Security Techniques for Virtualized Networks

由于经济、技术和环境方面的原因，将网络管理从基于硬件的转移到基于软件的“虚拟化”网络的趋势正在迅速增强。在虚拟化网络中，基于硬件的网络节点（路由器、交换机、防火墙等）被托管在云中的虚拟机中的基于软件的系统所取代。降低成本和提高资源利用率大有希望。此外，由于这种趋势依赖于软件的设置和操作，虚拟化有望加快创建和更改计算和网络服务的过程。它还可以更容易地创建在传统基础设施中由于成本或规模而不容易实现的服务。这一领域对支持加拿大和其他地区的创新和经济增长至关重要。

The trend to move network management from hardware-based to software-based "virtualized" networks is rapidly getting stronger for economic, technical, and environmental reasons. In virtualized networks, hardware-based network nodes (routers, switches, firewalls, etc.) are replaced with software-based systems that are hosted in virtual machines in the cloud. There is a significant promise of cost reduction and higher resource utilization. Moreover, as this trend relies on software for setup and operation, virtualization is expected to expedite the processes of creating and changing computing and network services. It should also make it easier to create services that were not easily implementable in traditional infrastructures due to cost or scale. This area is of tremendous importance to supporting innovation and economic growth in Canada and elsewhere. Network virtualization will be prevalent in different types of networks: private, public, and hybrid. At the heart of this trend is a significant concern about information security while network elements do not obey the traditional security principles where a physical security perimeter could be established. This proposed research program investigates new techniques for securing virtualized infrastructures from a computer networking perspective. Building on my expertise and my ongoing research program that started with my first Discovery Grant in 2004, the proposed research program will pursue the following distinct themes: Threat modelling and defining an alternative security perimeter for virtual networks. In this theme, we will investigate the creation of a substitute for a security perimeter in software-based virtual networks. Building resilience to attacks into the design of virtualized networks. This gives these networks the ability to sustain attacks and continue to function at a certain level during attacks while other means of defences are being sought. Creating new security evaluation techniques for network applications in virtual networks to be able to assess the security impact of new network applications in these environments. This contributes significantly to fundamental network security research. These defences that emanate from within the network should stop the attacks closer to their sources and reduce attack amplification. Another important benefit of doing this research in creating resilient networking architecture rather than creating a new defence for every type of attack is the prevention of the arms-race situation that we are currently facing. By the time solutions and patches are created, new attacks are appearing again and creating an arms-race like situation. Finally, this program will provide a number of highly qualified personnel with network security skills that are much needed in many industries.