Periodic Reporting for period 2 - ANASTACIA (Advanced Networked Agents for Security and Trust Assessment in CPS/IOT Architectures)
Periodo di rendicontazione: 2018-07-01 al 2019-12-31
The heterogeneous, distributed, and dynamically evolving nature of Cyber Physical Systems (CPS) based on Internet of Things (IoT) and virtualised cloud architectures introduces new and unexpected risks that cannot be completely solved by current state-of-the-art security solutions.
New paradigms and methods are required in order i) to build security into the ICT system at the outset, ii) to adapt to changing security conditions, iii) to reduce the need to fix flaws after deploying the system, and iv) to provide the assurance that the ICT system is secure and trustworthy at all times.
The ANASTACIA project addresses these concerns by researching, developing and demonstrating a holistic solution enabling trust and security by-design for cyber physical systems (CPS) based on IoT and cloud architectures.
To this end, ANASTACIA will develop a trustworthy-by-design security framework which will address all the phases of the ICT Systems Development Lifecycle (SDL) and will be able to take autonomous decisions through the use of new networking technologies such as Software Defined Networking (SDN) and Network Function Virtualisation (NFV) and of intelligent and dynamic security enforcement and monitoring methodologies and tools.
The ANASTACIA framework will include:
a security development paradigm based on the compliance to security best practices and the use of the security components and enablers (this will provide assisted security design, development and deployment cycles to assure security-by-design);
a suite of distributed trust and security components and enablers, that are able to dynamically orchestrate and deploy user security policies and risk-assessed resilient actions within complex and dynamic CPS and IoT architectures (online monitoring and testing techniques will allow more automated adaptation of the system to mitigate new and unexpected security vulnerabilities);
a holistic Dynamic Security and Privacy Seal, combining security and privacy standards and real time monitoring and online testing (this will provide quantitative and qualitative run-time evaluation of privacy risks and security levels, which can be easily understood and controlled by the final users).
The ultimate challenge of ANASTACIA is to provide a solution for addressing the increasing vulnerability of today's ICTs, based on smart, highly connected and dynamic CPS, by leveraging the same dynamic distributed and connected environment to enact smart security planning, enforcement and monitoring strategies.
The ANASTACIA framework will be evaluated in two relevant pilot domains: Mobile/Multi-access Edge Computing and Building Management Systems.
New paradigms and methods are required in order i) to build security into the ICT system at the outset, ii) to adapt to changing security conditions, iii) to reduce the need to fix flaws after deploying the system, and iv) to provide the assurance that the ICT system is secure and trustworthy at all times.
The ANASTACIA project addresses these concerns by researching, developing and demonstrating a holistic solution enabling trust and security by-design for cyber physical systems (CPS) based on IoT and cloud architectures.
To this end, ANASTACIA will develop a trustworthy-by-design security framework which will address all the phases of the ICT Systems Development Lifecycle (SDL) and will be able to take autonomous decisions through the use of new networking technologies such as Software Defined Networking (SDN) and Network Function Virtualisation (NFV) and of intelligent and dynamic security enforcement and monitoring methodologies and tools.
The ANASTACIA framework will include:
a security development paradigm based on the compliance to security best practices and the use of the security components and enablers (this will provide assisted security design, development and deployment cycles to assure security-by-design);
a suite of distributed trust and security components and enablers, that are able to dynamically orchestrate and deploy user security policies and risk-assessed resilient actions within complex and dynamic CPS and IoT architectures (online monitoring and testing techniques will allow more automated adaptation of the system to mitigate new and unexpected security vulnerabilities);
a holistic Dynamic Security and Privacy Seal, combining security and privacy standards and real time monitoring and online testing (this will provide quantitative and qualitative run-time evaluation of privacy risks and security levels, which can be easily understood and controlled by the final users).
The ultimate challenge of ANASTACIA is to provide a solution for addressing the increasing vulnerability of today's ICTs, based on smart, highly connected and dynamic CPS, by leveraging the same dynamic distributed and connected environment to enact smart security planning, enforcement and monitoring strategies.
The ANASTACIA framework will be evaluated in two relevant pilot domains: Mobile/Multi-access Edge Computing and Building Management Systems.
During the first reporting period of the project, ANASTACIA has defined the main architecture and components of the proposed framework that include:
• a security development paradigm (based on the compliance to security best practices and the use of the security components and enablers);
• a suite of distributed trust and security components and enablers (able to dynamically orchestrate and deploy user security policies and risk-assessed resilient actions within complex and dynamic CPS and IoT architectures);
• a holistic Dynamic Security and Privacy Seal (combining security and privacy standards and real time monitoring and online testing).
Additionally, ANASTACIA has defined testing deployment over three systems and infrastructure defined in the ANASTACIA project. The systems considered are: Building Energy Management System (BEMS), Multi-access Edge Computing (MEC) and Internet of Things (IoT).
Finally, the contributions of the involved partners brought to the execution of deep technical analysis. A proposal for a security policy model has been defined with the aim to define a series of rules to protect the CPS monitored by the ANASTACIA framework from cyber-attacks. For this objective, SDN and NFV technologies have been considered. Another topic is IoT security, context involving the Consortium relatively to new security model and privacy threats in IoT environments.
• a security development paradigm (based on the compliance to security best practices and the use of the security components and enablers);
• a suite of distributed trust and security components and enablers (able to dynamically orchestrate and deploy user security policies and risk-assessed resilient actions within complex and dynamic CPS and IoT architectures);
• a holistic Dynamic Security and Privacy Seal (combining security and privacy standards and real time monitoring and online testing).
