Internet-Draft I2NSF Framework for Security Management August 2024
Jeong, et al. Expires 7 February 2025 [Page]
Workgroup:
Operations and Management Area Working Group
Internet-Draft:
draft-jeong-opsawg-security-management-automation-00
Published:
Intended Status:
Informational
Expires:
Authors:
J. Jeong, Ed.
Sungkyunkwan University
P. Lingga
Sungkyunkwan University
J. Park
ETRI
D. Lopez
Telefonica I+D
S. Hares
Huawei

An I2NSF Framework for Security Management Automation in Cloud-Based Security Systems

Abstract

This document describes a Framework for Interface to Network Security Functions (I2NSF) in [RFC8329] for Security Management Automation (SMA) in Cloud-Based Security Systems. This security management automation facilitates Closed-Loop Security Control, Security Policy Translation, and Security Audit. To support these three features in SMA, this document specifies an extended architecture of the I2NSF framework with new system components and new interfaces. Thus, the SMA in this document can facilitate Intent-Based Security Management with Intent-Based Networking (IBN) in [RFC9315].

Status of This Memo

This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.

Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.

Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."

This Internet-Draft will expire on 7 February 2025.

Table of Contents

1. Introduction

Interface to Network Security Functions (I2NSF) defines a framework and interfaces for interacting with Network Security Functions (NSFs) [RFC8192][RFC8329]. Note that an NSF is defined as software that provides a set of security-related services, such as (i) detecting unwanted activity, (ii) blocking or mitigating the effect of such unwanted activity in order to fulfill service requirements, and (iii) supporting communication stream integrity and confidentiality [RFC8329]. The NSF can be implemented as a Virtual Network Function (VNF) in a Network Functions Virtualization (NFV) environment [ETSI-NFV][I-D.ietf-i2nsf-applicability].

This document describes Security Management Automation (SMA) of cloud-based security services in the I2NSF framework. The security management automation includes closed-loop security control, security policy translation, and security audit. This document specifies an augmented architecture of the I2NSF framework for the SMA services with new system components and new interfaces.

For reliable management for networked security services, this document proposes a network management and verification facility using a secuirty audit system (e.g., remote attestation and blockchain [Bitcoin]). This security audit system can facilitate the non-repudiation of configuration commands and monitoring data generated in the I2NSF framework.

Therefore, the Security Management Automation (SMA) in this document can facilitate Intent-Based Security Management with Intent-Based Networking (IBN) in [RFC9315] for autonomous security services.

Note that the scope of this document is to propose an extension of the standard I2NSF framework in [RFC8329] such that it can perform security management automation based on Intent-Based Networking (IBN) in [RFC9315]. This document augments the existing I2NSF framework by adding the new features of security policy translation, closed-loop security control, and security audit system to it. For this system augmentation, a system component called I2NSF Analyzer and a new external interface called Analytics Interface are introduced for Closed-Loop Security Control on the basis of the analysis of NSF monitoring data. This monitoring data is delivered from each NSF to I2NSF Analyzer via Monitoring Interface [I-D.ietf-i2nsf-nsf-monitoring-data-model]. I2NSF Analyzer performs the analysis of the NSF monitoring data, and sends the analysis results (e.g., policy reconfiguration and feedback message) to Security Controller via Analytics Interface. For more details, Refer to Section 3 in this document.

Also, note that Cloud or Edge-based Security Service Providers can get benefits by automating security service management in terms of automatic security policy enforcement and feedback-based security policy updates. Eventually, they can save Operational Expenditure (OPEX) significantly by this Intent-Based Security Management with Intent-Based Networking (IBN) in [RFC9315].

2. Terminology

This document uses the terminology described in [RFC8329], [I-D.ietf-i2nsf-applicability], and [SPT]. In addition, the following terms are defined below:

3. An I2NSF Framework for Security Management Automation

This section describes an extended I2NSF framework for security management automation, where the I2NSF framework is defined in in [RFC8329]. As shown in Figure 1, an I2NSF User can use security functions by delivering high-level security policies, which specify security requirements that the I2NSF user wants to enforce, to the Security Controller via the Consumer-Facing Interface (CFI) [I-D.ietf-i2nsf-consumer-facing-interface-dm].

