SBIR Phase I: Container Grids for Software Defined Security

小型企业创新研究(SBIR)第一阶段项目的更广泛影响/商业潜力体现在三个方面。首先，目前正在向软件定义安全过渡的传统硬件网络安全产品有一个价值80亿美元的市场。采用这一通用SDSec平台有可能加速这一市场过渡并提高企业安全性。其次，该项目作为一个开放平台的成功可以大大缩短从研究洞察到大规模生产部署之间的时间；以更低的规模/弹性构建的安全软件更快、更容易构建。最终结果将是创新速度的提高，以及利基、适合用途的安全功能的新市场，而这些功能目前对于供应商来说是无利可图的。最后，该平台可以协调企业内部工作负载的安全投资和实践与公共云工作负载的安全投资，解决领先IT组织面临的关键困境。这将使这些组织在世界舞台上更具竞争力。该小型企业创新研究(SBIR)第一阶段项目解决了构建企业级网络安全功能、可扩展性和弹性方面的两个最困难的技术挑战，其一般方式可以应用于新产品和旧代码库，而无需更改代码。在许多网络安全功能中以一般方式解决扩展/弹性问题是新颖的，而这种大规模并行、轻量级数据包处理功能的特定方法来实现这一点对该领域来说是新的。为什么是现在？这里提出的大规模并行设计对于传统的基于硬件的网络功能来说过于昂贵和不切实际。即使是传统的基于管理程序的虚拟机也会带来过多的硬件开销，无法使此设计在成本上具有竞争力。通过使用打包为Linux容器的vSwitch和网络安全功能，每个实例的硬件开销成本大幅下降，这种扩展/恢复能力的方法可能被证明是实用的。

The broader impact/commercial potential of this Small Business Innovation Research (SBIR) Phase I project appears in three areas. First, there is an $8B dollar market for legacy hardware network security products today that is in transition to Software Defined Security. Adoption of this general SDSec platform has the potential to accelerate that market transition and improve enterprise security. Second, this project's success as an open platform could dramatically shorten the time between research insight and at-scale production deployments; security software built to a lower bar of scale/resiliency is faster and easier to build. The end result will be an increased rate of innovation, and new markets for niche, fit-for-purpose security functions that today are not profitable for vendors to build. Last, this platform could harmonize enterprise security investments and practices for on premise workloads with security investments for public cloud workloads, solving a key dilemma faced by leading IT organizations. This will make those organizations more competitive on the world stage. This Small Business Innovation Research (SBIR) Phase I project addresses the two hardest technical challenges in building an enterprise-grade network security function, scale and resiliency, in a general way that can be applied to both new products and legacy codebases with no code change. Addressing scale/resiliency problems in a general way across many network security functions is novel, and this particular approach of massively parallel, lightweight packet processing functions to achieve this is new to this domain. Why now? The massively parallel design proposed here is far too expensive and impractical with traditional hardware-based network functions. Even traditional hypervisor-based virtual machines carry too much hardware overhead to make this design cost competitive. By using vSwitches and network security functions packaged as Linux containers, the hardware overhead cost per instance drops dramatically, and this class of approach for scale/resiliency may be proven practical.