Towards 5G-ready Security Evaluation

迈向 5G 就绪的安全评估

• 批准号: 560273-2020
• 负责人: Zhao, Lianying
• 金额: $ 2.19万
• 依托单位: Carleton University
• 依托单位国家: 加拿大
• 项目类别: Alliance Grants
• 财政年份: 2021
• 资助国家: 加拿大
• 起止时间: 2021-01-01 至 2022-12-31
• 项目状态: 已结题
• 来源: https://www.nserc-crsng.gc.ca/ase-oro/Details-Detailles_eng.asp?id=721745
• 关键词: Towards; 5G; ready; Security; Evaluation

Entering the era of the fifth generation (5G), telecom networks demonstrate certain characteristics less seen in the predecessors, complicating the security posture of the hosting IT infrastructure. For example, there are more parties sharing the platform, e.g., virtual operators, and network entities can appear/disappear dynamically on the fly. While there have been various well-established solutions to the detection, mitigation, prevention and analysis of cyber-attacks, evaluation of their probability has been a long quest in the IT industry. This concerns important decisions such as where more investments should go and how network functions should be deployed. Even though accurate prediction of such attack is non-trivial (if possible at all), we aim to at least come up with a basis for comparison. With such bases, a decision maker can see that system/infrastructure A is more secure than B, under the assumption of X. In this project, we take into account the 5G-specific characteristics and remodel various factors like attacks and defense mechanisms under the context of security evaluation. For instance, we use a layered model to represent 5G entities and propose a modular approach to aggregate security metrics of individual parties to have an overall score. Moreover, we will identify new measures to assist in security evaluation. Three tentative aspects are 1) Metadata of 5G network entities. Most 5G entities are based on virtualized/cloud-based network functions that can be automatically instantiated. The metadata that defines them has security implications.2) Machine learning. Without manually selecting security indicators, we can use methods like neural networks to self-adapt to indicate security levels, based on current expert knowledge. 3) User-based validation. As security evaluation always concerns the future (e.g., the probability), it is not easy or less straightforward to prove or falsify with algorithms. We also plan to also involve user opinions to facilitate the validation.As another differentiator, we base our experimentation and evaluation on real virtualized 5G testbed.

进入第五代（5G）时代，电信网络表现出某些在前辈中较少见到的特征，使托管IT基础设施的安全状况变得复杂。例如，有更多的参与方共享平台，例如，虚拟运营商和网络实体可以动态地出现/消失。虽然已经有各种完善的解决方案来检测，缓解，预防和分析网络攻击，但评估其概率一直是IT行业的长期追求。这涉及到重要的决策，例如更多的投资应该投向何处以及如何部署网络功能。即使准确预测这种攻击是不平凡的（如果可能的话），我们的目标是至少拿出一个比较的基础。有了这样的基础，决策者可以看到，在X的假设下，系统/基础设施A比B更安全。在这个项目中，我们考虑到5G的特定特征，并在安全评估的背景下重新构建各种因素，如攻击和防御机制。例如，我们使用分层模型来表示5G实体，并提出了一种模块化方法来聚合各方的安全指标，以获得整体得分。此外，我们将确定新的措施，以协助安全评估。三个尝试性方面是1）5G网络实体的元数据。大多数5G实体都基于虚拟化/基于云的网络功能，可以自动实例化。定义它们的元数据具有安全含义。2）机器学习。无需手动选择安全指标，我们可以使用神经网络等方法，根据当前的专家知识自适应地指示安全级别。3)基于用户的验证由于安全评估总是关注未来（例如，概率），用算法来证明或证伪是不容易或不那么直接的。作为另一个差异化因素，我们的实验和评估基于真实的虚拟5G测试平台。