   +------------+
   | I2NSF User |
   +------------+
          ^
          | Consumer-Facing Interface
          v
+-------------------+     Registration     +-----------------------+
|Security Controller|<-------------------->|Developer's Mgmt System|
+-------------------+      Interface       +-----------------------+
          ^      ^
          |      |
          |      |   Analytics Interface   +-----------------------+
          |      +------------------------>|    I2NSF Analyzer     |
          |                                +-----------------------+
          | NSF-Facing Interface              ^       ^       ^
          |                                   |       |       |
          |                                   |       |       |
          |    +------------------------------+       |       |
          |    |              +-----------------------+       |
          |    |              |   Monitoring Interface        |
          v    v              v                               v
   +----------------+ +---------------+   +-----------------------+
   |      NSF-1     |-|     NSF-2     |...|         NSF-n         |
   |   (Firewall)   | | (Web Filter)  |   |(DDoS-Attack Mitigator)|
   +----------------+ +---------------+   +-----------------------+
Figure 1: An Extended I2NSF Framework for Security Management Automation

3.1. Components with I2NSF Framework for Security Management Automation

The following are the system components for the SMA-based I2NSF framework.

  • I2NSF User: An entity that delivers a high-level security policy to Security Controller.

  • Security Controller: An entity that controls and manages other system components in the I2NSF framework. It translates a high-level security policy into the corresponding low-level security policy and selects appropriate NSFs to execute the security rules of the low-level security policy. A Security Policy Translator (SPT) can perform this security policy translation from a high-level security policy into a low-level security policy [SPT].

  • Developer's Management System (DMS): An entity that provides an image of of a virtualized NSF for a security service to the I2NSF framework, and registers the capability and access information of an NSF with Security Controller.

  • Network Security Function (NSF): An entity that is a Virtual Network Function (VNF) or Container Network Function (CNF), which is called Cloud-native Network Function, for a specific network security service such as firewall, web filter, deep packet inspection, DDoS-attack mitigation, and anti-virus.

  • I2NSF Analyzer: An entity that collects monitoring data from NSFs and analyzes such data for checking the activity and performance of the NSFs using machine learning techniques (e.g., Deep Learning [Deep-Learning]). If there is a suspicious attack activity for the target network or NSF, I2NSF Analyzer delivers a report of the augmentation or generation of security rules to Security Controller.

For SMA-based security services with Feedback-Based Security Management (FSM), I2NSF Analyzer is required as a new I2NSF component for the legacy I2NSF framework [RFC8329] to collect monitoring data from NSFs and analyzing the monitoring data. The actual implementation of the analysis of monitoring data is out of the scope of this document.

3.2. Interfaces with SMA-Based I2NSF Framework

The following are the interfaces for the SMA-based I2NSF framework. Note that the interfaces are modeled with YANG [RFC6020] and security policies are delivered through either RESTCONF [RFC8040] or NETCONF [RFC6241].

  • Consumer-Facing Interface: An interface between I2NSF User and Security Controller for the delivery of a high-level security policy [I-D.ietf-i2nsf-consumer-facing-interface-dm].

  • NSF-Facing Interface: An interface between Security Controller and an NSF for the delivery of a low-level security policy [I-D.ietf-i2nsf-nsf-facing-interface-dm].

  • Registration Interface: An interface between a DMS and Security Controller for the registration of an NSF's capability and access information with the Security Controller or the query of an NSF for a required low-level security policy [I-D.ietf-i2nsf-registration-interface-dm].

  • Monitoring Interface: An interface between an NSF and I2NSF Analyzer for collecting monitoring data from an NSF to check the activity and performance of an NSF for a possible malicious traffic [I-D.ietf-i2nsf-nsf-monitoring-data-model].

  • Analytics Interface: An interface between I2NSF Analyzer and Security Controller for the delivery of an analytics report of the augmentation or generation of security rules to Security Controller. This interface lets Security Controller get the report for security rules to its security policy management.

For SMA-based security services with FSM, Analytics Interface is required as a new I2NSF interface for the legacy I2NSF framework [RFC8329] to deliver an analytics report of the augmentation or generation of security rules to Security Controller through the analysis of the monitoring data from NSFs.

4. Security Audit System

The I2NSF framework is weak to both an insider attack and a supply chain attack since it trusts in NSFs provided by Developer's Management System (DMS) and assumes that NSFs work for their security services appropriately [I-D.ietf-i2nsf-applicability].

To detect the malicious activity of either an insider attack by a malicious DMS or a supply chain attack by a compromised DMS, a security audit system is required by the I2NSF framework. This security audit system can facilitate the non-repudiation of configuration commands and monitoring data generated in the I2NSF framework.

