CAREER: Secure and Trustworthy Intent-Based Networking

Intent-based networking (IBN) is poised to be a crucial element in future computer networks over the next decade. Unlike traditional network management, IBN allows administrators to express their goals in high-level natural language, focusing on 'what' they want the network to achieve rather than 'how' it should be configured. This approach simplifies network management in various environments such as cloud computing data centers, enterprises, and mobile networks. IBN also holds potential for enhancing network security by reducing human errors and responding swiftly to emerging threats. However, there has been little attention given to the unique security challenges posed by IBN for network vendors, administrators, tenants, and users. This project seeks to bridge that gap by addressing IBN's security and trust aspects. The project's novelties are designing a secure and trustworthy IBN architecture, identifying vulnerabilities in current designs, defending against operational attacks, and enhancing resilience against emerging threats. The project's broader significance and importance are in influencing real-world designs, standardization efforts, and industry practices to create a safer and more resilient digital infrastructure for society. The project aims to embed security considerations into the foundational principles of IBN, design a secure reference architecture, and explore IBN's interactions with other network components. The research team addresses these goals in three central and interdependent research thrusts. The first thrust focuses on securely fulfilling network intents, including designing formal models, identifying security-related race conditions, and addressing side-channel attack vectors. The second thrust ensures the secure fulfillment of network intents through scalable network provenance collection for generating access control policies and maintaining overall decision-making integrity. The third thrust involves integrating secure IBN into the broader network infrastructure, addressing cross-plane vulnerabilities, enforcing correct cross-plane functionality, and enhancing reasoning capabilities through root cause analysis. The research team plans to share project results by enhancing existing open-source IBN implementations and creating new tools for use by other researchers. Additionally, the outcomes are incorporated into networking and security courses for both graduate and undergraduate students. This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.