Security Techniques for Virtualized Networks

由于经济、技术和环境方面的原因，将网络管理从基于硬件的转移到基于软件的“虚拟化”网络的趋势正在迅速增强。在虚拟化网络中，基于硬件的网络节点（路由器、交换机、防火墙等）被托管在云中的虚拟机中的基于软件的系统所取代。降低成本和提高资源利用率大有希望。此外，由于这种趋势依赖于软件的设置和操作，虚拟化有望加快创建和更改计算和网络服务的过程。它还可以更容易地创建在传统基础设施中由于成本或规模而不容易实现的服务。这一领域对支持加拿大和其他地区的创新和经济增长至关重要。网络虚拟化将在不同类型的网络中流行：私有网络、公共网络和混合网络。这一趋势的核心是对信息安全的重大关注，而网络元素不遵守可以建立物理安全边界的传统安全原则。本研究计划从计算机网络的角度研究保护虚拟基础设施的新技术。基于我的专业知识和我正在进行的研究计划，从2004年我的第一个发现基金开始，拟议的研究计划将追求以下不同的主题：威胁建模和定义虚拟网络的替代安全边界。在本主题中，我们将研究在基于软件的虚拟网络中创建安全边界的替代品。在虚拟网络的设计中构建抵御攻击的能力。这使这些网络能够承受攻击，并在攻击期间继续在一定水平上运行，而其他防御手段正在寻求。为虚拟网络中的网络应用程序创建新的安全评估技术，以便能够评估这些环境中新的网络应用程序的安全影响。这对网络安全基础研究具有重要意义。这些来自网络内部的防御措施应该可以在更接近其来源的地方阻止攻击，并减少攻击的扩大。在创建弹性网络架构而不是为每种类型的攻击创建新的防御方面进行这项研究的另一个重要好处是防止我们目前面临的军备竞赛局面。当解决方案和补丁被创造出来时，新的攻击又出现了，造成了类似军备竞赛的局面。最后，该计划将提供许多行业急需的具有网络安全技能的高素质人才。

The trend to move network management from hardware-based to software-based "virtualized" networks is rapidly getting stronger for economic, technical, and environmental reasons. In virtualized networks, hardware-based network nodes (routers, switches, firewalls, etc.) are replaced with software-based systems that are hosted in virtual machines in the cloud. There is a significant promise of cost reduction and higher resource utilization. Moreover, as this trend relies on software for setup and operation, virtualization is expected to expedite the processes of creating and changing computing and network services. It should also make it easier to create services that were not easily implementable in traditional infrastructures due to cost or scale. This area is of tremendous importance to supporting innovation and economic growth in Canada and elsewhere.Network virtualization will be prevalent in different types of networks: private, public, and hybrid. At the heart of this trend is a significant concern about information security while network elements do not obey the traditional security principles where a physical security perimeter could be established. This proposed research program investigates new techniques for securing virtualized infrastructures from a computer networking perspective.Building on my expertise and my ongoing research program that started with my first Discovery Grant in 2004, the proposed research program will pursue the following distinct themes: Threat modelling and defining an alternative security perimeter for virtual networks. In this theme, we will investigate the creation of a substitute for a security perimeter in software-based virtual networks. Building resilience to attacks into the design of virtualized networks. This gives these networks the ability to sustain attacks and continue to function at a certain level during attacks while other means of defences are being sought. Creating new security evaluation techniques for network applications in virtual networks to be able to assess the security impact of new network applications in these environments. This contributes significantly to fundamental network security research. These defences that emanate from within the network should stop the attacks closer to their sources and reduce attack amplification. Another important benefit of doing this research in creating resilient networking architecture rather than creating a new defence for every type of attack is the prevention of the arms-race situation that we are currently facing. By the time solutions and patches are created, new attacks are appearing again and creating an arms-race like situation. Finally, this program will provide a number of highly qualified personnel with network security skills that are much needed in many industries.