NeTS-FIND: Collaborative Research: Designing Secure Networks from the Ground Up

该项目旨在开发一个干净的互联网架构，其中防止恶意网络攻击是一个基本的设计目标。这一目标是通过要求所有流量在一开始就明确地向网络发送其来源和意图来实现的。以此为指导原则，主要研究人员计划为专用网络开发量身定制的安全架构（例如，企业），其通常对谁可以与谁通信实施严格控制，以及对于公共服务器（例如，电子商务网站），这些网站更加“开放”，并希望在全球可见。建议的专用网络解决方案要求在称为域控制器的单个位置指定所有网络范围的策略。如果策略允许，域控制器赠款用户通信的显式权限。相比之下，这个公共设置的解决方案主张修改终端主机API，以允许终端主机向广域网和其他公共服务器发出其意图的信号。更广泛的影响：研究将最终形成专用网络的原型安全架构和公共服务安全机制的全面蓝图。无论哪种情况，这种方法都是激进的，代表了对现有思想的实质性知识偏离。

This project aims to develop a clean-slate Internet architecture where protection from malicious network-based attacks is a fundamental design goal. This goal is to be achieved by requiring all traffic to explicitly signal its origin as well as intent to the network at the very outset. Using this as a guiding principle, the principal investigators plan to develop tailor-made security architectures for private networks (e.g., enterprises) which often enforce tight controls on who can communicate with whom, as well as for public servers (e.g., e-commerce sites) which are more "open" and desire to be globally visible. The proposed solution for private networks requires all network-wide policies to be specified at a single location called the domain controller. If the policy allows it, the domain controller grants explicit permission for users to communicate. In contrast, this solution for the public setting argues for modifications to end-host APIs to allow end-hosts to signal their intent to the wide-area Internet and to other public servers.Broader Impact: The research will culminate in a prototype security architecture for private networks and a comprehensive blue-print of security mechanisms for public services. This approach in either case is radical, and represents a substantial intellectual departure from existing thinking.