Security Management Automation of Cloud-Based Security Services in I2NSF Framework
Department of Computer Science and Engineering
Sungkyunkwan University2066 Seobu-Ro, Jangan-GuSuwonGyeonggi-Do16419Republic of Korea+82 31 299 4957+82 31 290 7996pauljeong@skku.eduhttp://iotlab.skku.edu/people-jaehoon-jeong.php
Department of Electronic, Electrical and Computer Engineering
Sungkyunkwan University2066 Seobu-Ro, Jangan-GuSuwonGyeonggi-Do16419Republic of Korea+82 31 299 4957patricklink@skku.edu
Electronics and Telecommunications Research Institute
218 Gajeong-Ro, Yuseong-GuDaejeon305-700Republic of Korea+82 42 860 6514pjs@etri.re.kr
Telefonica I+D
Jose Manuel Lara, 9Seville41013Spain+34 682 051 091diego.r.lopez@telefonica.com
Huawei
7453 Hickory HillSalineMI48176USA+1-734-604-0332shares@ndzh.com
Security
I2NSF Working GroupInternet-Draft
This document describes Security Management Automation (SMA) of
cloud-based security services in the framework of Interface to Network
Security Functions (I2NSF). The security management automation in this
document deals with closed-loop security control, security policy
translation, and security audit. To support these three features in SMA, this
document specifies an augmented architecture of the I2NSF framework with new
system components and new interfaces.
Interface to Network Security Functions (I2NSF) defines a framework
and interfaces for interacting with Network Security Functions (NSFs)
.
Note that an NSF is defined as software that provides a set of
security-related services, such as (i) detecting unwanted activity,
(ii) blocking or mitigating the effect of such unwanted activity
in order to fulfill service requirements, and (iii) supporting
communication stream integrity and confidentiality .
The NSF can be implemented as a Virtual Network Function (VNF) in
a Network Functions Virtualization (NFV) environment .
This document describes Security Management Automation (SMA) of
cloud-based security services in the I2NSF framework. The security
management automation includes closed-loop security control, security
policy translation, and security audit. This document specifies an
augmented architecture of the I2NSF framework for the SMA services with
new system components and new interfaces.
For reliable management for networked security services, this document
proposes a network management and verification facility using a
secuirty audit system (e.g., remote attestation and blockchain ).
This security audit system can facilitate the non-repudiation of configuration
commands and monitoring data generated in the I2NSF framework.
Therefore, with the security service automation, this document facilitates
the foundation of Intent-Based Networking (IBN) for autonomous security services
.
This document uses the terminology described in and
.
In addition, the following terms are defined below:
Security Management Automation (SMA): It means that a high-level
security policy from a user (or administrator) is well-enforced in
a target I2NSF system. The high-level security policy can be
translated into the corresponding low-level security policy by a
security policy translator and dispatched to appropriate NSFs.
Through the monitoring of the NSFs, the activity and performace of
the NSFs is monitored and analyzed. If needed, the security rules of
the low-level security policy are augmented or new security rules are
generated and configured to appropriate NSFs.
Security Policy Translation (SPT): It means that a high-level security
policy is translated to a low-level security policy that can be
understood and configured by an NSF for a specific security service,
such as firewall, web filter, deep packet inspection, DDoS-attack
mitigation, and anti-virus.
Feedback-Based Security Management (FSM): It means that a security
service is evolved by updating a security policy (having security rules)
and adding new security rules for detected security attacks by
processing and analzing the monitoring data of NSFs.
This section summarizes the I2NSF framework as defined in .
As shown in ,
an I2NSF User can use security functions by delivering high-level security policies,
which specify security requirements that the I2NSF user wants to enforce, to
the Security Controller via the Consumer-Facing Interface (CFI)
.
The following are the system components for the SMA-based I2NSF framework.
I2NSF User: An entity that delivers a high-level security policy to
Security Controller.
