Recommended
More Related Content
What's hot
What's hot (20)
Similar to Building a chain of trust from the device to the cloud in 5G
Similar to Building a chain of trust from the device to the cloud in 5G (20)
Recently uploaded
Recently uploaded (20)
Building a chain of trust from the device to the cloud in 5G
- 1. Paul Bradley – Head of 5G Strategy 13th of June 2017 Building a chain of trust from the device to the cloud
- 2. Trust is vital – and it’s what we provide… …enabling our clients to deliver a vast range of trusted digital services for billions of individuals and things. 2 5G WORLD 2017 - PUBLIC
- 3. 5G comes with new security challenges 5G WORLD 2017 - PUBLIC3 ENHANCED MOBILE BROADBAND CRITICAL COMMUNICATIONS AND V2X NETWORK OPERATIONS BUILD FROM SECURITY SOLUTIONS FROM 3G/4G NEW SEGMENT-SPECIFIC SECURITY NEEDS • Begin with principles of authentication, integrity, confidentiality and privacy from 3G/4G • Adapt for NFV and Multi-Access Edge Computing • Security Architecture should be adapted to the needs of each slice MASSIVE IoTIoT
- 4. Gemalto’s role in Network Security & Software Licensing 5G WORLD 2017 - PUBLIC4 Gemalto secures the device and enhances security of the virtualized network whilst guaranteeing licensing management OUR SOLUTIONS User authentication and trusted identities Data encryption and key management Cloud and virtualization security Software Monetization
- 5. Network Security Should Rely on Certified Elements such as Hardware Security Modules 5G WORLD 2017 - PUBLIC5 CERTIFICATIONS INTRUSION DETECTION SWITCHES ON LID TAMPER RESISTANT FAN MOUNTS TAMPER RESISTANT I/O MOUNTS SERIALIZED TAMPER EVIDENT STICKERS INTERNAL BAFFLES TO PREVENT PROBING TAMPER RESISTANT SCREWS CRYPTO HYPERVISOR HARDWARE SECURITY MODULE DYNAMIC CRYPTO RESOURCE
- 6. Key Issues in Virtualization Security 5G WORLD 2017 - PUBLIC6 NFV M&O VNF VNF 1 VNF 2 VNF 3 EMS 2 EMS 3EMS 1 OSS / BSS VNF MANAGERS SERVICE, VNF & INFRASTRUCTURE DESCRIPTION VIRTUAL COMPUTE VIRTUAL STORAGE VIRTUAL NETWORK VIRTUALISATION LAYER COMPUTING HARDWARE STORAGE HARDWARE NETWORK HARDWARE HARDWARE RESOURCES NFV1 ORCHESTRATOR VITUALISED INFRASTRUCTURE MANAGER Network slice isolation1 1 1 1 1 1
- 7. Key Issues in Virtualization Security 5G WORLD 2017 - PUBLIC6 NFV M&O VNF VNF 1 VNF 2 VNF 3 EMS 2 EMS 3EMS 1 OSS / BSS VNF MANAGERS SERVICE, VNF & INFRASTRUCTURE DESCRIPTION VIRTUAL COMPUTE VIRTUAL STORAGE VIRTUAL NETWORK VIRTUALISATION LAYER COMPUTING HARDWARE STORAGE HARDWARE NETWORK HARDWARE HARDWARE RESOURCES NFV1 ORCHESTRATOR VITUALISED INFRASTRUCTURE MANAGER Network slice isolation1 Virtualization security2 2 2 2
- 8. Key Issues in Virtualization Security 5G WORLD 2017 - PUBLIC6 NFV M&O VNF VNF 1 VNF 2 VNF 3 EMS 2 EMS 3EMS 1 OSS / BSS VNF MANAGERS SERVICE, VNF & INFRASTRUCTURE DESCRIPTION VIRTUAL COMPUTE VIRTUAL STORAGE VIRTUAL NETWORK VIRTUALISATION LAYER COMPUTING HARDWARE STORAGE HARDWARE NETWORK HARDWARE HARDWARE RESOURCES NFV1 ORCHESTRATOR VITUALISED INFRASTRUCTURE MANAGER VNF integrity verification during on boarding of VNF3 3 Network slice isolation1 Virtualization security2
- 9. Key Issues in Virtualization Security 5G WORLD 2017 - PUBLIC6 NFV M&O VNF VNF 1 VNF 2 VNF 3 EMS 2 EMS 3EMS 1 OSS / BSS VNF MANAGERS SERVICE, VNF & INFRASTRUCTURE DESCRIPTION VIRTUAL COMPUTE VIRTUAL STORAGE VIRTUAL NETWORK VIRTUALISATION LAYER COMPUTING HARDWARE STORAGE HARDWARE NETWORK HARDWARE HARDWARE RESOURCES NFV1 ORCHESTRATOR VITUALISED INFRASTRUCTURE MANAGER VNF integrity verification during on boarding of VNF3 Low Latency Interconnect with Multi-Access Edge4 4 Network slice isolation1 Virtualization security2
