S E E D 4 C. ecure mbedded lements & ata protection the loud. By : Jean-Marc Lambert, Cloud Computing R&D, Gemalto

Transcription

1 S E E D 4 C ecure mbedded lements & ata protection the loud By : Jean-Marc Lambert, Cloud Computing R&D, Gemalto

2 Context Security of the Cloud is still an roadblock to massive cloud adoption in critical segments. Customers need trust, and want to keep control of their assets Need to harden cloud security Enforce various security policies (e.g., regulation and business policies) Let customers define & control these policies Provide evidences of the policy enforcement 2

3 Objectives Building a Trusted Cloud Computing Base (TCCB) Based on A Cloud of minimal Trusted Computing Bases: the Ds (Managed by the NoSE : Network of Secure Elements) 3

4 Objectives Building a Trusted Cloud Computing Base (TCCB) Based on A Cloud of minimal Trusted Computing Bases: the Ds (Managed by the NoSE : Network of Secure Elements) And That can guarantee end-to-end security of service 4

5 Korea Spain Finland France Alcatel-Lucent Gemalto ENSI Bourges Inria Wallix Cygate Mikkelin Puhelin Oy Nokia Solutions & Networks Oy, Finceptum Oy VTT Innovalia Association Nextel Software Quality Systems (SQS) Fundación Vicomtech IKUSI BISCAYTIK D4C: Security Embedded Element and Data Privacy for Cloud SOLACIA 5

6 D4C approach From an isolated security to a coordinated security Secure Element Extended () - Store securely critical data and execute securely critical apps - Support multi-tenant data & apps Network of Secure Element Extended (No) - Secure administration & exchange across cloud nodes. - Allow Tenants to manage their credentials & trust seeds. - Eg. allow critical data to be processed only in secure & compliant VMs (certified location, local key storage, ) No Isolated Security Coordinated Security 6

7 Deliver Trusted Services in a multi-nodes Trusted Cloud Execution Environment Trust & Assurance Trust & Assurance Policy Execution Trusted Execution Network Servers 7 7

8 D4C scope of work Modeling, Deployment, Enforcement and Assurance End 2 End Modeling M D Deployment Enforcement E A Assurance In depth security and assurance 8

9 D4C process D4C Users Policy Modeling Policy Assurance No App & Policy Deployment Policy Monitoring based Policy Enforcement 9

10 D4C: Enforcement engine Cooperative security: the model M D SE are multi-tenant (isolated security domains) E A SE services offered by a dedicated VM No Admin: Manage the attached SE (GP), the allocation of nodes to tenants & mirroring Tenant s security domain into SE(s) Tenant Admin: Manage security data and function in tenant security domains SE Tenant 1 security domain Data - Keys Functions - No Admin Tenant Admin Tenant 2 security domain Network of Secure Elements (No) Intranet Data - Keys Functions - Shared security domain Data - Location - Time/date - -Functions - Encrypt/decrypt - 10 West VM South SECURE ELEMENT East West No Admin Web Internal VLAN Hardened Hypervisor (KVM) 1 HOST 1 VM per HOST 1 SE per HOST

11 User W eb Server Use Case Environment Application/ Processing Server Ba nk Do mai n Possible location of SE or Operational Department Authenticaton Domain Authentication Server Database Servers Operational Department Operational Department MSC V L R H L R SMSC A U C EIR NSS VLR2 SMSC2 D4C Use-cases Various types of use-cases at different cloud levels (IaaS, PaaS, SaaS) ANSP AIRLINES AFTN Messages Integration Platform IATA Messages ikloud AOS in SaaS Passenger Services File Sharing App WebCom Services (eg WebRTC, vims) File Sharing App AODB MUSIK Advertising information EU Other SE E Airport 1 Airport Group 1 Airport N Airport Group N Airport 1 Passengers BI Possible locations of the SE Airport system mgt e-gov services IMS communication services Security Operations Center e-banking IAM authentication and auditing Security monitoring PaaS environment Telco services in the cloud (NFV) IaaS level security Administrative access mgt 11 vhsm + key ceremony

12 As a Conclusion : Tenant s defined Security Policy & Control Security aware placement & deployment engine Modeling, Deployment, Enforcement and Assurance solution Enforced by : Seed4C provides : The Network of Secure Elements Extended (No) The Secure Elements physically present in each trustable cloud node. The Assurance Framework providing evidences and allowing continuous monitoring. 12

13 13