Security Management Automation of Cloud-Based Security Services in I2NSF Framework

Status of This Memo

This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.¶

Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.¶

Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."¶

This Internet-Draft will expire on 10 August 2024.¶

Copyright Notice

Copyright (c) 2024 IETF Trust and the persons identified as the document authors. All rights reserved.¶

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License.¶

Table of Contents

1. Introduction

Interface to Network Security Functions (I2NSF) defines a framework and interfaces for interacting with Network Security Functions (NSFs) [RFC8192][RFC8329]. Note that an NSF is defined as software that provides a set of security-related services, such as (i) detecting unwanted activity, (ii) blocking or mitigating the effect of such unwanted activity in order to fulfill service requirements, and (iii) supporting communication stream integrity and confidentiality [RFC8329]. The NSF can be implemented as a Virtual Network Function (VNF) in a Network Functions Virtualization (NFV) environment [ETSI-NFV][I-D.ietf-i2nsf-applicability].¶

This document describes Security Management Automation (SMA) of cloud-based security services in the I2NSF framework. The security management automation includes closed-loop security control, security policy translation, and security audit. This document specifies an augmented architecture of the I2NSF framework for the SMA services with new system components and new interfaces.¶

For reliable management for networked security services, this document proposes a network management and verification facility using a secuirty audit system (e.g., remote attestation and blockchain [Bitcoin]). This security audit system can facilitate the non-repudiation of configuration commands and monitoring data generated in the I2NSF framework.¶

Therefore, with the security service automation, this document facilitates the foundation of Intent-Based Networking (IBN) for autonomous security services [RFC9315].¶

2. Terminology

This document uses the terminology described in [RFC8329] and [I-D.ietf-i2nsf-applicability]. In addition, the following terms are defined below:¶

• Security Management Automation (SMA): It means that a high-level security policy from a user (or administrator) is well-enforced in a target I2NSF system. The high-level security policy can be translated into the corresponding low-level security policy by a security policy translator and dispatched to appropriate NSFs. Through the monitoring of the NSFs, the activity and performace of the NSFs is monitored and analyzed. If needed, the security rules of the low-level security policy are augmented or new security rules are generated and configured to appropriate NSFs.¶

• Security Policy Translation (SPT): It means that a high-level security policy is translated to a low-level security policy that can be understood and configured by an NSF for a specific security service, such as firewall, web filter, deep packet inspection, DDoS-attack mitigation, and anti-virus.¶

• Feedback-Based Security Management (FSM): It means that a security service is evolved by updating a security policy (having security rules) and adding new security rules for detected security attacks by processing and analzing the monitoring data of NSFs.¶

   +------------+
   | I2NSF User |
   +------------+
          ^
          | Consumer-Facing Interface
          v
+-------------------+     Registration     +-----------------------+
|Security Controller|<-------------------->|Developer's Mgmt System|
+-------------------+      Interface       +-----------------------+
          ^      ^
          |      |
          |      |   Analytics Interface   +-----------------------+
          |      +------------------------>|    I2NSF Analyzer     |
          |                                +-----------------------+
          | NSF-Facing Interface              ^       ^       ^
          |                                   |       |       |
          |                                   |       |       |
          |    +------------------------------+       |       |
          |    |              +-----------------------+       |
          |    |              |   Monitoring Interface        |
          v    v              v                               v
   +----------------+ +---------------+   +-----------------------+
   |      NSF-1     |-|     NSF-2     |...|         NSF-n         |
   |   (Firewall)   | | (Web Filter)  |   |(DDoS-Attack Mitigator)|
   +----------------+ +---------------+   +-----------------------+

3. Security Management Automation in I2NSF Framework

This section summarizes the I2NSF framework as defined in [RFC8329]. As shown in Figure 1, an I2NSF User can use security functions by delivering high-level security policies, which specify security requirements that the I2NSF user wants to enforce, to the Security Controller via the Consumer-Facing Interface (CFI) [I-D.ietf-i2nsf-consumer-facing-interface-dm].¶