- 10. Key Issues in Virtualization Security 5G WORLD 2017 - PUBLIC6 NFV M&O VNF VNF 1 VNF 2 VNF 3 EMS 2 EMS 3EMS 1 OSS / BSS VNF MANAGERS SERVICE, VNF & INFRASTRUCTURE DESCRIPTION VIRTUAL COMPUTE VIRTUAL STORAGE VIRTUAL NETWORK VIRTUALISATION LAYER COMPUTING HARDWARE STORAGE HARDWARE NETWORK HARDWARE HARDWARE RESOURCES NFV1 ORCHESTRATOR VITUALISED INFRASTRUCTURE MANAGER VNF integrity verification during on boarding of VNF3 Low Latency Interconnect with Multi-Access Edge4 Secured/measured boot & security enclaves for sensitive VNFs5 5 Network slice isolation1 Virtualization security2
- 11. Key Issues in Virtualization Security 5G WORLD 2017 - PUBLIC6 NFV M&O VNF VNF 1 VNF 2 VNF 3 EMS 2 EMS 3EMS 1 OSS / BSS VNF MANAGERS SERVICE, VNF & INFRASTRUCTURE DESCRIPTION VIRTUAL COMPUTE VIRTUAL STORAGE VIRTUAL NETWORK VIRTUALISATION LAYER COMPUTING HARDWARE STORAGE HARDWARE NETWORK HARDWARE HARDWARE RESOURCES NFV1 ORCHESTRATOR VITUALISED INFRASTRUCTURE MANAGER VNF integrity verification during on boarding of VNF3 Low Latency Interconnect with Multi-Access Edge4 Secured/measured boot & security enclaves for sensitive VNFs5 Physical and logical protection of Security Assets on motherboard6 6 Network slice isolation1 Virtualization security2
- 12. Key Issues in Virtualization Security 5G WORLD 2017 - PUBLIC6 NFV M&O VNF VNF 1 VNF 2 VNF 3 EMS 2 EMS 3EMS 1 OSS / BSS VNF MANAGERS SERVICE, VNF & INFRASTRUCTURE DESCRIPTION VIRTUAL COMPUTE VIRTUAL STORAGE VIRTUAL NETWORK VIRTUALISATION LAYER COMPUTING HARDWARE STORAGE HARDWARE NETWORK HARDWARE HARDWARE RESOURCES NFV1 ORCHESTRATOR VITUALISED INFRASTRUCTURE MANAGER VNF integrity verification during on boarding of VNF3 Low Latency Interconnect with Multi-Access Edge4 Secured/measured boot & security enclaves for sensitive VNFs5 Physical and logical protection of Security Assets on motherboard6 Discovery mechanism of Security Hardware & characteristics (Openstack EPA) 7 7 Network slice isolation1 Virtualization security2
- 13. Key Issues in Virtualization Security 5G WORLD 2017 - PUBLIC6 NFV M&O VNF VNF 1 VNF 2 VNF 3 EMS 2 EMS 3EMS 1 OSS / BSS VNF MANAGERS SERVICE, VNF & INFRASTRUCTURE DESCRIPTION VIRTUAL COMPUTE VIRTUAL STORAGE VIRTUAL NETWORK VIRTUALISATION LAYER COMPUTING HARDWARE STORAGE HARDWARE NETWORK HARDWARE HARDWARE RESOURCES NFV1 ORCHESTRATOR VITUALISED INFRASTRUCTURE MANAGER VNF integrity verification during on boarding of VNF3 Low Latency Interconnect with Multi-Access Edge4 Secured/measured boot & security enclaves for sensitive VNFs5 Physical and logical protection of Security Assets on motherboard6 Discovery mechanism of Security Hardware & characteristics (Openstack EPA) 7 Run-time VNF Integrity verification8 8 Network slice isolation1 Virtualization security2
