"WANshielder – A Network Appliance for Cyber-Resilient ESnet Operation"

The Energy Sciences Network (ESnet) is a high-speed computer network serving United States Department of Energy (DOE) scientists and their HPC collaborators worldwide. The ESnet is a multi- domain network over virtual circuits guaranteeing end-to-end data transfer performance and security on the network. This network structure built using VPN connections and IPSEC tunnels is very similar to military crypto-partitioned networks and have the same problems taking advantage of network routing and security techniques to improve performance. This makes it harder to ensure resilient mission data exchange among user enclaves in the face of WAN impairments induced by cyber-attacks, network misconfiguration, equipment failures, and other causes. Architecture Technology Corporation (ATCorp) will develop a network appliance called WANshielder for enabling robust and resilient operation of high performance computing (HPC) applications over a wide-area Energy Sciences Network (ESnet) infrastructure experiencing accidental failures or cyber- attacks. Residing entirely within the plain text side of a HPC user enclave behind the inline network encryptor (INE), WANshielder operates as a transparent bridge or a “bump in the wire” device passively monitoring all IP traffic entering and leaving the enclave to infer the onset or occurrence of network events which could adversely impact mission applications. It then automatically takes actions to mitigate the impact of these network events. The ability of WANshielder to provide such automatic and agile recovery from network events, while meeting the throughput and latency requirements for networked HPC applications in an Energy Sciences Network (ESnet) environment, is well beyond the capabilities of the state of the art. During Phase I ATCorp will: (1) develop the detailed design of WANshielder; and (2) establish thefeasibility of the approach by building a proof-of-concept prototype of the appliance. WANshielder is a device installed within each enclave of a secure network that will ensure resilient mission data exchange between users in other enclaves in the face of WAN impairments induced by cyber-attacks, network misconfiguration, equipment failures, or other causes Commercial Applications and Other Benefits: The successful completion of a Phase I and then a Phase II prototype of WANShielder will allow ATCorp to move forward along the Technology Readiness scale (TRL levels), to further develop and productize WANShielder. The WANShielder project has many foundational components from previous DoD SBIRs and a successful Phase II and Phase III will obviously benefit the nation’s research and science community, but the software and techniques will then be able to be transferred to military applications as well to implement WANShielder on military Crypto-partitioned networks using HAIPEs as well. These types of networks are also used widely within large enterprise networks that connect multiple distributed locations into a single secure network. The potential public benefits of the WANShielder project are numerous, and the potential customers and market size are large.