Deliverable D1.1
Total Page:16
File Type:pdf, Size:1020Kb
DELIVERABLE D1.1 STATE OF THE ART, PROJECT CONCEPT AND REQUIREMENTS Grant Agreement number: 786922 Project acronym: ASTRID Project title: AddreSsing ThReats for virtualIseD services Start date of the project: 01/05/2018 Duration of the project: 36 months Type of Action: Research & Innovation Action (RIA) Name: Orazio Toscano Project Coordinator: Phone: +39 010 600 2223 e-mail: [email protected] Due Date of Delivery: M10 (28/02/2019) Actual Date of Delivery: 27/02/2019 Date of Revision Delivery: 27/02/2020 Work Package: WP1 – Reference Architecture Type of the Deliverable: R Dissemination level: PU Editors: POLITO Version: 3.0 Deliverable D1.1 List of Authors POLITO POLITECNICO DI TORINO Fulvio Valenza, Fulvio Risso, Riccardo Sisto, Guido Marchetto CNIT CONSORZIO NAZIONALE INTERUNIVERSITARIO PER LE TELECOMUNICAZIONI Matteo Repetto, Alessandro Carrega DTU DANMARKS TEKNISKE UNIVERSITET Thanassis Giannetsos ETI ERICSSON TELECOMUNICAZIONI Orazio Toscano INFO INFOCOM S.R.L. Maurizio Giribaldi SURREY UNIVERSITY OF SURREY Mark Manulis AGE AGENTSCAPE AG Benjamin Ertl GIOUMPITEK MELETI SCHEDIASMOS YLOPOIISI KAI POLISI ERGON UBITECH PLIROFORIKIS ETAIREIA PERIORISMENIS EFTHYNIS Anastasios Zafeiropoulos, Eleni Fotopoulou, Thanos Xirofotos TUB TECHNISCHE UNIVERSITAET BERLIN Tran Quang Thanh, Stefan Covaci Page 2 of 203 Deliverable D1.1 Disclaimer The information, documentation and figures available in this deliverable are written by the ASTRID Consortium partners under EC co-financing (Call: H2020-DS-SC7-2017, Project ID: 786922) and do not necessarily reflect the view of the European Commission. The information in this document is provided “as is”, and no guarantee or warranty is given that the information is fit for any particular purpose. The reader uses the information at his/her sole risk and liability. Copyright Copyright © 2019 the ASTRID Consortium. All rights reserved. The ASTRID Consortium consists of: ERICSSON TELECOMUNICAZIONI (ETI) UNIVERSITY OF SURREY (SURREY) CONSORZIO NAZIONALE INTERUNIVERSITARIO PER LE TELECOMUNICAZIONI (CNIT) INFOCOM S.R.L. (INFO) POLITECNICO DI TORINO (POLITO) TECHNISCHE UNIVERSITAET BERLIN (TUB) TECHNICAL UNIVERSITY OF DENMARCK (TUD) AGENTSCAPE AG (AGE) GIOUMPITEK MELETI SCHEDIASMOS YLOPOIISI KAI POLISI ERGON PLIROFORIKIS ETAIREIA PERIORISMENIS EFTHYNIS (UBITECH) DANMARKS TEKNISKE UNIVERSITET (DTU) This document may not be copied, reproduced or modified in whole or in part for any purpose without written permission from the ASTRID Consortium. In addition to such written permission to copy, reproduce or modify this document in whole or part, an acknowledgement of the authors of the document and all applicable portions of the copyright notice must be clearly referenced. Page 3 of 203 Deliverable D1.1 Table of Contents DISCLAIMER .................................................................................................................................................................. 3 COPYRIGHT ................................................................................................................................................................... 3 TABLE OF CONTENTS ................................................................................................................................................ 4 1 EXECUTIVE SUMMARY....................................................................................................................... 7 2 INTRODUCTION ................................................................................................................................... 8 3 PROJECT CONCEPTS AND CURRENT TRENDS IN CYBER-SECURITY .................................. 8 3.1 THE VIRTUALIZATION WAVE: CLOUD, EDGE, AND FOG ............................................................................................. 9 3.2 THREATS FROM CYBER-PHYSICAL SYSTEMS ........................................................................................................... 10 3.3 INCREASING THREATS AGAINST SYSTEMS BASED ON IOT, CLOUD, EDGE AND FOG .......................................... 11 3.3.1 Statistics about cyber-attacks in Virtualized Platforms .......................................................................... 12 3.4 CHALLENGES AND EMERGING TRENDS .................................................................................................................... 16 3.5 TOWARDS INTEGRATED AND PERVASIVE SITUATIONAL AWARENESS ................................................................ 20 3.5.1 Context and enforcement ....................................................................................................................................... 22 3.5.2 Detection and policies .............................................................................................................................................. 23 3.5.3 Awareness and reaction .......................................................................................................................................... 23 3.5.4 Forensics and legal validity ................................................................................................................................... 24 3.6 THE ASTRID CONCEPT ............................................................................................................................................. 25 3.6.1 What is ASTRID? ......................................................................................................................................................... 25 3.6.2 Technical approach ................................................................................................................................................... 27 3.7 APPLICATION SCENARIOS .......................................................................................................................................... 30 3.7.1 Situational awareness.............................................................................................................................................. 31 3.7.2 Distributed firewalling ............................................................................................................................................ 34 3.7.3 Network monitoring ................................................................................................................................................. 36 3.7.4 Trusted and safe execution .................................................................................................................................... 38 3.7.5 Response to Attacks and Enabling Forensic Investigation ..................................................................... 41 3.7.6 Lawful interception ................................................................................................................................................... 43 3.7.7 Protection of data confidentiality and personal data ............................................................................... 45 4 RELEVANT TECHNOLOGIES AND APPROACHES ..................................................................... 46 4.1 ORCHESTRATION MODELS AND STRATEGIES .......................................................................................................... 47 4.1.1 Cloud Orchestrators .................................................................................................................................................. 47 4.1.2 NFV Orchestrator ....................................................................................................................................................... 48 4.1.3 Northbound APIs ........................................................................................................................................................ 51 4.1.4 Virtual Network Functions Profiling Mechanisms...................................................................................... 51 4.2 AUTOMATIC CONFIGURATION OF NETWORK SECURITY FUNCTIONS ................................................................. 52 4.2.1 Policy Based Configuration ................................................................................................................................... 52 4.2.2 Modelling of Network Security Functions....................................................................................................... 54 4.2.3 Issues in Automatic Network Security Configuration ............................................................................... 55 4.3 PROGRAMMABLE DATA PLANES FOR PACKET PROCESSING .................................................................................. 57 4.3.1 Technologies for building fast data planes .................................................................................................... 58 4.3.2 Programming abstractions ................................................................................................................................... 62 4.4 DATA COLLECTION, FUSION, ABSTRACTION ............................................................................................................ 63 4.4.1 Log Collectors ............................................................................................................................................................... 63 4.4.2 Log Storage ................................................................................................................................................................... 64 4.4.3 Graph Databases .......................................................................................................................................................