- 14. Key Issues in Virtualization Security 5G WORLD 2017 - PUBLIC6 NFV M&O VNF VNF 1 VNF 2 VNF 3 EMS 2 EMS 3EMS 1 OSS / BSS VNF MANAGERS SERVICE, VNF & INFRASTRUCTURE DESCRIPTION VIRTUAL COMPUTE VIRTUAL STORAGE VIRTUAL NETWORK VIRTUALISATION LAYER COMPUTING HARDWARE STORAGE HARDWARE NETWORK HARDWARE HARDWARE RESOURCES NFV1 ORCHESTRATOR VITUALISED INFRASTRUCTURE MANAGER VNF integrity verification during on boarding of VNF3 Low Latency Interconnect with Multi-Access Edge4 Secured/measured boot & security enclaves for sensitive VNFs5 Physical and logical protection of Security Assets on motherboard6 Discovery mechanism of Security Hardware & characteristics (Openstack EPA) 7 Run-time VNF Integrity verification8 Migration of VNF using security features9 9 Network slice isolation1 Virtualization security2
- 15. Key Issues in Virtualization Security 5G WORLD 2017 - PUBLIC6 NFV M&O VNF VNF 1 VNF 2 VNF 3 EMS 2 EMS 3EMS 1 OSS / BSS VNF MANAGERS SERVICE, VNF & INFRASTRUCTURE DESCRIPTION VIRTUAL COMPUTE VIRTUAL STORAGE VIRTUAL NETWORK VIRTUALISATION LAYER COMPUTING HARDWARE STORAGE HARDWARE NETWORK HARDWARE HARDWARE RESOURCES NFV1 ORCHESTRATOR VITUALISED INFRASTRUCTURE MANAGER VNF integrity verification during on boarding of VNF3 Low Latency Interconnect with Multi-Access Edge4 Secured/measured boot & security enclaves for sensitive VNFs5 Physical and logical protection of Security Assets on motherboard6 Discovery mechanism of Security Hardware & characteristics (Openstack EPA) 7 Run-time VNF Integrity verification8 Migration of VNF using security features9 Network slice isolation1 Virtualization security2
- 16. l MOBILE CORESERVICE PROVIDER Mobile security chain: key architectural elements 5G WORLD 2017 - PUBLIC7 Network providing seamless IP connectivity suited to my reliability, availability, mobility and security needs Conforms to SLA Applications are running and data analysis take place at core and the edge VNF1, VNF2… MOBILE EDGE MOBILE EDGE SERVICE PROVIDER MOBILE EDGE VNFa, VNFb… 5G SERVICE PROVIDER Network slice isolation1
- 17. l MOBILE CORESERVICE PROVIDER Mobile security chain: key architectural elements 5G WORLD 2017 - PUBLIC7 Network providing seamless IP connectivity suited to my reliability, availability, mobility and security needs Conforms to SLA Applications are running and data analysis take place at core and the edge VNF1, VNF2… MOBILE EDGE MOBILE EDGE SERVICE PROVIDER MOBILE EDGE VNFa, VNFb… Slice 15G SERVICE PROVIDER Network slice isolation1
- 18. l MOBILE CORESERVICE PROVIDER Mobile security chain: key architectural elements 5G WORLD 2017 - PUBLIC7 Network providing seamless IP connectivity suited to my reliability, availability, mobility and security needs Conforms to SLA Applications are running and data analysis take place at core and the edge VNF1, VNF2… MOBILE EDGE MOBILE EDGE SERVICE PROVIDER MOBILE EDGE VNFa, VNFb… Slice 1 Slice 2 5G SERVICE PROVIDER Network slice isolation1
- 19. Strong Trust Establishment between Virtual Functions 5G WORLD 2017 - PUBLIC8 NFV MANAGEMENT & ORCHESTRATOR (MANO) HARDWARE SECURITY MODULE MULTI-ACCESS EDGES HARDWARE SECURITY MODULE CORE Trigger Mutual Authentication between the MANO and resources Trigger Mutual Authentication between all virtualised elements on the same slice which interact Verify integrity of each function vs what was installed by the MANO vs image stored in VNF Manager 1 2 3 Virtualization security, VNF integrity verification during on boarding of VNF32
- 20. Strong Trust Establishment between Virtual Functions 5G WORLD 2017 - PUBLIC9 NFV MANAGEMENT & ORCHESTRATOR (MANO) HARDWARE SECURITY MODULE MULTI-ACCESS EDGES HARDWARE SECURITY MODULE CORE Implement integrity and confidentiality protection so that instructions and data cannot be compromised/modified 4 Virtualization security, VNF integrity verification during on boarding of VNF32
