CAREER: Towards Elastic Security with Safe and Efficient Network Security Function Virtualization

职业：通过安全高效的网络安全功能虚拟化迈向弹性安全

• 批准号: 2129164
• 负责人: Hongxin Hu
• 金额: $ 50万
• 依托单位: SUNY at Buffalo
• 依托单位国家: 美国
• 项目类别: Continuing Grant
• 财政年份: 2021
• 资助国家: 美国
• 起止时间: 2021-02-01 至 2025-10-31
• 项目状态: 未结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=2129164&HistoricalAwards=false
• 关键词: CAREER; Towards; Elastic; Security; Safe

Traditional network security functions are generally implemented on vendor proprietary appliances or middleboxes, which usually lack a general programming interface, and their versatility and flexibility are also very poor. These traditional network security appliances often need to be placed at fixed network entry points and have a constant capacity with respect to the maximum amount of traffic they can process. Such rigid nature makes them inefficient in protecting today's prevailing programmable and virtualizable environments. Network Function Virtualization (NFV) and Software-Defined Networking (SDN) are two emerging networking paradigms that offer the potential to address those limitations and are able to facilitate elastic security with the design of a new breed of network security functions called virtual Network Security Functions (vNSFs). The major goal of this project is to extend the understanding and science of virtual Network Security Functions. It will develop new technology for virtual Network Security Functions where security microservices can be deployed elastically, safely and efficiently, on demand, tailored to the needs of the situation. It addresses major challenges inherent in the management, design, deployment, and execution of virtual Network Security Functions that currently prevent the full use of their benefits. This project will also integrate a comprehensive education plan with the proposed research to train the next generation workforce in computational sciences. The project will foster the diversity of students by active recruitment of women and other under-represented groups for participation in the research.This project will first propose a new firewall architecture to address challenges in virtual firewall scaling. This project will then explore solutions to facilitate safe and efficient virtualization of both traditional and Artificial Neural Network (ANN)-based Intrusion Detection Systems. Finally, this project will develop a general framework, OpenNSFV, for supporting safe and efficient virtualization of network security functions. The proposed solutions of this project will be flexible, scalable, trustworthy, and optimal, and will substantially enhance the security of programmable and virtualizable network infrastructure. To demonstrate the practicality and feasibility of the proposed solutions, the project will implement, deploy, and evaluate the proposed security mechanisms in real production environments.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.

传统的网络安全功能一般在厂商专有的设备或中间盒上实现，通常缺乏通用的编程接口，通用性和灵活性也很差。这些传统的网络安全设备通常需要放置在固定的网络入口点，并且相对于它们可以处理的最大流量而言具有恒定的容量。这种严格的性质使得它们在保护当今流行的可编程和虚拟化环境方面效率低下。网络功能虚拟化 (NFV) 和软件定义网络 (SDN) 是两种新兴的网络范式，它们有可能解决这些限制，并能够通过称为虚拟网络安全功能的新型网络安全功能的设计来促进弹性安全（vNSF）。该项目的主要目标是扩展对虚拟网络安全功能的理解和科学。 它将开发虚拟网络安全功能的新技术，其中安全微服务可以根据需要、根据情况的需要弹性、安全、高效地部署。它解决了虚拟网络安全功能的管理、设计、部署和执行中固有的主要挑战，这些挑战目前阻碍了其优势的充分利用。该项目还将综合教育计划与拟议的研究相结合，以培训下一代计算科学劳动力。该项目将通过积极招募女性和其他代表性不足的群体参与研究来促进学生的多样性。该项目将首先提出一种新的防火墙架构，以应对虚拟防火墙扩展方面的挑战。然后，该项目将探索促进传统和基于人工神经网络 (ANN) 的入侵检测系统安全高效虚拟化的解决方案。最后，该项目将开发一个通用框架OpenNSFV，用于支持安全高效的网络安全功能虚拟化。该项目提出的解决方案将是灵活的、可扩展的、值得信赖的和最佳的，并将大大增强可编程和虚拟化网络基础设施的安全性。为了证明所提出的解决方案的实用性和可行性，该项目将在实际生产环境中实施、部署和评估所提出的安全机制。该奖项反映了 NSF 的法定使命，并通过使用基金会的智力优势和能力进行评估，被认为值得支持。更广泛的影响审查标准。

项目成果

Teaching SDN Security Using Hands-on Labs in CloudLab

使用 CloudLab 中的动手实验室教授 SDN 安全性

• 发表时间: 2020-07
• 期刊: Journal of the Colloquium for Information System Security Education
• 作者: Yuan, Xiaohong;Liu, Zhipeng;Park, Younghee;Hu, Hongxin;Li, Hongda
• 通讯作者: Li, Hongda

Paving the Way for NFV Acceleration: A Taxonomy, Survey and Future Directions

为 NFV 加速铺平道路：分类、调查和未来方向

• 发表时间: 2020-01
• 期刊: ACM computing surveys
• 影响因子: 16.6
• 作者: Fei, Xincai;Liu, Fangming;Zhang, Qixia;Jin, Hai;Hu, Hongxin
• 通讯作者: Hu, Hongxin

Return-to-Non-Secure Vulnerabilities on ARM Cortex-M TrustZone: Attack and Defense

ARM Cortex-M TrustZone 回归非安全漏洞：攻击与防御

• 发表时间: 2023-01
• 期刊: Proceedings of the 60th ACM/IEEE Design Automation Conference (DAC 2023
• 作者: Ma, Zheyuan;Tan, Xi;Ziarek, Lukasz;Zhang, Ning;Hu, Hongxin;Zhao, Ziming
• 通讯作者: Zhao, Ziming

BYOZ: Protecting BYOD Through Zero Trust Network Security

BYOZ：通过零信任网络安全保护 BYOD

• DOI: 978-1-6654-5408
• 发表时间: 2022-01
• 期刊: and Storage
• 作者: Anderson, John;Huang, Qiqing;Cheng, Long;Hu, Hongxin
• 通讯作者: Hu, Hongxin

Octans: Optimal Placement of Service Function Chains in Many-Core Systems

Octans：众核系统中服务功能链的优化布局

• 发表时间: 2021-01
• 期刊: IEEE transactions on parallel and distributed systems
• 影响因子: 5.3
• 作者: Yu, Heng;Zheng, Zhilong;Shen, Junxian;Miao, Congcong;Sun, Chen;Hu, Hongxin;Bi, Jun;Wu, Jianping;Wang, Jilong
• 通讯作者: Wang, Jilong