CICI:TCR:CAREFREE:Cloud infrAstructure ResiliencE of the Future foR tEstbeds, accelerators and nEtworks

以云计算为代表的网络基础设施已成为加快现代科学探索、发现和进步的主力军。有几个研究云可用，使来自不同研究领域的科学家能够访问商业云产品无法提供的重要的新网络基础设施方法。与商业云同行一样，在这些系统上运行的科学工作负载需要安全，而使用这些尖端系统的科学家希望保护他们的数据和程序的完整性和机密性。此外，他们期望强大的系统可用性，而无需担心攻击造成的中断。由于这些试验台提供裸机资源来支持系统研究，因此它们的攻击面更大(与商业云相比)，这会降低它们的安全性。因此，该项目的目标是确保包括网络连接加速器的科学网络基础设施(以下一代云系统的形式)的安全。该项目旨在开发下一代弹性云基础设施。该研究通过同时关注网络和硬件加速器，从跨层角度调查网络基础设施安全。它的补充性研究以开放云测试床为基础。该试验台与公共网络隔离，是解决安全问题的理想平台，可在其中发起、识别和缓解攻击。这项研究有三个突破口。首先，它识别利用与网络层相关的漏洞的高级攻击策略。其次，它定义并探讨了三个经典的安全问题：机密性、完整性和可用性；利用硬件加速器漏洞的对手可能会危及这些安全问题。第三，通过硬件/软件/网络的联合设计策略，探索高效、可扩展的防御解决方案。总的来说，它将这些跨层防御解决方案与现有基础设施集成在一起，并为评估和过渡到其他研究网络基础设施制定基准。该奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

Cyberinfrastructure in the form of cloud computing has become the main workhorse for accelerating modern scientific exploration, discovery, and advancement. Several research clouds are available and give scientists from diverse research domains access to significant new cyber-infrastructure approaches that are unavailable through commercial cloud offerings. Like their commercial cloud counterparts, the scientific workloads running on these systems require security, and the scientists using these cutting-edge systems wish to preserve the integrity and confidentiality of their data and programs. In addition, they expect robust system availability without worrying about disruptions caused by attacks. Since these testbeds offer bare metal resources to support systems research they have an increased attack surface (in comparison to commercial clouds), which makes them less secure. As a consequence, the goal of this project is to secure scientific cyberinfrastructures (in the form of next-generation cloud systems) that include network-attached accelerators. This project aims to develop the next-generation resilient cloud infrastructure. The research investigates cyberinfrastructure security from a cross-layer perspective by focusing on both networking and hardware accelerators. Its complementary research thrusts build on the Open Cloud Testbed. This experimental testbed is isolated from public networks and is an ideal platform for addressing security issues where attacks can be launched, identified, and mitigated. This research has three thrusts. First, it identifies advanced attack strategies leveraging vulnerabilities associated with the network layer. Second, it defines and explores three classic security concerns; confidentiality, integrity, and availability; which can be compromised by an adversary leveraging hardware accelerator vulnerabilities. Third, it explores efficient and scalable defense solutions with a co-design strategy for hardware/software/network. Collectively, it integrates these cross-layer defense solutions with the existing infrastructure and develops benchmarking for evaluation and transition to other research cyberinfrastructures.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.