CICI:TCR:CAREFREE:Cloud infrAstructure ResiliencE of the Future foR tEstbeds, accelerators and nEtworks

云计算形式的网络基础设施已成为加速现代科学探索、发现和进步的主要主力。几个研究云是可用的，并为来自不同研究领域的科学家提供了重要的新网络基础设施方法，这些方法是通过商业云产品无法获得的。与商业云一样，在这些系统上运行的科学工作负载需要安全性，使用这些尖端系统的科学家希望保持其数据和程序的完整性和机密性。此外，他们还希望系统具有强大的可用性，而不必担心攻击造成的中断。由于这些测试平台提供裸金属资源来支持系统研究，因此它们具有更大的攻击面（与商业云相比），这使得它们不太安全。因此，该项目的目标是保护科学网络基础设施（以下一代云系统的形式），其中包括网络连接的加速器。 该项目旨在开发下一代弹性云基础设施。该研究通过关注网络和硬件加速器，从跨层的角度研究网络基础设施安全。其补充研究重点建立在开放云测试平台上。该实验平台与公共网络隔离，是解决安全问题的理想平台，可以发起，识别和缓解攻击。这项研究有三个重点。首先，它确定了利用与网络层相关的漏洞的高级攻击策略。其次，它定义并探讨了三个经典的安全问题：机密性，完整性和可用性;这可能会被利用硬件加速器漏洞的对手所破坏。第三，它探索了有效的和可扩展的防御解决方案与硬件/软件/网络的协同设计策略。总的来说，它将这些跨层防御解决方案与现有的基础设施相集成，并为评估和过渡到其他研究网络基础设施制定基准。该奖项反映了NSF的法定使命，并被认为值得通过使用基金会的知识价值和更广泛的影响审查标准进行评估来支持。

Cyberinfrastructure in the form of cloud computing has become the main workhorse for accelerating modern scientific exploration, discovery, and advancement. Several research clouds are available and give scientists from diverse research domains access to significant new cyber-infrastructure approaches that are unavailable through commercial cloud offerings. Like their commercial cloud counterparts, the scientific workloads running on these systems require security, and the scientists using these cutting-edge systems wish to preserve the integrity and confidentiality of their data and programs. In addition, they expect robust system availability without worrying about disruptions caused by attacks. Since these testbeds offer bare metal resources to support systems research they have an increased attack surface (in comparison to commercial clouds), which makes them less secure. As a consequence, the goal of this project is to secure scientific cyberinfrastructures (in the form of next-generation cloud systems) that include network-attached accelerators. This project aims to develop the next-generation resilient cloud infrastructure. The research investigates cyberinfrastructure security from a cross-layer perspective by focusing on both networking and hardware accelerators. Its complementary research thrusts build on the Open Cloud Testbed. This experimental testbed is isolated from public networks and is an ideal platform for addressing security issues where attacks can be launched, identified, and mitigated. This research has three thrusts. First, it identifies advanced attack strategies leveraging vulnerabilities associated with the network layer. Second, it defines and explores three classic security concerns; confidentiality, integrity, and availability; which can be compromised by an adversary leveraging hardware accelerator vulnerabilities. Third, it explores efficient and scalable defense solutions with a co-design strategy for hardware/software/network. Collectively, it integrates these cross-layer defense solutions with the existing infrastructure and develops benchmarking for evaluation and transition to other research cyberinfrastructures.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.