Software Defined Security Mechanisms for Critical Infrastructure Management

Transcription

1 Software Defined Security Mechanisms for Critical Infrastructure Management SESSION: CRITICAL INFRASTRUCTURE PROTECTION Dr. Anastasios Zafeiropoulos, Senior R&D Architect, Contact:

2 Network and not only- softwarization The Future Internet is the Future Internet Software. The hardware will become a commodity and the value will be in the software to drive it and the data it generates. Era of a software revolution through the design of infrastructural agnostic applications. Applications and services provided without the definition of strict borders and control points. Softwarization seen as a game-changer for the Telecom, Cloud and ICT domains.

3 Move towards a new world of applications Reconfigurable by design applications. Exploit programmability of the underlying infrastructure. Dynamically adaptive according to network conditions and policies. Need for novel programming paradigms and open APIs. Avoid vendor lock-in.

4 The ARCADIA Project Horizon 2020 EU funded project (Call:H2020-ICT ) - Design of a novel reconfigurable by design highly distributed applications development paradigm over programmable infrastructure. Novel software development paradigm; Context Model that will conceptualize dynamic configuration and programmable aspects of underlying resources; Smart Controller that is going to undertake placement and real time management of applications over programmable infrastructure.

5 ARCADIA Conceptual Architecture

6 Enabling Technologies Network Function Virtualization Deployment and management of applications; Carrier grade and scalable solutions. Software Defined Networking Exploit network programmability; Management of NFV deployments. Reactive Software Development Paradigm - Interpretable Software Annotations High level description of objectives; Configurability hints to orchestration components; Real time adaptation/re-configuration.

7 Network Function Virtualization E2E Network Service End Point Network Service End Point Logical Abstractions Logical Links SW Instances VNF : Virtualized Network Function VNF VNF VNF VNF VNF VNF Instances VNF VNF VNF VNF NFV Infrastructure (NFVI) VNF Forwarding Graph aka. Service Chain Virtual Resources Virtual Compute Virtual Storage Virtual Network Virtualization SW HW Resources Virtualization Layer Compute Storage Network

8 Service Chaining according to Virtual Functions (VFs) Develop NFV-aware applications - Virtual Network Functions (VNFs) are becoming more and more application oriented. VNFs require support of application orchestration beyond network resource configuration. VFs as abstraction of VNFs. Service Chaining: multiple VFs used in sequence to deliver a service - E2E Services composed through VF Forwarding Graphs ETSI NFV Architecture, Network Functions Virtualisation (NFV); Management and Orchestration

9 ARCADIA Application Breakdown

10 Reactive Distributed Software Development Paradigm Simple and high-level abstractions for concurrency and parallelism. High levels of responsiveness, resiliency, elasticity and asynchronous mode of communication. Reactive components, able to react and dynamically adapt to the conditions on their operational environment. Non-blocking behaviour among the instantiated functions per component - asynchronous and event-driven programming models. Parts of the system can fail and recover without compromising the overall application while high-availability can be ensured through replication in critical components Let-it-crash models. Properties of Reactive Systems based on the Reactive Manifesto

11 NFV Security Main Challenges Combination of all generic virtualization threats and those threats specific to network function software. Network function-specific threats are determined by the quality of the network function s design and software implementation. Reliance on additional software (that is, hypervisors and modules for management and orchestration) and hence a longer chain of trust. Reduced isolation of network functions. Fate-sharing due to resource pooling and multitenancy. Providing Security in NFV: Challenges and Opportunities, Alcatel-Lucent Strategic White Paper

12 NFV Security Opportunities Virtualization provides the potential to eliminate some threats inherent to the network function software through new mechanisms such as hypervisor introspection and centralized security management. VM introspection monitoring can provide high-fidelity monitoring while keeping the monitor secure by leveraging the isolation provided by virtualization. Centralized security management allows network functions to be configured and protected effectively according to a common policy as well as to support a set of automated mechanisms. Design and deployment of a policy-driven approach to orchestration, security zoning and workload placement. e.g if the policy requires that certain VNF components to be separated physically, they will be placed on different hosts. Support state-of-the-art security analytics to enable security anomaly prediction, detection and isolation.

13 Critical Infrastructure NFV deployment models and Security Considerations Private NFV deployment model the carrier owns the cloud, network function software and service portal main threats coming from insiders analytics applied to access logs Exposed NFV deployment model some network functions are exposed to subscribers infiltration or compromise of a public network function to internal VNFs employ security zoning, hypervisor introspection and analytics

14 Critical Infrastructure NFV deployment models and Security Considerations Hybrid NFV deployment model management of VNFs from a third party entity potential for attack in the carrier network identity and access management solutions Community NFV deployment model the carrier hosts network functions that are deployed and managed by different parties attack by a malicious VNF or other application employ security zoning and firewalling decommissioning and recommissioning of VNFs Providing Security in NFV: Challenges and Opportunities, Alcatel-Lucent Strategic White Paper

15 Security Analytics in NFV world Objective to detect, explain, explore, and understand security events in an NFV environment. Analytics will be crucial to support dynamic service chains, service automation and detect security threats. real-time correlation and log aggregation historical analysis and long-term insights ability to train models and detect outliers across any of the existing security data feeds. Collect service chain performance analytics and identify anomalies or misbehaviour of a software instance.

16 High Performance Survivable Communications in Distributed IoT Deployments Provide public safety agencies with a survivable, scalable and robust communications and professional IoT-supported intervention management services during day-to-day operation and disaster relief missions.

17 Anastasios Zafeiropoulos, Senior R&D Architect, UBITECH Contact: