SECURED SECurity at the network EDge

Transcription

1 SECURED SECurity at the network EDge Antonio Lioy Politecnico di Torino < polito.it > TENACE meeting Sestriere (Italy) January 22 nd, 2015

2 The SECURED FP7 project FP7 call 10 Collaborative Project (FP7-ICT ) grant agreement no duration: 3 years (1/10/ /9/2016) EC contribution: 2.7 M Euro web: fp7.eu mail: coordinator@secured fp7.eu 2

3 The Consortium (I) Politecnico di Torino Italy coordinator = Prof. Antonio Lioy ( antonio.lioy@polito.it ) networking, trusted computing, security policies HP Laboratory Bristol United Kingdom networking, trusted computing Primetel PLC Cyprus telco, network and content provider (regional) Telefonica Investigacion y Desarrollo Spain telco and network provider (worldwide) 3

4 The Consortium (II) United Nations Interregional Crime and Justice Research Institute Italy social and policy aspects of security Universitat Politecnica de Catalunya Spain networking, mobility (Barcelona Supercomputing Center Spain) computational architectures VTT Technical Research Centre of Finland cybersecurity 4

5 Main idea users have many "terminals" laptop, desktop, tablet, smartphone, Internet-connected TV, car infosystem, with very different security level (because it's difficult to develop security controls for so many platforms with so different characteristics) and different network connection (hence we can't consistently rely on network border protection) IDEA: offload security controls from the user terminals to a (trusted and secure) network node 5

6 From heterogeneous to uniform security security applications independent from user terminals security protection independent from user location 6

7 Use cases home home gateway, protection of family (and visitors') devices enterprise wired/wireless access, protection of hosts (including servers?) public hotspot WiFi access, protection of visitors mobile 3G/4G access, protection of subscriber's device IoT wireless access point, protection of IoT node NOTE: first hop not "SECURED"? then create a secure connection to a SECURED-node somewhere in the network 7

8 Main components NED (Network Edge Device) trusted node (with TC techniques) VMM for multi-tenancy (one VM per user) e.g. home gateway, corporate router, wireless AP, GGSN security applications specific tasks (packet filter, parental control, anti-phishing, content inspection, ) executed at the NED security policies simplify configuration of applications share "best practice" policies flexibility (users care about policy, not implementation) 8

9 SECURED architecture authn application repository 2. authenticate 1. trust 3. get apps 4. get policies policy repository user terminal NED 5. protect! personal execution environment 9

10 Trust and security NED (Network Edge Device user terminal policy app(s) TPM secure & trusted channel measures verifier 10

11 Monolithic vs split NED end-user device end-user device network SEC edge device (SECURED) network edge device (SECURED) OF SEC computing device (SECURED) network network 11

12 Hierarchical security policies the same connection may be subject to constraints from different tenants (depending on the network environment) policies are applied in a hierarchical way user is informed of the overall policy applied to her connection (and may refuse connecting to the network) government government ISP parent user (child) ISP corporation department user (employee) 12

13 Security policy: levels high-level block access to malware distribution hosts medium-level use service MalwareLookup to verify if a host is a known malware distribution point low-level if ( lookup( host, dns.malware.org) == 1) then deny; else permit 13

14 Cooperative and uncooperative policies cooperative policies disclose their content (to the end-user) and hence permit policy reconciliation display of the final policy implementation on a single PSA uncooperative policies do not disclose their content to anybody (but the policy owner) policy reconciliation impossible policy display impossible require a dedicated PSA (chained to the others of the user) 14

15 Components and issues in SECURED components PSC = Personal Security Controller PSA = Personal Security Application TVD = Trusted Virtual Domain (PSC + PSA 1 PSA N ) the "split" model implies personalized network path (SDN?) access to network-hosted computational capabilities (NFV?) these points have issues with security trust "personal" 15

16 Cloud / SDN / NFV for Secured 1. attestation 2. config( α ) cloud controller NED PSC PSA 1 PSA 2 PSA 3 α / 1 α / 2 α / 3 ext Mr. α 16

17 THANK YOU!

18 Disclaimer and confidentiality note EU disclaimer SECURED (project no ) is co-funded by the European Union (EU) via the European Commission (EC), under the Information and Communication Technologies (ICT) theme of the 7th Framework Programme for R&D (FP7). This document does not represent the opinion of the EC and the EC is not responsible for any use that might be made of its content. SECURED disclaimer The information in this document is provided "as is", and no guarantee or warranty is given that the information is fit for any particular purpose. The user thereof uses the information at its sole risk and liability Confidentiality The information in this document is confidential and restricted only to the members of the SECURED consortium (including the Commission Services). 18