1. Security Working Group
2017 Aug 29-30
Face to Face Meeting
VMWare Campus Conference Call

2. 2017 Aug 29, 30 Security Working Group Meeting Agenda
Tuesday Aug 29
Noon (PDT): Arrivals -- Lunch is available in the VMWare cafeteria (Building: Hilltop C)
12:30 PM (PDT): Check-In (Building: Hilltop A)
1:00 PM (PDT): Meeting Start
3:00 PM (PDT: Coffee/Dessert break
5:00 PM (PDT): Meeting End
6:30 PM (PDT): Security Team Dinner  (location Saint Michael's Alley Homer Avenue, Palo Alto, CA 94301)
Wednesday Aug 30
8:00 AM (PDT): Arrival with Breakfast and Coffee
8:30 AM (PDT): Meeting Start
Noon (PDT): Lunch at the VMWare cafeteria
3:00 PM (PDT): Coffee/Dessert break
6:30 PM (PDT): Security Team Dinner (location La Strada University Avenue, Palo Alto, CA 94301)

3. California Release – Near Term Security Goal
Protected communication (inbound and outbound) over the public internet on north bound interface
OAuth 2.0 methods
PKI certificate methods
Mutually authenticated TLS
Key Management API
Inbound Connection Manager (Firewall)
Overall plan - Provide well defined API interfaces for security services with basic implementation right out of the box
Allow commercial partners to supply enhanced features and services using the same API interface with drop in replacements

4. 2017 Aug 29, 30 Security Working Group Meeting Agenda
Location:
VMWare Campus
3401 Hillview Ave.
Palo Alto, CA 94304
Detailed campus map, recommended hotels and required NDA posted on edgeX Security Working Group Wiki.
Recommended Airports: San Jose (SJC) [closest] or San Francisco (SFO)
Requested: To RSVP for the in-person meeting, please August 23

5. Security
Functionality
Requirements
Fuse Arch.

6. Security Micro Service High Level Architecture Environment
Hardware
OS Specific Platform
EdgeX Platform
Security
Function X
Secure
Boot
RoT

7. Security Micro Service High Level Architecture Function
Security Function X
API interface to rest of EdgeX platform
API interface to Platform Secure Elements
Simple SW Secure Element Implementation
Out of Scope -Shim interface per deployment
Shim will interface with OS provide secure elements or hardware secure elements of the hardware platform (TPM)
Function
API EdgeX System
API
Platform Secure Elements
Simple SW Secure Elements Implementation
Shim interface
(Out of scope) OR
OS or HW Secure Elements

8. EdgeX Security High Level Architecture Services
Data Protection
Identity and Access
Operational Security
DAR
Encrypted Storage
DIT
Encrypted Comms
Access Control
(Least Privilege)
Administration
Local and Remote
Security
Monitoring
Audit
Key
Management
Data Protection
Policy
Authentication
Identity and Access
Policy
SW Update
Management
Attestation
Identity
Management
Chain of Trust
Operational Security
Policy
Guidelines
Inbound
Connection Manager Firewall
Privacy

9. Example Use Case EdgeX Northbound Connection
EdgeX Gateway
Connection is initiated from EdgeX to Cloud
Set up a mutually authenticated TLS connection using x.509 methods
Certificate Handling
Provisioning, renewal,
Use OS certificate store and services
Required to use export service to obtain a connection
Policy service
Who can talk to who, read, write, connection type
Initial settings of EdgeX to configure Cloud connection

10. EdgeX Security High Level Function
Authentication methods
X.509 PKI Smart device
Username and password
Dumb device – Service Plugin
OAuth2.0
Customer required external Authentication Method
PKI Elliptic Curve Methods
ECDSA 128, 256
Built in simple service for out of the box authentication
Need authentication method for secure connection to EdgeX microservices.
Microservices within a single container may not need to authenticate.
OAuth2.0 is recommended since it support internal and external
Access to HW Platform Key Store
Functions
API EdgeX System
API
Platform Secure Elements

11. EdgeX Security High Level Function
DIT Encrypted Comms
Connection mode encryption
TLS
DTLS
Payload encryption
AES 128, 256
Internal connections encryption is optional
External connections encryption is required
Confidentiality
Integrity
Possible to East-West Protected Connection via OAuth 2.0 (Distributed EdgeX)
Functions
API EdgeX System
API
Platform Secure Elements

12. EdgeX Security High Level Function
DAR Encrypted Storage
Confidentiality
Integrity
Functions
API EdgeX System
API
Platform Secure Elements

13. EdgeX Security High Level Function
David F. volunteered to specify requirements and look for open source candidate
Inbound Connection Manager Firewall
Functions
API EdgeX System
API
Platform Secure Elements

14. EdgeX Security High Level Function
Access Management
OAuth2.0 Roles
Resource Owner
Client
Resource Server
Authorization Server
Functions
API EdgeX System
API
Platform Secure Elements

15. EdgeX Security High Level Function
DAR Policy
What to encrypt
Encryption method
Functions
API EdgeX System
API
Platform Secure Elements

16. EdgeX Security High Level Function
Identity and Access Policy
Identities
Resource Owner
Client
Resource Server
Authorization Server
Access for each identity
Read and/or Write Controls for devices
Parameter level
Admin control API for remote admin
Publish Controls
Encryption requirements for communications to all identities and publishing paths
Functions
API EdgeX System
API
Platform Secure Elements

