You are viewing an old version of this page. View the current version.
Compare with Current
View Page History
« Previous
Version 3
Next »
References
Survey of Options
Expectations
- Ability to secure the intra-ONAP communications, i.e. between ONAP projects, such as SO-to-AAI, UUI-to-MSB, OOF-to-VID, etc.
- Ability to secure the ONAP-to-external-system communications, i.e. ONAP-to-database-cluster, ONAP-to-NetworkFunctions, ONAP-to-other-ONAP, etc.
- Ability to scale with the defined ONAP projects (static per ONAP release)
- Ability to scale with the number of deployed instances of ONAP VMs/pods/microservices (dynamic)
- Ability to scale with the number of external-system connections (configurable)
- Ability to work with HEAT-based deployment
- Ability to work with OOM-based deployment
- Ability to work with other (non-HEAT, non-OOM) deployment
- Ability to operate with other layers of security
- Ability to securely upgrade ONAP in-the-field
- Ability for resilient and fault-tolerant ONAP communications in-the-field
- Minimal efforts to implement across all ONAP projects
- Minimal impact on resource usage and performance across ONAP
Threat Models
- External attacker analyzes the captured traffic among services to steal secrets such as passwords and certificates
- Internal attacker analyzes the captured traffic among services to steal secrets such as passwords and certificates
- External attacker bombards the container services with new connections, leading to large number forked processes and threads leading to resource issues on other workloads (containers) in the system
- Internal attacker bombards the container services with new connections, leading to large number forked processes and threads leading to resource issues on other workloads (containers) in the system
- External attacker exploits downloads of containers from repositories to tamper with them and inject malicious code
- Internal attacker exploits downloads of containers from repositories to tamper with them and inject malicious code
- External attacker introduces malicious VM into ONAP environment to steal data and subvert operations
- Internal attacker introduces malicious VM into ONAP environment to steal data and subvert operations
- External attacker introduces malicious pod into ONAP environment to steal data and subvert operations
- Internal attacker introduces malicious pod into ONAP environment to steal data and subvert operations
- External attacker introduces malicious microservice into ONAP environment to steal data and subvert operations
- Internal attacker introduces malicious microservice into ONAP environment to steal data and subvert operations
- External attacker introduces malicious external-system into ONAP environment to steal data and subvert operations
- Internal attacker introduces malicious external-system into ONAP environment to steal data and subvert operations
Discussion
- There has already been discussion and recommendation for using Istio https://istio.io/
- This page is gathering thoughts for alternative solutions
Discussion of Istio
Discussion of Tinc Vpn
Discussion of ZeroTier
Discussion of WireGuard
Discussion of vpncloud.rs
Discussion of PeerVpn
Discussion of OpenVpn