CC*DNI Integration: Enhancing Science Through Custom Paths For Trusted Users

University Of Kentucky Research Foundation, Lexington KY

Investigators

Abstract

Progress in medicine, science, and engineering -- as in essentially all areas of human endeavor -- increasingly depends on network access to very large data sets (billions to trillions of bytes) containing information such as scientific measurements, monitoring information, images, videos, simulation results, etc. The number of researchers working with, transferring, and sharing very large data sets is growing at an alarming rate. Although network transmission speeds are rapidly increasing, devices deployed in the middle of the network for security and management purposes -- e.g., firewalls, intrusion detectors, and the like -- create major bottlenecks that prevent researchers from being able to quickly move these large files between laboratories, high-performance computing sites, and storage facilities. Historically, network designers have addressed this problem by creating and maintaining a special "Science DMZ" network that provided a "fast lane", bypassing performance-limiting security devices thanks to the trusted nature of the users and applications connected to the Science DMZ. Today, however, the growing number and variety of users who need high-performance data transfer makes it increasingly difficult to maintain such a separate infrastructure. This project is developing ways to provide trusted users on the normal (campus) network with dynamic access to such fast lanes by authenticating them on-the-fly, determining the nature of their data transfer, and whether it should be allowed or not. This project leverages emerging Software-Defined Networking (SDN) capabilities to single out individual data flows for specialized treatment in the network. Using the SDN infrastructure already deployed on campus, the project is developing new control software and protocols that enable trusted users to authenticate themselves to the network and set up network connections free from middlebox interference while still enforcing middlebox security functionality for normal campus traffic. The ability of trusted users to create such fast lanes -- as opposed to (only) network administrators -- will enable future networks to handle the rapidly growing number of big data users.