Collaborative Research: CICI: Secure and Resilient Architecture: SciGuard: Building a Security Architecture for Science DMZ Based on SDN and NFV Technologies

随着数据密集型科学在许多科学领域成为常态，高性能数据传输正迅速成为标准的网络基础设施要求。为了满足这一要求，越来越多的大学校园部署了科学DMZ。科学DMZ是构建在园区或实验室网络边缘或边缘附近的网络的一部分，其设计使设备、配置和安全策略针对高性能科学应用而不是通用计算进行优化。该项目开发了一个名为SciGuard的安全和弹性架构，以应对科学非军事区的安全挑战和固有弱点。SciGuard基于两种新兴的网络模式，即软件定义网络(SDN)和网络功能虚拟化(NFV)，这两种模式都支持保护科学非军事区所需的粒度、灵活性和弹性。两个核心安全功能，SDN防火墙应用程序和虚拟入侵检测系统(IDS)共存于SciGuard中，用于保护科学非军事区。SDN防火墙应用程序是在SDN控制器上运行的基于软件的在线安全功能。它可以很好地扩展，而无需使用按流/按连接的网络流量处理绕过防火墙。它还与基于硬件的机构防火墙分离，为发送到科学DMZ的纯科学流量实施量身定制的安全策略。虚拟入侵检测系统是一种基于NFV的被动安全功能，可以快速实例化和灵活扩展，以应对科学非军事区中的攻击流量变化，同时显著降低设备和运营成本。除了这些功能外，研究人员还为SciGuard设计了基于云的联邦机制，以支持安全策略自动测试和安全情报共享。在这个项目中开发的新机制是健壮的、可扩展的、低成本的、易于管理的和最佳配置的，因此大大增强了科学非军事区的安全性。这项研究通过积极招募妇女和其他代表性不足的群体参与该项目，鼓励参与该项目的学生的多样性。该项目有大量的研究生参与研究，并培养有前途的本科生实施和实验所提出的方法。此外，该项目通过将研究成果纳入新的和现有的课程来改进学术课程。

As data-intensive science becomes the norm in many fields of science, high-performance data transfer is rapidly becoming a standard cyberinfrastructure requirement. To meet this requirement, an increasingly large number of university campuses have deployed Science DMZs. A Science DMZ is a portion of the network, built at or near the edge of the campus or laboratory's network, that is designed such that the equipment, configuration, and security policies are optimized for high-performance scientific applications rather than for general-purpose computing. This project develops a secure and resilient architecture called SciGuard that addresses the security challenges and the inherent weaknesses in Science DMZs. SciGuard is based on two emerging networking paradigms, Software-Defined Networking (SDN) and Network Function Virtualization (NFV), both of which enable the granularity, flexibility and elasticity needed to secure Science DMZs. Two core security functions, an SDN firewall application and a virtual Intrusion Detection System (IDS), coexist in SciGuard for protecting Science DMZs. The SDN firewall application is a software-based, in-line security function running atop the SDN controller. It can scale well without bypassing the firewall using per-flow/per-connection network traffic processing. It is also separated from the institutional hardware-based firewalls to enforce tailored security policies for the science-only traffic sent to Science DMZs. The virtual IDS is an NFV-based, passive security function, which can be quickly instantiated and elastically scaled to deal with attack traffic variations in Science DMZs, while significantly reducing both equipment and operational costs. In addition to these functions, the researchers also design a cloud-based federation mechanism for SciGuard to support security policy automatic testing and security intelligence sharing. The new mechanisms developed in this project are robust, scalable, low cost, easily managed, and optimally provisioned, therefore substantially enhancing the security of Science DMZs. This research encourages the diversity of students involved in the project by active recruitment of women and other underrepresented groups for participation in the project. The project has substantial involvement of graduate students in research, and trains promising undergraduate students in the implementation and experiments of the proposed approach. Moreover, the project enhances academic curricula by integrating the research findings into new and existing courses.