Search

Future drone delivery infrastructure and service for distributing goods to inner city and rural areas, by collaborating with the already existing transportation system, has become an important function in the semi-/full-automation process of home deliveries. This has been exacerbated by the current (and possible future) Covid-19 pandemic. This paper presents a new paradigm for a 5G enabled drone delivery system based on ground-aerial integrated mobilities called TWIN that provide a high-quality communication system for increased drone fleet service capacity. We depict the 5G architecture that supports the dual mobilities and emphasize the strategies to ensure reliable, low latency radio link, high accuracy drone positioning together with location management. The increased link level availability coupled with high accuracy location management, allows for a series of new network applications and support the fast creation of drone delivery services. We envision that logistic services on the TWIN concept will have a high societal and economic impact for both urban and rural areas. acceptedVersion

openaire: EC/H2020/871808/EU//INSPIRE-5Gplus The promise of disparate features envisioned by the 3GPP for 5G, such as offering enhanced Mobile Broadband connectivity while providing massive Machine Type Communications likely with very low data rates and maintaining Ultra Reliable Low Latency Communications requirements, create a very challenging environment for protecting the 5G networks themselves and associated assets. To overcome such complexity, future 5G networks must employ a very high degree of network and service management automation, which is a security challenge by itself as well as an opportunity for smarter and more efficient security functions. In this paper, we present the smart, trustworthy and liable 5G security platform being designed and developed in the INSPIRE-5Gplus1 project. This platform takes advantage of new techniques such as Machine Learning (ML), Artificial Intelligence (AI), Distributed Ledger Technologies (DLT), network softwarization and Trusted Execution Environment (TEE) for closed-loop and end-to-end security management following a zero-touch model in 5G and Beyond 5G networks. To this end, we specifically elaborate on two key aspects of our platform, namely security management with Security Service Level Agreements (SSLAs) and liability management, in addition to the description of the overall architecture.

International audience; Anomaly detection remains a challenging task due to both the ever more complex functions that need to be executed and the evolution of current networking devices which induces limitation of computational resources such as the Internet of Things (IoT). Furthermore, results of anomaly function computations can be repeated gradually over time or executed in neighboring nodes, thus leading to a waste of such limited computing resources in constrained nodes. To tackle these issues, the content-centric paradigm enhanced with computing features offers a promising solution to reduce the computation resources and finally improve the scalability of anomaly detection functions. In this paper, we propose a first step toward a content-oriented control plane which enables the distribution of the processing and the sharing of results of anomaly detection functions in the network. We present the way we leverage NFN to support Bayesian Network inference to detect anomalies in network traffic. The relevance and performance of our proposed approach are demonstrated by considering the Content Poisoning Attack (CPA) through numerous experiment data.

Part 6: Industrial Applications; International audience; This paper presents the main results of the experiments conducted using the MMT-IoT security analysis solution run on a IoT Fed4Fire+ platform (Virtual Wall - w.iLab proposed by IMEC, Belgium). MMT is a monitoring framework developed by Montimage, and MMT-IoT is the tool that allows monitoring and analysing the security and performance of IoT networks. The results obtained concern two principal advancements. First, the adaptations made to deploy MMT-IoT on the IoT platform in order to run the tool on the platform’s IoT devices. Second, the deployment of the software allowed us to run preliminary tests on the selected platform for performing initial validation and scalability tests on this real environment. To this end, Montimage defined and implemented three test scenarios related to security and scalability with 1 or more clients. These results will be used to prepare a new experimentation phase involving also another Fed4Fire+ platform (LOG-a-TEC proposed by IJS, Slovenia).

International audience; After more than one decade of research efforts, ICN technologies seem mature enough to move from a design and implementation phase to early deployment trials. However, if one wants an ICN stack to be operated in a production context, some major locks, related to (1) the lack of adequate deployment infrastructure, (2) the migration of relevant services and (3) the capability to accurately monitor an overall ICN domain, must be addressed. In this paper we present a feedback experience of the deployment of a Named Data Networking island. The latter considers HTTP over NDN as a primary service deployed through dedicated gateways and NFV as a substrate for deploying and orchestrating ICN components. From the performance assessment of individual components up to the opening of the testbed to end-users in university campus, we propose an analysis that can guide further research efforts in the ICN area.

Traffic volumes in mobile networks are rising and end-user needs are rapidly changing. Mobile network operators need more flexibility, lower network operating costs, faster service roll-out cycles, and new revenue sources. The 5th Generation (5G) and future networks aim to deliver ultra-fast and ultra-reliable network access capable of supporting the anticipated surge in data traffic and connected nodes in years to come. Several technologies have been developed to meet these emergent demands of future mobile networks, among these are software defined networking, network function virtualization, and cloud computing. In this paper, we discuss the security challenges these new technologies are prone to in the context of the new telecommunication paradigm. We present a multi-tier component-based security architecture to address these challenges and secure 5G software defined mobile network (SDMN), by handling security at different levels to protect the network and its users. The proposed architecture contains five components, i.e., secure communication, policy-based communication, security information and event management, security defined monitoring, and deep packet inspection components for elevated security in the control and the data planes of SDMNs. Finally, the proposed security mechanisms are validated using test bed experiments.

