Grant: Discovery Grants Program - Individual

The trend to move network management from hardware-based to software-based "virtualized" networks is rapidly getting stronger for economic, technical, and environmental reasons. In virtualized networks, hardware-based network nodes (routers, switches, firewalls, etc.) are replaced with software-based systems that are hosted in virtual machines in the cloud. There is a significant promise of cost reduction and higher resource utilization. Moreover, as this trend relies on software for setup and operation, virtualization is expected to expedite the processes of creating and changing computing and network services. It should also make it easier to create services that were not easily implementable in traditional infrastructures due to cost or scale. This area is of tremendous importance to supporting innovation and economic growth in Canada and elsewhere.Network virtualization will be prevalent in different types of networks: private, public, and hybrid. At the heart of this trend is a significant concern about information security while network elements do not obey the traditional security principles where a physical security perimeter could be established. This proposed research program investigates new techniques for securing virtualized infrastructures from a computer networking perspective.Building on my expertise and my ongoing research program that started with my first Discovery Grant in 2004, the proposed research program will pursue the following distinct themes: Threat modelling and defining an alternative security perimeter for virtual networks. In this theme, we will investigate the creation of a substitute for a security perimeter in software-based virtual networks. Building resilience to attacks into the design of virtualized networks. This gives these networks the ability to sustain attacks and continue to function at a certain level during attacks while other means of defences are being sought. Creating new security evaluation techniques for network applications in virtual networks to be able to assess the security impact of new network applications in these environments. This contributes significantly to fundamental network security research. These defences that emanate from within the network should stop the attacks closer to their sources and reduce attack amplification. Another important benefit of doing this research in creating resilient networking architecture rather than creating a new defence for every type of attack is the prevention of the arms-race situation that we are currently facing. By the time solutions and patches are created, new attacks are appearing again and creating an arms-race like situation. Finally, this program will provide a number of highly qualified personnel with network security skills that are much needed in many industries.