN）来隔离数据路径，以满足安全和/或其他目的的需要。通过位于数据源附近的分布式数据传输节点（DDTN）网络来满足对特别高带宽的需求。因此，研究人员能够快速有效地将数据从仪器传输到中央存储;从工作站传输到中央计算设施;从中央设施传输到外部计算中心;从一个机构传输到另一个机构，并根据数据的敏感性分类确保适当的安全性。新的以研究为导向的网络配置通过消除高通量实验室和中心、健康科学站点以及位于整个校园的传统学术研究单位的瓶颈，显著增强了研究能力。

Performance of campus networking infrastructure at the University of Virginia (UVA) is encumbered by conventional security approaches such as multi-layered firewalls. Recognizing that the research community needs increasingly higher performance yet more secure-data storage and transfer capabilities, UVA is implementing an ambitious upgrade to its research computing infrastructure. The scalable secure science DMZ project enables more efficient, flexible and secure data transfer between multiple end nodes across campus through two primary activities. First, a multi-stage network infrastructure is built to enable rapid data transfer and efficient data sharing for both secure data as well as for conventional non-secure data. Second, the existing data transport infrastructure is enhanced through a combination of network upgrades, network configuration changes, and the implementation of Science DMZ functionality. The new research network infrastructure leverages Virtual Local Area Networks (VLANS) to isolate data paths as needed for security and/or other purposes. Demands for especially high bandwidth are accommodated through a network of Distributed Data Transfer Nodes (DDTNs) that are positioned near the data sources. As a result, researchers are able to quickly and efficiently transfer and share data from instrument to central storage; from workstation to central computing facilities; from central facilities to external computing centers; and from one institution to another, with assurance of appropriate security based on the sensitivity classification of the data. The new research-oriented network configuration significantly enhances research capacity by eliminating bottlenecks at high-throughput laboratories and centers, the health-sciences sites, and conventional academic research units located throughout campus.