Security Controller: An entity that controls and manages other system
components in the I2NSF framework. It translates a high-level security
policy into the corresponding low-level security policy and selects
appropriate NSFs to execute the security rules of the low-level security
policy.
Developer's Management System (DMS): An entity that provides an image of
of a virtualized NSF for a security service to the I2NSF framework, and
registers the capability and access information of an NSF with Security
Controller.
Network Security Function (NSF): An entity that is a Virtual Network
Function (VNF) or Container Network Function (CNF), which is called
Cloud-native Network Function, for a specific network security service
such as firewall, web filter, deep packet inspection, DDoS-attack
mitigation, and anti-virus.
I2NSF Analyzer: An entity that collects monitoring data from NSFs and
analyzes such data for checking the activity and performance of the NSFs
using machine learning techniques (e.g., Deep Learning ).
If there is a suspicious attack activity for the target network or NSF,
I2NSF Analyzer delivers a report of the augmentation or generation of
security rules to Security Controller.
For SMA-based security services with Feedback-Based Security Management (FSM),
I2NSF Analyzer is required as a new I2NSF component for the legacy I2NSF
framework to collect monitoring data from NSFs and
analyzing the monitoring data. The actual implementation of the analysis of
monitoring data is out of the scope of this document.
The following are the interfaces for the SMA-based I2NSF framework. Note that
the interfaces are modeled with YANG and security
policies are delivered through either RESTCONF or
NETCONF .
Consumer-Facing Interface: An interface between I2NSF User and Security
Controller for the delivery of a high-level security policy
.
NSF-Facing Interface: An interface between Security Controller and an NSF
for the delivery of a low-level security policy
.
Registration Interface: An interface between a DMS and Security Controller
for the registration of an NSF's capability and access information with the
Security Controller or the query of an NSF for a required low-level security
policy .
Monitoring Interface: An interface between an NSF and I2NSF Analyzer for
collecting monitoring data from an NSF to check the activity and performance
of an NSF for a possible malicious traffic .
Analytics Interface: An interface between I2NSF Analyzer and Security
Controller for the delivery of an analytics report of the augmentation
or generation of security rules to Security Controller, which lets
Security Controller apply the report for security rules to its security
policy management.
For SMA-based security services with FSM, Analytics Interface is required
as a new I2NSF interfacefor the legacy I2NSF framework
to deliver an analytics report of the augmentation or generation of security rules to Security
Controller through the analysis of the monitoring data from NSFs.
To facilitate Security Policy Translation (SPT), Security Controller needs to
have a security policy translator that performs the translation of a high-level
security policy into the corresponding low-level security policy.
For the automatic SPT services, the I2NSF framework needs to bridge a high-level
YANG data model and a low-level YANG data model in an automatic manner
.
Note that a high-level YANG data model is for the I2NSF Consumer-Facing Interface
,
and a low-level YANG data model is for the I2NSF NSF-Facing Interface
.
shows automatic
mapping of high-level and low-level data models. Automatic Data Model Mapper
takes a high-level YANG data module for the Consumer-Facing Inteface and
a low-level YANG data module for the NSF-Facing Interface. It then
constructs a mapping table associating the data attributes (or variables) of
the high-level YANG data module with the corresponding data attributes (or
variables) of the low-level YANG data module. Also, it generates a set of
production rules of the grammar for the construction of an XML file of
low-level security policy rules.
shows
high-to-low security policy translation. A security policy translator
is a component of Security Controller. The translator consists of
three components such as Policy Data Model Mapper, Policy Data Extractor,
Policy Data Converter, and Policy Generator.
Policy Data Model Mapper maps the attributes and their values of a
high-level security policy to the corresponding attributes and their
values of a low-level security policy. Note that the values of a high-level
security policy may involve a human language and must be converted
to an appropriate value for a low-level security policy (e.g.,
employees -> 192.0.1.0/24).
Policy Data Extractor extracts the values of the attributes related to
a security policy from a high-level security policy that was
delivered by an I2NSF User to a Security Controller through the
Consumer-Facing Interface .
