Secure Deployment of Network Configuration

网络配置的安全部署

• 批准号: RGPIN-2017-06659
• 负责人: Atwood, John
• 金额: $ 1.46万
• 依托单位: Concordia University
• 依托单位国家: 加拿大
• 项目类别: Discovery Grants Program - Individual
• 财政年份: 2019
• 资助国家: 加拿大
• 起止时间: 2019-01-01 至 2020-12-31
• 项目状态: 已结题
• 来源: https://www.nserc-crsng.gc.ca/ase-oro/Details-Detailles_eng.asp?id=677282
• 关键词: Secure; Deployment; Network; Configuration

Secure deployment of configuration information for network devices has been possible for a long time, but is relatively little used, because almost all of the management of Internet security has to be done manually. The security aspect is particularly difficult to retrofit to legacy equipment, especially in industries that use equipment with long expected lifetimes. Using a combination of novel intermediaries, careful assessment of management needs, and concepts from autonomic networks, we will investigate ways to reduce the initial and on-going costs of security enforcement, in ways that "play well" with existing operational practices.***Our long-term objective is to formulate secure methods to manage the deployment of network configuration that are sufficiently automated that they will actually be deployed in operational networks, thus providing effective security for these networks.***The research program will encompass four main areas of activity:***1) Development and validation of methods for managing the security of routing protocols, without requiring manual intervention by networking staff;***2) Exploration and validation of methods for managing mixed deployments of legacy devices and modern devices, while minimizing the disruption and maximizing the security during the transitioning of the control paradigm, thus encouraging the adoption of more up-to-date control and performance-assessment technologies, without requiring the de-commissioning of legacy equipment;***3) Demonstration of the utility of our security-management approach in the area of Software-Defined Networking, specifically on the control path between the controller and the switches, which will make it easier to ensure the security of the managed objects;***4) Assessment of selected application areas, such as power grids and industrial plants, as candidates for secure management of legacy devices, using our mixed-deployment solution.***The lack of deployment for security solutions is based on an assessment (by network management executives) that the potential cost of security breaches is smaller than the cost of installing and maintaining the security solutions. The novelty of our work comes from the fact that we expect to be able to substantially lower the recurring costs of security management, to the point where the expected cost of maintaining (real) security is attractive (or at least acceptable). Governmental mandates will increase the desirability of these approaches, as they will increase the cost of not complying.***The proposed areas of study will facilitate increased security in the Internet, which in turn responds to the statement by the Internet Engineering Task Force (the Standards Development Organization for the Internet) that "pervasive surveillance is an attack", which can only be mitigated by pervasive security.**

长期以来，网络设备的配置信息的安全部署一直是可能的，但使用相对较少，因为几乎所有的互联网安全管理都必须手动完成。安全方面尤其难以改装成传统设备，特别是在使用预期寿命较长的设备的行业。利用新的中介、对管理需求的仔细评估和来自自主网络的概念的组合，我们将研究如何以与现有操作实践“很好地配合”的方式来降低安全实施的初始和持续成本。*我们的长期目标是制定安全的方法来管理网络配置的部署，这些方法充分自动化，从而将它们实际部署在操作网络中，从而为这些网络提供有效的安全。*研究计划将包括四个主要活动领域：*1)开发和验证用于管理路由协议的安全的方法，而不需要网络工作人员的人工干预；*2)探索和验证管理传统设备和现代设备混合部署的方法，同时最大限度地减少控制范例过渡期间的干扰和最大限度地提高安全性，从而鼓励采用更新的控制和性能评估技术，而不需要停止使用传统设备；*3)展示我们的安全管理方法在软件定义的网络领域的效用，特别是在控制器和交换机之间的控制路径上，这将使确保被管理对象的安全变得更容易；*4)使用我们的混合部署解决方案评估选定的应用领域，如电网和工业厂房，作为传统设备安全管理的候选。*缺乏安全解决方案的部署是基于(网络管理高管)的评估，即安全漏洞的潜在成本小于安装和维护安全解决方案的成本。我们工作的新颖性来自这样一个事实，即我们预计能够大幅降低安全管理的经常性成本，达到维护(实际)安全的预期成本具有吸引力(或至少可以接受)的程度。政府的命令将增加这些方法的可取性，因为它们将增加不遵守的成本。*拟议的研究领域将促进增强互联网的安全性，这反过来又回应了互联网工程任务组(互联网标准发展组织)的声明，即“普遍监视是一种攻击”，只有通过普遍安全才能减轻这一点。**