A security audit system has the following four main objectives:

+-----------------------------+                   +----------------+
|         I2NSF User          |                   |Developer's Mgmt|
|                             +------------+      |     System     |
+--------------+--------------+            |      +--------+-------+
               | Consumer-Facing Interface |               |
               |                           |  Remote       |
   High-level Security Policy              |  Attestation  |
               |                           |  Interface    |
               |                           |               |
               V                           |               V
+--------------+--------------+            |     +---------+--------+
|                             |            V     |     Security     |
|     Security Controller     +------------+---->|       Audit      |
|                             |            ^     |      System      |
+--------------+--------------+            |     +---------+--------+
               |  NSF-Facing Interface     |               ^
               |                           |  Remote       |
   Low-level Security Policy               |  Attestation  |
               |                           |  Interface    |
               V                           |               |
+--------------+--------------+            |      +--------+-------+
|            NSF(s)           +------------+      | I2NSF Analyzer |
|                             +------------------>|                |
+-----------------------------+    Monitoring     +----------------+
                                   Interface
Figure 2: Activity Auditing with Security Audit System

Figure 2 shows activity auditing with a security audit system in the I2NSF framework. All the components in the I2NSF framwork report its activities (such as configuration commands and monitoring data) to Security Audit System as transactions through Remote Attestation Interface [I-D.yang-i2nsf-remote-attestation-interface-dm]. The security audit system can analyze the reported activities from the I2NSF components to detect malicious activities such as an insider attack and a supply chain attack. Note that such a security audit system can be implemented by remote attestation [RFC9334][I-D.yang-i2nsf-remote-attestation-interface-dm] or Blockchain [Bitcoin]. The details of the implementation of the security audit system are out of the scope of this document.

In order to determine a minimum set of controls required to reduce the risks from either an insider attack or a supply chain attack, the security audit system should analyze the activities of all the components in the I2NSF framework periodically, evaluate possible risks, and take an action to such risks since vulnerabilities and threats may change in different environments over time.

5. IANA Considerations

This document does not require any IANA actions.

6. Security Considerations

The same security considerations for the I2NSF framework [RFC8329] are applicable to this document.

The development and introduction of I2NSF Analyzer and Security Audit System in the I2NSF Framework may create new security concerns that have to be anticipated at the design and specification time. The usage of machine learning to analyze monitoring data of malicious NSFs may add a risk to its model to be attacked (e.g., adversarial attack) and can result in a bad security policy that is deployed into the I2NSF system.

7. References

7.1. Normative References

[RFC8192]
Hares, S., Lopez, D., Zarny, M., Jacquenet, C., Kumar, R., and J. Jeong, "Interface to Network Security Functions (I2NSF): Problem Statement and Use Cases", RFC 8192, DOI 10.17487/RFC8192, , <https://www.rfc-editor.org/info/rfc8192>.
[RFC8329]
Lopez, D., Lopez, E., Dunbar, L., Strassner, J., and R. Kumar, "Framework for Interface to Network Security Functions", RFC 8329, DOI 10.17487/RFC8329, , <https://www.rfc-editor.org/info/rfc8329>.
[RFC6020]
Bjorklund, M., Ed., "YANG - A Data Modeling Language for the Network Configuration Protocol (NETCONF)", RFC 6020, DOI 10.17487/RFC6020, , <https://www.rfc-editor.org/info/rfc6020>.
[RFC8040]
Bierman, A., Bjorklund, M., and K. Watsen, "RESTCONF Protocol", RFC 8040, DOI 10.17487/RFC8040, , <https://www.rfc-editor.org/info/rfc8040>.
[RFC6241]
Enns, R., Ed., Bjorklund, M., Ed., Schoenwaelder, J., Ed., and A. Bierman, Ed., "Network Configuration Protocol (NETCONF)", RFC 6241, DOI 10.17487/RFC6241, , <https://www.rfc-editor.org/info/rfc6241>.
[I-D.ietf-i2nsf-consumer-facing-interface-dm]
Jeong, J. P., Chung, C., Ahn, T., Kumar, R., and S. Hares, "I2NSF Consumer-Facing Interface YANG Data Model", Work in Progress, Internet-Draft, draft-ietf-i2nsf-consumer-facing-interface-dm-31, , <https://datatracker.ietf.org/doc/html/draft-ietf-i2nsf-consumer-facing-interface-dm-31>.
[I-D.ietf-i2nsf-nsf-facing-interface-dm]
Kim, J. T., Jeong, J. P., Jung-Soo, J., Hares, S., and Q. Lin, "I2NSF Network Security Function-Facing Interface YANG Data Model", Work in Progress, Internet-Draft, draft-ietf-i2nsf-nsf-facing-interface-dm-29, , <https://datatracker.ietf.org/doc/html/draft-ietf-i2nsf-nsf-facing-interface-dm-29>.
[I-D.ietf-i2nsf-registration-interface-dm]
Hyun, S., Jeong, J. P., Roh, T., Wi, S., and J. Jung-Soo, "I2NSF Registration Interface YANG Data Model for NSF Capability Registration", Work in Progress, Internet-Draft, draft-ietf-i2nsf-registration-interface-dm-26, , <https://datatracker.ietf.org/doc/html/draft-ietf-i2nsf-registration-interface-dm-26>.
[I-D.ietf-i2nsf-nsf-monitoring-data-model]
Jeong, J. P., Lingga, P., Hares, S., Xia, L., and H. Birkholz, "I2NSF NSF Monitoring Interface YANG Data Model", Work in Progress, Internet-Draft, draft-ietf-i2nsf-nsf-monitoring-data-model-20, , <https://datatracker.ietf.org/doc/html/draft-ietf-i2nsf-nsf-monitoring-data-model-20>.