Policy Data Converter converts the values of the high-level policy's
attributes into the values of the corresponding low-level policy's
attributes to generate the low-level security policy
.
Policy Generator generates the corresponding low-level security policy
that is delivered by the Security Controller to an appropriate NSF through
NSF-Facing Interface .
The I2NSF framework is weak to both an insider attack and a supply chain attack
since it trusts in NSFs provided by Developer's Management System (DMS) and
assumes that NSFs work for their security services appropriately.
.
To detect the malicious activity of either an insider attack by a malicious
DMS or a supply chain attack by a compromised DMS, a security audit
system is required by the I2NSF framework. This security audit system can
facilitate the non-repudiation of configuration commands and monitoring data
generated in the I2NSF framework.
A security audit system has the following four main objectives:
To check the existence of a security policy, a management system, and
its procedures; To identify and understand the existing vulnerabilities and risks of
either an insider attack or a supply chain attack; To review existing security controls on operational and administrative
issues; To provide recommendations and corrective actions to Security Controller
for further security improvement.
shows activity auditing with a security audit system in the I2NSF
framework. All the components in the I2NSF framwork report its
activities (such as configuration commands and monitoring data)
to Security Audit System as transactions through Remote Attestation
Interface .
The security audit system can analyze the reported activities from the
I2NSF components to detect malicious activities such as an insider attack
and a supply chain attack.
Note that such a security audit system can be implemented by remote
attestation
or Blockchain . The details of the implementation
of the system audit system are out of the scope of this document.
In order to determine a minimum set of controls required to reduce the
risks from either an insider attack or a supply chain attack, the security
audit system should analyze the activities of all the components in the
I2NSF framework periodically, evaluate possible risks, and take an action
to such risks since vulnerabilities and threats may change in
different environments over time.
This document does not require any IANA actions.
The same security considerations for the I2NSF framework
are applicable to this document.
The development and introduction of I2NSF Analyzer and Security Audit
System in the I2NSF Framework may create new security concerns that
have to be anticipated at the design and specification time. The usage
of machine learning to analyze monitoring data of malicious NSFs may add a
risk to its model to be attacked (e.g., adversarial attack) and can result
in a bad security policy that is deployed into the I2NSF system.
Network Functions Virtualisation (NFV); Architectural FrameworkBitcoin: A Peer-to-Peer Electronic Cash SystemDeep Learning
This work was supported in part by Institute of Information &
Communications Technology Planning & Evaluation (IITP) grant
funded by the Korea Ministry of Science and ICT (MSIT) (2020-0-00395-003,
Standard Development of Blockchain based Network Management Automation
Technology).
This work was supported by the IITP grant funded by the Korea MSIT
(R-20160222-002755, Cloud based Security Intelligence Technology
Development for the Customized Security Service Provisioning).
This document is made by the group effort of I2NSF working group.
Many people actively contributed to this document, such as Linda Dunbar,
Yoav Nir, and Qin Wu.
The authors sincerely appreciate their contributions.
The following are co-authors of this document:
Jeonghyeon Kim -
Department of Electrical and Computer Engineering,
Sungkyunkwan University,
2066 Seobu-ro Jangan-gu,
Suwon, Gyeonggi-do 16419,
Republic of Korea.
EMail: jeonghyeon12@skku.edu
Yunchul Choi -
Electronics and Telecommunications Research Institute,
218 Gajeong-Ro, Yuseong-Gu,
Daejeon, 34129,
Republic of Korea.
EMail: cyc79@etri.re.kr
Younghan Kim -
School of Electronic Engineering,
Soongsil University,
369, Sangdo-ro, Dongjak-gu,
Seoul 06978,
Republic of Korea.
EMail: younghak@ssu.ac.kr
The following changes are made from draft-jeong-i2nsf-security-management-automation-03:
This version replaces "Application Interface" with "Analytics
Interface" to deliver analytics information from I2NSF Analyzer to
Security Controller.
This version enhances the description of Security Policy Transation and
Security Audit System.