Research Engagement
The Science DMZ
What is a Science DMZ?
A Science DMZ is a network environment within a campus’s IT infrastructure, designed specifically for moving large volumes of research data. Unlike the enterprise campus network, it minimizes barriers to data movement by applying a security model written specifically for science workflows. This gives large research data transfers a clean path to the wide area over equipment and connectivity optimized for high performance.
While the network is a key component of this environment, a Science DMZ also reshapes how research data is handled end-to-end and how your teams work with it, not just what equipment you deploy.
The concept originated from ESnet, the U.S. Department of Energy’s Energy Sciences Network, which maintains the full technical reference in its Fasterdata knowledge base.
Research traffic needs its own path
Campus networks are built around enterprise traffic: email and calendaring, HR and finance systems, administrative applications, staff and student devices, web and cloud services, voice and video. These applications create many small connections that usually pass through a firewall for inspection.
Research data traffic has a different profile. Moving datasets among instruments, storage, computing systems, and collaborators produces large volumes of data. These transfers are often negatively affected by packet loss and reordering, which can drastically slow transfer rates, particularly when magnified over a continental or international connection with many participating networks. Firewalls, shallow-buffered switches, and device tuning can all contribute to loss. A Science DMZ is a concept for minimizing sources of loss at the edge, fully utilizing the path. It can help turn a transfer measured in hours into one measured in minutes, or one measured in days into one measured in hours.
A Science DMZ gives research data its own path and security model, sized and configured for how the data actually moves, reducing data transfer time.
A Science DMZ consists of:
An intentionally engineered path at or near the network edge
Wire-speed devices with deep queues, augmenting the traditional enterprise environment with a virtual-circuit option (where available) and a security policy scoped to the small, known set of hosts that use it.
Data Transfer Nodes (DTNs)
Servers built and tuned for one purpose, moving data well, rather than general-purpose machines drafted into the role – running purpose-built transfer tools such as Globus.
Measurement built in from the start
So that when something is slow you can see where instead of guessing.
Research engagement and support
A Science DMZ only delivers value when researchers actually use it. That means onboarding the scientists who move data and standing up the support teams and expertise that keep it usable over time.
perfSONAR is a widely deployed open-source toolkit for troubleshooting network performance problems and helps set realistic expectations about what a given path can deliver. It tests continuously, so you can investigate a slow transfer with measurements rather than assumptions. This testing methodology surfaces problems proactively and helps researchers adopt both the ScienceDMZ and the appropriate tools, rather than developing workarounds.
Because perfSONAR is deployed on national backbones like the Internet2 network and across many regional networks, it makes problems that span more than one organization considerably easier to solve collaboratively.
Six R&E network organizations lead the perfSONAR development consortium: the Energy Sciences Network (ESnet), Indiana University, Internet2, and the University of Michigan in the U.S.; GÉANT across Europe; and Rede Nacional de Ensino e Pesquisa (RNP) in Brazil. It grew out of an Internet2 network performance measurement effort dating back to 2001.
The bigger picture
The Science DMZ is now accepted best practice for research connectivity. Hundreds of campuses have adopted it, largely through the National Science Foundation’s Campus Cyberinfrastructure (CC*) program.
But a Science DMZ is only one part of a path between endpoints. Data moving between two institutions traverses many networks and exchange points at the campus, regional, state, national, and international scales, each operated by a different entity. Experience shows that most performance problems occur near the network edge. While a well-built campus edge cannot compensate for problems elsewhere along the path, it remains the essential foundation for successful scientific data movement.