A Virtual Network Topology Security Assessment Process Presented by Rich Goyette 12/12/20151

Overview Motivation Virtual Network Concept Security Model Development Assessment Process Summary An Example Conclusions and Future Work 12/12/20152

Motivation Network Virtualization: Trust and Security challenges. Security is hard to quantify. – Expert judgement is an alternative but: Time and labour intensive; Inconsistent; Our approach – model expert judgement: – Repeatable; – Uses available VNet attributes. 12/12/20153

Concept of Virtual Networks Logical Plane Physical Plane Service Provider (SP) Requirements Virtual Network Provider (VNP) Infrastructure Provider 1 (InP 1) Infrastructure Provider 2 (InP 2) Infrastructure Provider 3 (InP 3) Attribute Search and Comparison 12/12/20154

VNet Attributes are Key! Each physical network element (node and link) has attributes. Attributes are stored in resource discovery framework. RDF We use the attribute values to characterize VNet security. 12/12/20155

How We Model Expert Judgement For each network element (nodes, links), expert judgement of security is modeled using the additive form of multi-attribute value function: x i :A security relevant attribute (operating system, media type, etc.). v(x i ):A value function for a single attribute x i. x: A vector of attributes {x1, x2, … xj} for an element. δ i :A scaling constant for attribute x i. V(x):An expert value function for attribute vector x. (V(x) is the security value of a node or link with attributes x). 12/12/20156

Some Conditions The additive form is only valid when attributes are mutually preference independent; A line of questioning is needed for attribute independence testing following attribute selection. ExampleAlternativesIndependent? Computer selection[1TB, 2GHz, 1GB] [1TB, 4GHz, 1GB] Yes Dinner selection[Potato, Fish, White] [Potato, Beef, White] No 12/12/20157

Decision Support Tools We use MACBETH (Measuring Attractiveness by a Categorical Based Evaluation Technique) to illustrate the development of value functions and scaling constants. Other methods can be used by the must result in measurable value functions on an ordinal scale. 12/12/20158

Single Attribute Value Functions Assume we are considering a Link network element with respect to confidentiality. Link confidentiality can be characterized by: – Channel Mode (CM) – Encryption (ENC) – Media Type (MT) 12/12/20159

Single Attribute Value Functions “In your professional judgement, with respect to confidentiality, what is your strength of preference for fiber over wireless media?” “Twisted pair?” “Coax?” 12/12/201510

Single Attribute Value Functions Based on pairs comparison, a value function is proposed; Values are normalized between the best and worst cases on MACBETH proposed scale (pre-cardinal); Judges can adjust positions to some extent (cardinal). 12/12/201511

Single Attribute Value Functions Encryption and Channel Mode value functions developed similarly; 12/12/201512

Scaling Constant Development Scaling constants in MACBETH are developed using the same process. “Consider the worst case combination of these attributes with respect to confidentiality” “Characterize your strength of preference with respect to this case in going from {wireless, no encryption, no channels} to {fiber, no encryption, no channels}” 12/12/201513

Scaling Constant Development MACBETH fills in remainder of weights and suggests scaling constants. Security Value of Link i: 12/12/201514

Security Value Aggregation We combine network element security values using the following simple aggregation model: The low value is included to manage “weakest link” concerns. We end up with a 3X2 matrix representing C, I, and A for VNet Nodes and Links. 12/12/201515

Assessment Process Summary Gather Security Experts Compute Attribute Value Function Develop Attribute Value Functions Compute Security Value for Element Develop Element Value Function Obtain Attribute Values Identify Relevant Attributes For Each Element: For Each Element in Topology : Identify all Types of VNet Element Aggregate Security Values Nodes and Links MAVT Model Generation Model Application 12/12/201516

Example: Identify Relevant Attributes 12/12/201517

Example: Develop Attribute Value Functions 12/12/201518

Example: Develop Scaling Constants 12/12/201519

Example: Evaluate Topology 12/12/201520

Conclusions Our process is passive; Our process compares current VNet security to expert “best effort”; Once our model is generated, security assessment is relatively straightforward; Model can be generated as a separate business enterprise. 12/12/201521

Future Work Gathering experts for model generation is problematic: – Time, schedule, frequency. – Dynamics of group decision making. Physical network components will change, migrate, and/or evolve. Providers will lie. 12/12/201522