...

Status: Draft

Best Practice:

...

ONAP requires two components to improve the security of credentials used in orchestration.

1. a secrets vault to store credentials used by ONAP
2. a process to instantiate credentials

Component 1: Secrets Vault - A service that can be integrated with ONAP that provides secure storage of the credentials used by ONAP to authenticate to VNFs.

Image Added

• OpenStack’s Barbican: specific to OpenStack, not a mature service
• Various commercial services such as LastPass

Recommendation: ONAP should provide a reference implementation of a secrets vault service as an ONAP project.

Next Steps:

• Find a project lead for a reference implementation.

Component 2: A process to provision ONAP instances with credentials. These credentials may be used for interprocess communication (e.g., APPC calling A&AI) or for ONAP configuring VNFs.

Automatic provisioning of certificates and credentials to ONAP components: AAF can provision certificates. ECOMP DCAE is currently using AAF to provision certificates.

Next steps:

• Work with the AAF team to include this functionality in Release 2. It is important to understand that the AAF solution depends on the CA supporting the SCEP protocol.
• Enhance AAF to provision userIDs & passwords to ONAP instances and VNFs. Most VNFs only support userID/password authentication today. ETSI NFV SEC may issue a spec in the future on a more comprehensive approach to using PKI for NFV which can be visited by ONAP SEC when released. Steve is working on this right now but doesn’t know when he’ll be done.

4. Static Code Scans

Status: Draft

...