17. EdgeX Security High Level Function
Operational Security Policy
Inbound Connection Manager Firewall Policy
SW Update Management Policy
Audit Policy
Attestation Policy
Functions
API EdgeX System
API
Platform Secure Elements

18. EdgeX Security High Level Function
Identity Management
Enroll/deactivate
PKI Certificates –Smart device
Dumb device - Service Agent
Public PKI ID authorized to update
White list
CRL (certificate revocation list)
Functions
API EdgeX System
API
Platform Secure Elements

19. EdgeX Security High Level Function
Software Update Management
In Scope
EdgeX Microservices
EdgeX can play an orchestration role for Platform under EdgeX (OS) when allowed.
Future
South bound connected devices
Method
Validation of update signature
PKI Certificates –Smart device
Dumb device - Service Agent
Functions
API EdgeX System
API
Platform Secure Elements

20. EdgeX Security High Level Function
Security Monitoring
Monitoring
Alerts
Anomaly detection
Intrusion detection
Functions
API EdgeX System
API
Platform Secure Elements

21. EdgeX Security High Level Function
Audit
Log security events
Signing and anti-tamper protections
Functions
API EdgeX System
API
Platform Secure Elements

22. EdgeX Security High Level Function
Riaz volunteered to pick a suggested REST API from open source
Key Management
Containerize Key Vault
Later someone would need to connect this to other OS services and hardware RoT
Need to design a REST EdgeX API to these services
PKCS #11 services?
Functions
API EdgeX System
API
Platform Secure Elements

23. EdgeX Security High Level Function
Attestation
Measurement for chain of trust
Measurement of boot images
Measurement of control and configuration
Functions
API EdgeX System
API
Platform Secure Elements

24. EdgeX Security High Level Function
Chain of Trust
What so measure
How to measure
Attestation measurement signing
Functions
API EdgeX System
API
Platform Secure Elements

25. EdgeX Security High Level Function
Privacy
Needs to be taken into consideration
Consumer
Health Care (HIPA)
EU Requirements
Functions
API EdgeX System
API
Platform Secure Elements

26. Digital Signature Algorithm
EdgeX Security High Level Architecture Hardware Platform Required Security Functionality HW
TEE
Secure Update
Key Store
Digital Signature Algorithm
TRNG
Attestation
Secure Boot

27. EdgeX Security High Level Function
HW TEE (Trusted Execution Environment)
Required in platform to protect and isolate security sensitive values
Functions
API EdgeX System
API
Platform Secure Elements

28. EdgeX Security High Level Function
Key Store
Required in platform to protect stored keys
Functions
API EdgeX System
API
Platform Secure Elements

29. EdgeX Security High Level Function
RNG (Random Number Generator
TRNG (True Random Number Generator)
DRNG (Deterministic RNG)
Functions
API EdgeX System
API
Platform Secure Elements

30. EdgeX Security High Level Function
Secure Boot
Signature validation at each boot level
Integrity checks at each boot level
Connection into chain of trust in EdgeX
Functions
API EdgeX System
API
Platform Secure Elements

31. EdgeX Security High Level Function
Digital Signature Algorithm
ECDSA
Functions
API EdgeX System
API
Platform Secure Elements

32. EdgeX Security High Level Function
Attestation
Measurement of each boot level
Connection into attestation in EdgeX
Functions
API EdgeX System
API
Platform Secure Elements

33. EdgeX Security High Level Architecture Open Questions
Out of Scope - Provide guidance on how security features can/should be tested

34. Proposed Northbound Security Objectives
Client, Distribution and Services Access
Parameter level read/write
Streaming data permissions ( publish/subscribe)
Administration & Permissions Management
Remote Administration Access
Permission management interface
Differentiation of local vs remote access
Clients & services operating “behind the firewall”
Applications and services located on public Internet
Flexibility
Enable companies to enforce internal security policies
Flexible key management methods
Certificate Authority, PKI, Blockchain
Flexible support of security and access technologies
PKI, SSL, OAuth

35. Proposed Northbound Access Permissions Topology

36. Past Security Agreements
“Fuse microservices to enforce access control, authentication, and authorization (AAA).” – Also needs to support smart end points to cloud (AAA)
Needs to support tunneled and encrypted sensor data to the cloud – Gateway in pass through mode only.
Specifies Gateway administrator provisions devices. Should also allow for smart devices to connect to cloud in pass through mode.
“Rely on installation-unique credentials for protecting access to any of the Fuse repositories.” – Add support for Smart end points support (certificate, authentication, integrity, optional encryption)
“Documentation provided with Fuse should strongly recommend that implementers expose HTTPS only.” – Needs to require TLS 2.0 or higher, down grade to unsecure modes should be flagged as insecure by EdgeX.
“For those subscribers of MQTT data, there is no ability to protect sensitive data in transit” – This statement is in error. Typical protection is provided by a TLS layer that MQTT is tunneled through.
Mangement Use Cases “EdgeX Administrator updates software” – This is only the EdgeX software upgrade and not end devices. Needs to support upgrade of devices from cloud to device in pass through mode to support various vendor methods.
Control Use Cases “EdgeX published all data” – Need to change to allow for smart devices to publishing data directly to cloud.