7.2. Informative References

[RFC9315]
Clemm, A., Ciavaglia, L., Granville, L. Z., and J. Tantsura, "Intent-Based Networking - Concepts and Definitions", RFC 9315, DOI 10.17487/RFC9315, , <https://www.rfc-editor.org/info/rfc9315>.
[RFC9334]
Birkholz, H., Thaler, D., Richardson, M., Smith, N., and W. Pan, "Remote ATtestation procedureS (RATS) Architecture", RFC 9334, DOI 10.17487/RFC9334, , <https://www.rfc-editor.org/info/rfc9334>.
[I-D.ietf-i2nsf-applicability]
Jeong, J. P., Hyun, S., Ahn, T., Hares, S., and D. Lopez, "Applicability of Interfaces to Network Security Functions to Network-Based Security Services", Work in Progress, Internet-Draft, draft-ietf-i2nsf-applicability-18, , <https://datatracker.ietf.org/doc/html/draft-ietf-i2nsf-applicability-18>.
[I-D.yang-i2nsf-remote-attestation-interface-dm]
Yang, P., chenmeiling, Su, L., Lopez, D., Jeong, J. P., and L. Dunbar, "I2NSF Remote Attestation Interface YANG Data Model", Work in Progress, Internet-Draft, draft-yang-i2nsf-remote-attestation-interface-dm-01, , <https://datatracker.ietf.org/doc/html/draft-yang-i2nsf-remote-attestation-interface-dm-01>.
[SPT]
Lingga, P., Jeong, J., Yang, J., and J. Kim, "Deep Learning", IEEE Transactions on Dependable Secure Computing, DOI 10.1109/TDSC.2024.3371788, , <https://doi.org/10.1109/TDSC.2024.3371788>.
[ETSI-NFV]
"Network Functions Virtualisation (NFV); Architectural Framework", Available: https://www.etsi.org/deliver/etsi_gs/nfv/001_099/002/01.02.01_60/gs_nfv002v010201p.pdf, .
[Bitcoin]
Nakamoto, S., "Bitcoin: A Peer-to-Peer Electronic Cash System", Available: https://bitcoin.org/bitcoin.pdf, .
[Deep-Learning]
Goodfellow, I., Bengio, Y., and A. Courville, "Deep Learning", The MIT Press, Available: https://www.deeplearningbook.org/, .

Acknowledgments

This document benefited from discussions in the I2NSF Working Group, especially from Linda Dunbar and Yoav Nir. This document took advantage of the review and comments from the following experts: Qin Wu and Adrian Farrel. The authors sincerely appreciate their sincere efforts and kind help.

This work was supported by Institute of Information & Communications Technology Planning & Evaluation (IITP) grant funded by the Korea Ministry of Science and ICT (MSIT)(RS-2024-00398199).

This work was supported in part by Institute of Information & Communications Technology Planning & Evaluation (IITP) grant funded by the Korea Ministry of Science and ICT (MSIT)(No. 2022-0-01015, Development of Candidate Element Technology for Intelligent 6G Mobile Core Network).

Contributors

The following are coauthors of this document:

Yunchul Choi
Standards & Open Source Research Division
Electronics and Telecommunications Research Institute
218 Gajeong-ro, Yuseong-gu,
Daejeon
34129
Republic of Korea
Younghan Kim
School of Electronic Engineering
Soongsil University
369, Sangdo-ro, Dongjak-gu
Seoul
06978
Republic of Korea

Authors' Addresses

Jaehoon Paul Jeong (editor)
Department of Computer Science and Engineering
Sungkyunkwan University
2066 Seobu-Ro, Jangan-Gu
Suwon
Gyeonggi-Do
16419
Republic of Korea
Patrick Lingga
Department of Electrical and Computer Engineering
Sungkyunkwan University
2066 Seobu-Ro, Jangan-Gu
Suwon
Gyeonggi-Do
16419
Republic of Korea
Jung-Soo Park
Standards & Open Source Research Division
Electronics and Telecommunications Research Institute
218 Gajeong-Ro, Yuseong-Gu
Daejeon
34129
Republic of Korea
Diego R. Lopez
Telefonica I+D
Jose Manuel Lara, 9
41013 Seville
Spain
Susan Hares
Huawei
7453 Hickory Hill
Saline, MI 48176
United States of America