Stay Thrifty, Stay Secure: A VPN-based Assurance Framework for Hybrid Systems

Abstract

Security assurance provides a wealth of techniques to demonstrate that a target system holds some nonfunctional properties and behaves as expected. These techniques have been recently applied to the cloud ecosystem, while encountering some critical issues that reduced their benefit when hybrid systems, mixing public and private infrastructures, are considered. In this paper, we present a new assurance framework that evaluates the trustworthiness of hybrid systems, from traditional private networks to public clouds. It implements an assurance process that relies on a Virtual Private Network (VPN)-based solution to smoothly integrate with the target systems. The assurance process provides a transparent and non-invasive solution that does not interfere with the working of the target system. The performance of the framework have been experimentally evaluated in a simulated scenario.

An Assurance-Based Risk Management Framework for Distributed Systems

“…Assurance frameworks have recently received increasing attention as the means to gain justifiable confidence that IT systems will consistently demonstrate one or more security (non-functional in a broader sense) properties, and behave as expected [20], [23]. Anisetti et al [20] presented an assurance framework for test-based cloud certification, which has then been extended for hybrid systems mixing cloud and private infrastructures [24]. Aslam et al [25] presented FoNAC, an audit and certification framework targeting fog computing and based on Trusted Platform Modules.…”

Towards an Assurance Framework for Edge and IoT Systems

“…Security assurance is defined as the mean to obtain justifiable confidence that an IT system behaves as expected demonstrating some non-functional properties (e.g., confidentiality) [3]. In the last decade, assurance has become a well-established practice, increasing the trustworthiness of service and cloud systems [3], with some methodologies addressing hybrid clouds [6] and edge systems [5]. However, hybrid cloud/edge and IoT systems raise some significant challenges, impairing the effectiveness of state of art solutions.…”

An Assurance Framework and Process for Hybrid Systems

“…We present a framework that provides a lightweight assurance solution addressing the peculiarities of modern distributed systems, mixing public endpoints on the cloud, microservices, and private deployments not directly reachable from the outside (e.g., traditional private corporate networks and private clouds). The framework has been first defined in [4] and here extended to address requirements complementarity and automation. The original framework in [4], offering only a graphical dashboard, constrained the ability to integrate framework's functionalities with existing security processes, and to trigger such functionalities in a automated way.…”

“…The framework has been first defined in [4] and here extended to address requirements complementarity and automation. The original framework in [4], offering only a graphical dashboard, constrained the ability to integrate framework's functionalities with existing security processes, and to trigger such functionalities in a automated way. To address all requirements in Section 2, it adopts a layer-3 VPN that connects the framework with the private deployments under verification (i.e., the target networks), and offers a REST API providing full and programmatic access to framework's functionalities.…”

“…In this paper, we extend our assurance framework in [4] enabling a centralized security assurance, complementing existing security processes and systems, and providing automation of assurance activities. The framework implements an API-based approach facilitating integration and automation, and relies on Virtual Private Networks (VPNs) to target both public and private infrastructures.…”