- 21. Is the connection from the Core to the Multi-Access Edge Secure? 5G WORLD 2017 - PUBLIC10 https://youtu.be/cdoCeKOLij4 Low Latency Interconnect with Multi-Access Edge4
- 22. With 5G slicing… isolate the communications between functions 5G WORLD 2017 - PUBLIC11 Provide confidentiality and integrity protection for all data and virtual functions Provide confidentiality and integrity protection for all data and virtual functions HIGH SPEED ENCRYPTION MOBILE EDGES CORE HSE HSE Low Latency Interconnect with Multi-Access Edge4
- 23. Protection of Applications & VNFs 5G WORLD 2017 - PUBLIC12 NFV INFRASTRUCTURE A Hypervisor provides some level of isolation HARDWARE RESOURCES (CPU, STORAGE, NETWORK) HYPERVISOR Secured/measured boot & security enclaves for sensitive VNFs5
- 24. Protection of Applications & VNFs 5G WORLD 2017 - PUBLIC12 NFV INFRASTRUCTURE A Hypervisor provides some level of isolation HARDWARE RESOURCES (CPU, STORAGE, NETWORK) HYPERVISOR NFV INFRASTRUCTURE Malicious code could be implemented to hack through the walls HARDWARE RESOURCES (CPU, STORAGE, NETWORK) HYPERVISOR Secured/measured boot & security enclaves for sensitive VNFs5
- 25. Protection of Applications & VNFs 5G WORLD 2017 - PUBLIC12 NFV INFRASTRUCTURE A Hypervisor provides some level of isolation HARDWARE RESOURCES (CPU, STORAGE, NETWORK) HYPERVISOR NFV INFRASTRUCTURE Malicious code could be implemented to hack through the walls HARDWARE RESOURCES (CPU, STORAGE, NETWORK) HYPERVISOR NFV INFRASTRUCTURE Secure enclaves (“HMEE”) in the CPU increase isolation between the VNFs Secured/measured boot & security enclaves for sensitive VNFs5
- 26. Protection of Applications & VNFs 5G WORLD 2017 - PUBLIC12 NFV INFRASTRUCTURE A Hypervisor provides some level of isolation HARDWARE RESOURCES (CPU, STORAGE, NETWORK) HYPERVISOR NFV INFRASTRUCTURE Malicious code could be implemented to hack through the walls HARDWARE RESOURCES (CPU, STORAGE, NETWORK) HYPERVISOR NFV INFRASTRUCTURE Secure enclaves (“HMEE”) in the CPU increase isolation between the VNFs HSM A HSM tethered to the Enclave could increase the security level of the system for operations such as Key Generation or Mutual Auth. between functions Secured/measured boot & security enclaves for sensitive VNFs5
- 27. Protection of Applications & VNFs 5G WORLD 2017 - PUBLIC12 NFV INFRASTRUCTURE A Hypervisor provides some level of isolation HARDWARE RESOURCES (CPU, STORAGE, NETWORK) HYPERVISOR NFV INFRASTRUCTURE Malicious code could be implemented to hack through the walls HARDWARE RESOURCES (CPU, STORAGE, NETWORK) HYPERVISOR NFV INFRASTRUCTURE Secure enclaves (“HMEE”) in the CPU increase isolation between the VNFs HSM A HSM tethered to the Enclave could increase the security level of the system for operations such as Key Generation or Mutual Auth. between functions A Virtual HSM can be tethered to real HSMs allowing for elasticity and scalability HSM VIRTUAL HSM Secured/measured boot & security enclaves for sensitive VNFs5
- 28. Software Licensing Management 5G WORLD 2017 - PUBLIC13 How to forge sustainable business relationships between multiple stakeholders in a complex 5G environment APPLICATION PROVIDERS On-premise and cloud B2B applications NETWORK VENDORS Virtual Network Function scalable licensing The importance of security, protection, licensing, usage and entitlement management solutions is critical in helping the industry monetize their software and driving disruptive business models CLOUD PROVIDERS Cloud services and applications
