Collaborative Research: CICI: Secure and Resilient Architecture: S3D: A New SDN-Based Security Framework for the Science DMZ

科学非军事区(SDMZ)是建设最先进的科学研究基础设施的关键基础要素。SDMZ是构建在园区或实验室边缘的网络的一部分，其设计使设备、配置和安全策略针对高性能科学应用而非通用业务系统或企业计算进行了优化。SDMZ正越来越多地由研究机构、校园和国家实验室实施。为了提高科研数据的吞吐量，NSF通过升级研究网络连接和鼓励安装SDMZ，资助了许多科学非军事区在校园的实施。然而，SDMZ的特点使其成为一个独特的生态系统，不能简单地采用现有的基于企业和云的网络安全技术和策略。该项目设计并构建了一个集成的软件定义网络(SDN)安全框架，用于利用科学DMZ(SDMZ)模型管理数据密集型科学应用程序。它是首批演示细粒度安全控制如何在高性能数据密集型网络中共存的演示之一。该项目在大规模数据密集型科研基础设施的可信性和可靠性方面取得了重大进展。该项目评估了SDMZ安全体系结构的现状，并确定了其现有安全服务中的当前不足。新提议的框架：1)使用可迁移和科学应用感知的可动态部署的安全服务定义细粒度的网络流量控制；2)定义一类新的网络权限管理策略，可以撤销或转移违反SDMZ策略或不同于用户定义的、特定于应用的使用预期的流量；3)建立高性能虚拟电路，使数据密集型应用能够注册其经过身份验证的流量并在SDMZ中快速传递。此外，本项目引入了统一的安全策略引擎，大大简化了对上述三种服务的控制。该策略引擎提供了有价值且用户友好的抽象，以满足SDMZ特定于领域的需求。

The Science DMZ (SDMZ) is a key foundational element in building state-of-the-art scientific research infrastructure. The SDMZ is a portion of the network, built at the campus or laboratory's edge, that is designed such that the equipment, configuration, and security policies are optimized for high-performance scientific applications rather than for general-purpose business systems or enterprise computing. SDMZs are increasingly being implemented by research agencies, campuses and national labs. In order to improve the throughput of scientific research data, NSF has funded many Science DMZ implementations on campuses by upgrading research network connectivity and encouraging installation of a SDMZ. However, the SDMZ has characteristics that separate it as a unique ecosystem which cannot simply adopt existing enterprise and cloud based network security technologies and policies. This project designs and prototypes an integrated Software Defined Network (SDN) security framework for managing data-intensive science applications utilizing the Science DMZ (SDMZ) model. It offers one of the first demonstrations of how fine-grained security controls can co-exist within a high performance data-intensive network. This project produces significant advancements in the trustworthiness and reliability of large-scale data-intensive scientific research infrastructures.This project evaluates the current state of the SDMZ security architecture, then identifies the current shortcomings in its existing security services. The new proposed framework: 1) defines fine-grained network flow controls using dynamically deployable security services that are migratable and science-application aware; 2) defines a new class of network privilege management policies that can revoke or divert flows that violate SDMZ policies or that differ from user-defined, application-specific usage expectations; 3) establishes high-performance virtual circuits that enable data intensive applications to register and fast-path their authenticated flows across the SDMZ. Furthermore, this project introduces a unified security policy engine to dramatically simplify the control of the above three services. The policy engine offers a valuable and user-friendly abstraction to meet the domain-specific needs of the SDMZ.