4. Security Policy Translation

To facilitate Security Policy Translation (SPT), Security Controller needs to have a security policy translator that performs the translation of a high-level security policy into the corresponding low-level security policy. For the automatic SPT services, the I2NSF framework needs to bridge a high-level YANG data model and a low-level YANG data model in an automatic manner [I-D.ietf-i2nsf-applicability][I-D.yang-i2nsf-security-policy-translation]. Note that a high-level YANG data model is for the I2NSF Consumer-Facing Interface [I-D.ietf-i2nsf-consumer-facing-interface-dm], and a low-level YANG data model is for the I2NSF NSF-Facing Interface [I-D.ietf-i2nsf-nsf-facing-interface-dm].¶

Figure 2 shows automatic mapping of high-level and low-level data models. Automatic Data Model Mapper takes a high-level YANG data module for the Consumer-Facing Inteface and a low-level YANG data module for the NSF-Facing Interface. It then constructs a mapping table associating the data attributes (or variables) of the high-level YANG data module with the corresponding data attributes (or variables) of the low-level YANG data module. Also, it generates a set of production rules of the grammar for the construction of an XML file of low-level security policy rules.¶

Figure 3 shows high-to-low security policy translation. A security policy translator is a component of Security Controller. The translator consists of three components such as Data Model Mapper, Data Extractor, Data Converter, and Policy Generator.¶

 High-level YANG Data Module   Low-level YANG Data Module
             |                              |
             V                              V
   +---------+------------------------------+---------+
   |             Policy Data Model Mapper             |
   +------------------------+-------------------------+
                            |
                            V
                 Data Model Mapping Table

   +--------------------------------------------------+
   |                    I2NSF User                    |
   +------------------------+-------------------------+
                            | Consumer-Facing Interface
                            |
                High-level Security Policy
                            |
   Security Controller      V
   +------------------------+--------------------------------+
   |  Security Policy       |                                |
   |  Translator            V                                |
   |  +---------------------+-----------------------------+  |
   |  |                     |                             |  |
   |  |                     V                             |  |
   |  |               +-----+-----+          +----------+ |  |
   |  |               |    Data   |          |Data Model| |  |
   |  |               | Extractor |          |  Mapper  | |  |
   |  |               +-----+-----+          +----------+ |  |
   |  | Extracted Data from |              Mapping |      |  |
   |  |   High-Level Policy V                Model V      |  |
   |  |               +-----+-----+           +----+---+  |  |
   |  |               |    Data   |<--------->| NSF DB |  |  |
   |  |               | Converter |           +--------+  |  |
   |  |               +-----+-----+                       |  |
   |  |                     |  Required Data for          |  |
   |  |                     V  Target NSFs                |  |
   |  |            +--------+---------+                   |  |
   |  |            | Policy Generator |                   |  |
   |  |            +--------+---------+                   |  |
   |  |                     |                             |  |
   |  |                     V                             |  |
   |  +---------------------+-----------------------------+  |
   |                        |                                |
   |                        V                                |
   +------------------------+--------------------------------+
                            | NSF-Facing Interface
                            |
                 Low-level Security Policy
                            |
                            V
   +------------------------+-------------------------+
   |                      NSF(s)                      |
   +--------------------------------------------------+

Data Model Mapper maps the attributes and their values of a high-level security policy to the corresponding attributes and their values of a low-level security policy. Note that the values of a high-level security policy may involve a human language and must be converted to an appropriate value for a low-level security policy (e.g., employees -> 192.0.1.0/24).¶

Data Extractor extracts the values of the attributes related to a security policy from a high-level security policy that was delivered by an I2NSF User to a Security Controller through the Consumer-Facing Interface [I-D.ietf-i2nsf-consumer-facing-interface-dm].¶

Data Converter converts the values of the high-level policy's attributes into the values of the corresponding low-level policy's attributes to generate the low-level security policy [I-D.ietf-i2nsf-nsf-facing-interface-dm].¶

Policy Generator generates the corresponding low-level security policy that is delivered by the Security Controller to an appropriate NSF through NSF-Facing Interface [I-D.ietf-i2nsf-nsf-facing-interface-dm].¶

