CAREER: Towards Elastic Security with Safe and Efficient Network Security Function Virtualization

传统的网络安全功能一般是在厂商专有的设备或中间盒上实现的，通常缺乏通用的编程接口，通用性和灵活性也很差。这些传统的网络安全设备通常需要放置在固定的网络入口点，并且在它们可以处理的最大流量方面具有恒定的容量。这种僵化的性质使它们在保护当今流行的可编程和可虚拟化环境方面效率低下。网络功能虚拟化(NFV)和软件定义网络(SDN)是两种新兴的网络模式，它们提供了解决这些限制的潜力，并能够通过设计一种称为虚拟网络安全功能(VNSF)的新型网络安全功能来促进弹性安全。这个项目的主要目标是扩展对虚拟网络安全功能的理解和科学。它将开发虚拟网络安全功能的新技术，其中安全微服务可以根据情况的需要按需灵活、安全和高效地部署。它解决了虚拟网络安全功能的管理、设计、部署和执行中固有的主要挑战，这些功能目前阻碍了其优势的充分利用。该项目还将把一项全面的教育计划与拟议的研究结合起来，以培训计算科学领域的下一代劳动力。该项目将通过积极招募女性和其他代表性不足的群体参与研究，培养学生的多样性。该项目将首先提出一个新的防火墙架构，以应对虚拟防火墙扩展方面的挑战。然后，该项目将探索解决方案，以促进传统和基于人工神经网络(ANN)的入侵检测系统的安全和高效虚拟化。最后，该项目将开发一个通用框架OpenNSFV，以支持安全高效的网络安全功能虚拟化。该项目建议的解决方案将是灵活、可扩展、值得信赖和最佳的，并将显著增强可编程和可虚拟化网络基础设施的安全性。为了证明建议的解决方案的实用性和可行性，该项目将在实际生产环境中实施、部署和评估建议的安全机制。该奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

Traditional network security functions are generally implemented on vendor proprietary appliances or middleboxes, which usually lack a general programming interface, and their versatility and flexibility are also very poor. These traditional network security appliances often need to be placed at fixed network entry points and have a constant capacity with respect to the maximum amount of traffic they can process. Such rigid nature makes them inefficient in protecting today's prevailing programmable and virtualizable environments. Network Function Virtualization (NFV) and Software-Defined Networking (SDN) are two emerging networking paradigms that offer the potential to address those limitations and are able to facilitate elastic security with the design of a new breed of network security functions called virtual Network Security Functions (vNSFs). The major goal of this project is to extend the understanding and science of virtual Network Security Functions. It will develop new technology for virtual Network Security Functions where security microservices can be deployed elastically, safely and efficiently, on demand, tailored to the needs of the situation. It addresses major challenges inherent in the management, design, deployment, and execution of virtual Network Security Functions that currently prevent the full use of their benefits. This project will also integrate a comprehensive education plan with the proposed research to train the next generation workforce in computational sciences. The project will foster the diversity of students by active recruitment of women and other under-represented groups for participation in the research.This project will first propose a new firewall architecture to address challenges in virtual firewall scaling. This project will then explore solutions to facilitate safe and efficient virtualization of both traditional and Artificial Neural Network (ANN)-based Intrusion Detection Systems. Finally, this project will develop a general framework, OpenNSFV, for supporting safe and efficient virtualization of network security functions. The proposed solutions of this project will be flexible, scalable, trustworthy, and optimal, and will substantially enhance the security of programmable and virtualizable network infrastructure. To demonstrate the practicality and feasibility of the proposed solutions, the project will implement, deploy, and evaluate the proposed security mechanisms in real production environments.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.