Feasible Cooperative Zero Trust Framework for 5G

数以百万计的美国人每天通过他们的设备连接到5G蜂窝网络；然而，大多数人没有意识到他们的连接依赖于在大量网络组件上运行的软件堆栈。因此，他们的安全和隐私直接依赖于该基础设施软件的可信性，而网络客户自己可以做的很少来验证可信性。用户必须信任网络运营商及其监管机构使用的流程、标准和法规。因此，网络客户目前不能将“零信任”(ZT)原则扩展到网络；也就是说，他们不能有意义地观察到对其安全和隐私至关重要的软件的信任并建立合理的基础。我们的融合加速器团队将结合软件安全分析、以人为本的设计、网络、网络安全、标准、法律和法规方面的专业知识，为多利益相关者、高安全的5G网络背景下的ZT网络安全解决方案建立新的技术基础。被称为“合作零信任”(CZT)的多方--尤其是客户和网络运营商--将使用它共同努力，不断确保客户网络中涉及的5G基础设施软件的可信性。为了开发CZT，该团队将：(1)为CZT解决方案和框架开发新的理论和技术基础，包括将软件监控嵌入5G基础设施的值得信赖和高效的技术基础；(2)利用人类可读的技术需求文档，开发可理解和可操作的新的自动化软件信任指标；以及(3)通过确保CZT安全技术在现有监管环境中的务实可操作性，以及通过制定法律和监管框架设计激励结构，包括协调一致的法律和标准草案，为CZT安全技术的广泛采用铺平道路。

Millions of Americans connect daily to 5G cellular networks through their devices;, however, most are unaware that their connections depend on stacks of software running on legions of networking components. Their security and privacy therefore directly depends on the trustworthiness of this infrastructural software, and yet network customers can do very little themselves to verify the trustworthiness. The user must trust the processes, standards, and regulations used by the network operators and their regulators. As a result, network customers cannot currently extend principles of “Zero Trust” (ZT) to the network; namely, they cannot meaningfully observe and establish a reasoned basis for trust in the software critical to their security and privacy.    Our convergence accelerator team will combine expertise in software security analysis, human-centered design, networking, cybersecurity, standards, laws, and regulations to establish a novel technical foundation for ZT cybersecurity solutions in the context of multi-stakeholder, high-security 5G networks. Called “Cooperative Zero Trust,” (CZT) multiple parties— notably, clients and network operators —will use it to work jointly on continuously assuring trustworthiness of the 5G infrastructure software involved in a client’s network. To develop CZT the team will: (1) develop novel theoretical and technical foundations for CZT solutions and frameworks, including a trustworthy and efficient technical foundation for inserting software monitoring into 5G infrastructure, (2) utilize human-readable technical requirements documents to develop new automated indicators of software trust that are intelligible and actionable, and (3) pave the way for widespread adoption of CZT security technologies by ensuring their pragmatic workability within existing regulatory environments, and designing incentive structures through legal and regulatory framework development, including aligned draft laws and standards.