5. Security Audit System

The I2NSF framework is weak to both an insider attack and a supply chain attack since it trusts in NSFs provided by Developer's Management System (DMS) and assumes that NSFs work for their security services appropriately [I-D.ietf-i2nsf-applicability].¶

To detect the malicious activity of either an insider attack by a malicious DMS or a supply chain attack by a compromised DMS, a security audit system is required by the I2NSF framework. This security audit system can facilitate the non-repudiation of configuration commands and monitoring data generated in the I2NSF framework.¶

A security audit system has the following four main objectives:¶

• To check the existence of a security policy, a management system, and its procedures;¶

• To identify and understand the existing vulnerabilities and risks of either an insider attack or a supply chain attack;¶

• To review existing security controls on operational and administrative issues;¶

• To provide recommendations and corrective actions to Security Controller for further security improvement.¶

+-----------------------------+                   +----------------+
|         I2NSF User          |                   |Developer's Mgmt|
|                             +------------+      |     System     |
+--------------+--------------+            |      +--------+-------+
               | Consumer-Facing Interface |               |
               |                           |  Remote       |
   High-level Security Policy              |  Attestation  |
               |                           |  Interface    |
               |                           |               |
               V                           |               V
+--------------+--------------+            |     +---------+--------+
|                             |            V     |     Security     |
|     Security Controller     +------------+---->|       Audit      |
|                             |            ^     |      System      |
+--------------+--------------+            |     +---------+--------+
               |  NSF-Facing Interface     |               ^
               |                           |  Remote       |
   Low-level Security Policy               |  Attestation  |
               |                           |  Interface    |
               V                           |               |
+--------------+--------------+            |      +--------+-------+
|            NSF(s)           +------------+      | I2NSF Analyzer |
|                             +------------------>|                |
+-----------------------------+    Monitoring     +----------------+
                                   Interface

Figure 4 shows activity auditing with a security audit system in the I2NSF framework. All the components in the I2NSF framwork report its activities (such as configuration commands and monitoring data) to Security Audit System as transactions through Remote Attestation Interface [I-D.yang-i2nsf-remote-attestation-interface-dm]. The security audit system can analyze the reported activities from the I2NSF components to detect malicious activities such as an insider attack and a supply chain attack. Note that such a security audit system can be implemented by remote attestation [RFC9334][I-D.yang-i2nsf-remote-attestation-interface-dm] or Blockchain [Bitcoin]. The details of the implementation of the security audit system are out of the scope of this document.¶

In order to determine a minimum set of controls required to reduce the risks from either an insider attack or a supply chain attack, the security audit system should analyze the activities of all the components in the I2NSF framework periodically, evaluate possible risks, and take an action to such risks since vulnerabilities and threats may change in different environments over time.¶

6. IANA Considerations

This document does not require any IANA actions.¶

7. Security Considerations

The same security considerations for the I2NSF framework [RFC8329] are applicable to this document.¶

The development and introduction of I2NSF Analyzer and Security Audit System in the I2NSF Framework may create new security concerns that have to be anticipated at the design and specification time. The usage of machine learning to analyze monitoring data of malicious NSFs may add a risk to its model to be attacked (e.g., adversarial attack) and can result in a bad security policy that is deployed into the I2NSF system.¶

Appendix A. Acknowledgments

This document benefited from discussions in the I2NSF Working Group, especially from Linda Dunbar and Yoav Nir. This document took advantage of the review and comments from the following experts: Qin Wu and Adrian Farrel. The authors sincerely appreciate their sincere efforts and kind help.¶

This work was supported by Institute of Information & Communications Technology Planning & Evaluation (IITP) grant funded by the Korea Ministry of Science and ICT (MSIT)(2020-0-00395-003, Standard Development of Blockchain based Network Management Automation Technology).¶

This work was supported in part by Institute of Information & Communications Technology Planning & Evaluation (IITP) grant funded by the Korea Ministry of Science and ICT (MSIT)(No. 2022-0-01015, Development of Candidate Element Technology for Intelligent 6G Mobile Core Network).¶

Appendix B. Contributors

The following are coauthors of this document:¶

Authors' Addresses