Additionally, ANASTACIA has defined testing deployment over three systems and infrastructure defined in the ANASTACIA project. The systems considered are: Building Energy Management System (BEMS), Multi-access Edge Computing (MEC) and Internet of Things (IoT).
Finally, the contributions of the involved partners brought to the execution of deep technical analysis. A proposal for a security policy model has been defined with the aim to define a series of rules to protect the CPS monitored by the ANASTACIA framework from cyber-attacks. For this objective, SDN and NFV technologies have been considered. Another topic is IoT security, context involving the Consortium relatively to new security model and privacy threats in IoT environments.
Regarding the security policy languages, ANASTACIA selected the HSPL/MSPL to model the security policies for the ANASTACIA project. Then the main security policies to cope with the main goals of the project were identified, like access control, filtering, forwarding, channel protection and specific IoT operational policies. The security policy models were extended to be able to represent specific network and IoT capabilities. Using the new models, the security policies at different levels were defined and instantiated, to be used in the main ANASTACIA use cases.
Detail the High-level Security Policy Language (HSPL) and the Medium-level Security Policy Language (MSPL) as well as the main identified security policies and the policy refinement and translation processes through multiple diagrams and step-by-step workflows for each process has been identified. These processes oversee refining high-level to medium-level security policies and translating medium-level security policies in final security enabler configurations.
ANASTACIA framework covers: (1) a refinement process from High-level Security Language (HSPL) to Medium-level security Policy Language (MSPL), corresponding to h2mservice API; and (2), a translation from Medium-level Security Policy Language (MSPL) to lower-level configurations which will correspond to m2lservice API.
A key innovation of ANASTACIA has been in defining and implementing synergies between SDN controllers (i.e. namely the SDN-based security enforcement algorithms) and NFV MANO (i.e. the security-aware VNF placement algorithms), and that is for the purpose of coordinating security to have an effective impact. Regarding Monitoring and Reaction capabilities of the platform, several areas has been researched:
• Define the architecture of the Monitoring and Reaction Modules of the ANASTACIA platform.
• Analyse the monitoring and reaction capabilities of the technologies brought by the partners.
• Develop the corresponding adaptations of such technologies to meet the project requirements.
• Help the integration of the developed technologies, by defining the interfaced with other components of the ANASTACIA platform.
Within the privacy area, initial research efforts pursued a broad-ranging examination of regional and national legislation which could be of relevance to the DSPS. These efforts led to the identification of specific dispositions in the GDPR, eIDAS regulation, e-privacy directive and swiss regulations which should shape the DSPS’s approach to personal data protection and security certification and to the design of the seal itself. A similar process was followed in the case of technical standards: Following a sweeping examination of standards and recommendations by ISO, ITU, ENISA, NIST and other bodies related to the IoT/CPS ecosystem; several standards were identified as having the potential to support the synthetic DSPS model or to further define the DSPS architecture that should be developed and implemented.
A complete plan for the implementation of use cases has been defined, through the identifying of cases that will examine critical components and features in the ANASTACIA framework. Finally, based on this plan, the use cases have started their implementation phase, with preparation of specific testbeds, and integration of ANASTACIA components.
Detail the High-level Security Policy Language (HSPL) and the Medium-level Security Policy Language (MSPL) as well as the main identified security policies and the policy refinement and translation processes through multiple diagrams and step-by-step workflows for each process has been identified. These processes oversee refining high-level to medium-level security policies and translating medium-level security policies in final security enabler configurations.
ANASTACIA framework covers: (1) a refinement process from High-level Security Language (HSPL) to Medium-level security Policy Language (MSPL), corresponding to h2mservice API; and (2), a translation from Medium-level Security Policy Language (MSPL) to lower-level configurations which will correspond to m2lservice API.
A key innovation of ANASTACIA has been in defining and implementing synergies between SDN controllers (i.e. namely the SDN-based security enforcement algorithms) and NFV MANO (i.e. the security-aware VNF placement algorithms), and that is for the purpose of coordinating security to have an effective impact. Regarding Monitoring and Reaction capabilities of the platform, several areas has been researched:
• Define the architecture of the Monitoring and Reaction Modules of the ANASTACIA platform.
• Analyse the monitoring and reaction capabilities of the technologies brought by the partners.
• Develop the corresponding adaptations of such technologies to meet the project requirements.
• Help the integration of the developed technologies, by defining the interfaced with other components of the ANASTACIA platform.
Within the privacy area, initial research efforts pursued a broad-ranging examination of regional and national legislation which could be of relevance to the DSPS. These efforts led to the identification of specific dispositions in the GDPR, eIDAS regulation, e-privacy directive and swiss regulations which should shape the DSPS’s approach to personal data protection and security certification and to the design of the seal itself. A similar process was followed in the case of technical standards: Following a sweeping examination of standards and recommendations by ISO, ITU, ENISA, NIST and other bodies related to the IoT/CPS ecosystem; several standards were identified as having the potential to support the synthetic DSPS model or to further define the DSPS architecture that should be developed and implemented.
A complete plan for the implementation of use cases has been defined, through the identifying of cases that will examine critical components and features in the ANASTACIA framework. Finally, based on this plan, the use cases have started their implementation phase, with preparation of specific testbeds, and integration of ANASTACIA components.