SDI-CSCS: EP3: A Clean-Slate Software-Defined Approach for Enabling Elastic Security

该项目探索了一种全新的方法来保护新兴软件定义计算和网络系统基础设施（SDI）中的关键服务。该项目探索了一种新的，弹性和灵活的安全方法，作为拟议的弹性放置，权限和性能（EP3）框架的一部分。在EP3中，弹性适用于可用于执行安全任务的处理量，以及策略的类型和处理发生的位置。拟议的研究以三种方式解决灵活的安全基础设施。首先，研究重点将设计一个具有更高可验证性和与网络计算任务相关的机密性的数据平面。这为网络管理员提供了更大的灵活性，可以将安全关键处理转移到网络中的任何位置。第二个研究任务将是开发一个控制平面，利用布局灵活性，根据需要动态启动防御。最后，项目团队将开发一套新颖的SDI启发的安全功能，突出的好处，弹性的位置，姿态和性能。这项研究活动将开发和传播一套开源工具，建模抽象，算法设计，原型实现，将大大减少时间部署他们的技术在当前和未来的SDI部署。项目团队还将使研究成果作为学生的教育资源，并计划将跨学科研究的成果整合到跨越安全，网络和系统的多个班级的关键课程项目中。该项目将积极鼓励代表性不足的群体参与研究，并与领先的行业合作者密切合作，评估拟议的技术并在操作环境中部署解决方案。

This project explores a clean-slate approach to securing critical services in emerging Software-Defined computing and networking systems Infrastructure (SDI). The project explores a new, elastic and flexible security approach as part of a proposed Elastic Placement, Posture and Performance (EP3) framework. In EP3, elasticity applies to the amount of processing available to perform security tasks, as well as to the types of policy and the placement where the processing occurs. The proposed research addresses flexible security infrastructure in three ways. First, a research thrust will design a data plane with greater verifiability and confidentiality associated with in-network computation tasks. This gives network administrators greater flexibility in moving security critical processing to anywhere in the network. A second research task will be to develop a control plane that leverages placement flexibility to dynamically launch defenses as needed. Finally, the project team will develop a set of novel SDI-inspired security capabilities that highlight the benefits of elasticity in placement, posture and performance.This research activity will develop and disseminate a set of open-source tools, modeling abstractions, algorithm designs, and prototype implementations that will dramatically reduce the time to deploy their techniques in current and future SDI deployments. The project team will also make the research results useful as an educational resource for students, and plan to integrate the outputs of the interdisciplinary research in key course projects in multiple classes spanning security, networking, and systems. The project will actively encourage research participation from underrepresented groups, and work closely with leading industry collaborators to evaluate the proposed techniques and deploy the solutions in operational settings.