- 29. Data Protection / Confidentiality Privacy / Anonymity Denial of Service Protection Anti-Clone mechanism FOR THE ABOVE, WE NEED TO DETERMINE THE FOLLOWING REQUIREMENTS: Device Security per 5G Segment 5G WORLD 2017 - PUBLIC15 Device Capabilities (consumption/processing/memory...) Connectivity Cost (device) Connectivity Cost (recurring – subscription) Type of service provider data in transit FOR THE MAIN 5G SUB-SEGMENTS, WE NEED TO ANALYSE: WE THEN APPLY SECURITY SOLUTIONS (END-TO-END)
- 30. Segmenting Security Needs of Major 5G Use-Cases 5G WORLD 2017 - PUBLIC16 S.F.U.: Security Firmware Upgrade – A.R.M.: Active Risk Management Security Needs (MNO/SP) WALLED GARDEN / OUT-OF-BAND MGMT / TOKENISATION / A.R.M. / S.F.U. Complimentary Core Security to reinforce SOFTWARE IN TRUSTED ENCLAVE / SECURE ELEMENT Credentials Protection Sub. Authentication Anti-DoS Confidentiality Sub. Authentication Anti-DoS Authenticity ID/Privacy Sub. Authentication Confidentiality+ ID/Privacy+ Integrity+ Anti-DoS Authenticity Sub. Authentication Confidentiality++ ID/Privacy++ Integrity++ Device FW Integrity Anti-DoS Authenticity Sub. Authentication Confidentiality+++ ID/Privacy+++ Integrity+++ Device FW Integrity Anti-DoS Authenticity Basic Sensors Broadband Modem Set-Top Box Auto Info-tainment Industrial Basic Smart Wearable Retail (PoS) Laptop Smartphone/tablet Auto Telematics Home Automation Industrial Critical Medical Wearable Metering/CriticalSensors Public Safety/1st Resp. Military Remote Surgery V2X 1 2 3 54
- 31. PROTECT IDs device MANAGE IDs AND GRANT ACCESS core It’s important to find the right balance 5G WORLD 2017 - PUBLIC17 RISK END-TO-END MOBILE NETWORK + SERVICE PROVIDER SECURITY FRAMEWORK • Secure Element • Software in Trusted Enclave • Active Risk Management • Out of Band • Tokenisation • Security Firmware Upgrade
- 32. Weaker Security at Device: Reinforce Core 5G WORLD 2017 - PUBLIC18 RISK If a device does not support a Secure Element (cost, data worthless…) • Software in Trusted Enclave • Active Risk Management • Tokenisation • Security Firmware Upgrade PROTECT IDs device MANAGE IDs AND GRANT ACCESS core
- 33. PROTECT IDs device MANAGE IDs AND GRANT ACCESS core Stronger Device Security: Core adapted accordingly 5G WORLD 2017 - PUBLIC19 RISK If the SP data in transit requires normal to best-in-class security • Secure Element • Security Firmware Upgrade
- 34. To conclude… 5G WORLD 2017 - PUBLIC20 Virtualization brings new challenges in securing your core and edge clouds. Adapt appropriate security per network slice blueprint. Establish trust between functions, encrypt all data at rest or in transit. Choose your end-to-end security architecture wisely based upon the value of the data being transmitted and don’t only consider the device bill of materials. Gemalto is focused on security at the device, multi- access edge and the core with an appropriate footprint per 5G segment meeting both MNO and Service Provider requirements. We’re working with the entire industry to continue to secure next generation mobile communications.
- 35. Thank you Come and see us at Booth 5G 504 You can find me on 5G WORLD 2017 - PUBLIC21