The wide adoption of the Internet of Things (IoT) paradigm in several application domains has raised new security issues, which should be carefully taken into account to achieve a real benefit from the indisputable innovation potential of IoT. In fact, the heterogeneity of involved technologies, including the integration of different resource-constrained devices and networks, has led to the introduction of new threats affecting all architectural layers and urging for the design and enforcement of adequate security countermeasures , including effective monitoring capabilities. In this paper, we present a monitoring tool for IoT systems based on the extension of the Montimage network monitoring tools . The proposed solution, validated within the H2020 ANASTACIA project, proved to be well suited to monitor IoT-level networks thanks to the exploitation of protocol-specific plugins.

International audience; NDN is the most mature proposal of the ICN paradigm, a clean-slate approach for the Future Internet. Although NDN was designed to natively tackle security issues inherent to IP networks, it also introduces new security threats that may prevent its practical deployment by telco operators. Therefore, designing and implementing a dedicated security monitoring plane is essential to enable such future deployment. In this article, we present a set of contributions in this area. It first consists of featuring significant NDN attacks in a real operating context to evaluate their actual impact. Then, by analyzing the NFD data plane pipelines, we present a monitoring plane design that captures the state of NDN nodes by instrumenting 18 metrics with dedicated probes. We then correlate these metrics with a Bayesian network, which allows the detection of potential abnormal behaviors. To validate our approach, we demonstrate the efficiency of our monitoring plane in the detection of content poisoning attacks and interest flooding attacks in a testbed carrying real traffic.

International audience; 5G is envisioned as a transformation of the communications architecture towards multi-tenant, scalable and flexible infrastructure, which heavily relies on virtualised network functions and programmable networks. In particular, orchestration will advance one step further in blending both compute and data resources, usually dedicated to virtualisation technologies, and network resources into so-called slices. Although 5G security is being developed in current working groups, slice security is seldom addressed. In this work, we propose to integrate security in the slice life cycle, impacting its management and orchestration that relies on the virtualization/softwarisation infrastructure. The proposed security architecture connects the demands specified by the tenants through as-a-service mechanisms with built-in security functions relying on the ability to combine enforcement and monitoring functions within the software-defined network infrastructure. The architecture exhibits desirable properties such as isolating slices down to the hardware resources or monitoring service-level performance

International audience; The orchestration of countermeasures in the context of security incidents remains a challenging task for network operators. The main objective of this demonstration is to present how this orchestration is possible in the context of a virtualized NDN network. Based on an adaptation of the TOSCA topology and orchestration model, it is possible to trigger these countermeasures after the detection of NDN specific attacks. We show how the Montimage Monitoring Tool (MMT) has been adapted to detect typical Content Poisoning Attack (CPA), and how the orchestrator can trigger reactions to mitigate their impact on the network.

International audience; Named Data Networking (NDN) is the most mature proposal of the Information Centric Networking paradigm, a clean-slate approach for the Future Internet. Although NDN was designed to tackle security issues inherent to IP networks natively, newly introduced security attacks in its transitional phase threaten NDN's practical deployment. Therefore, a security monitoring plane for NDN is indispensable before any potential deployment of this novel architecture in an operating context by any provider. We propose an approach for the monitoring and anomaly detection in NDN nodes leveraging Bayesian Network techniques. A list of monitored metrics is introduced as a quantitative measure to feature the behavior of an NDN node. By leveraging the hypothesis testing theory, a micro detector is developed to detect whenever the metric significantly changes from its normal behavior. A Bayesian network structure that correlates alarms from micro detectors is designed based on the expert knowledge of the NDN specification and the NFD implementation. The relevance and performance of our security monitoring approach are demonstrated by considering the Content Poisoning Attack (CPA), one of the most critical attacks in NDN, through numerous experiment data collected from a real NDN deployment.

Software Defined Network (SDN) is an advanced approach to designing dynamic, manageable, cost-effective, and adaptable network architectures. SDN will play a key role as an enabler for 5G and future networks. Transferring network monitoring functions to a software entity working in conjunction with configurable hardware accelerators through a scheme called Software Defined Monitoring (SDM) is one promising way to attain the dynamism necessary for the monitoring of the next generation-networks. In this paper, we propose a novel SDM architecture for future mobile backhual networks. As an SDN solution, the proposed architecture provides more granular and dynamic network management functions through its programmable interface, centralized control, and virtualized abstractions. At the same time, the SDM framework intuitively seem prone to various challenges that come with the separation of the control and data planes of middleboxes. This paper collects specific opportunities, vulnerabilities as well as challenges related to SDM. It also highlights how SDM can be used to solve the current limitations in legacy monitoring systems. The feasibility of the proposed SDM architecture is verified by using a testbed implementation.

International audience; We present two practical components to allow real deployment of NDN: a NDN/HTTP gateway that allows to connect a NDN network to the rest of the World Wide Web, and a monitoring solution dedicated to NDN. Following NFV principle , all components of our NDN network are deployed as Virtual Network Functions and run on standard hardware. The whole infrastructure will be shown in a live demo at the conference.

Security policies are enforced through the deployment of certain security functionalities within the applications. When the security policies dynamically change, the associated security functionalities currently deployed within the applications must be adapted at runtime in order to enforce the new security policies. INTER-TRUST is a framework for the specification, negotiation, deployment and dynamic adaptation of interoperable security policies, in the context of pervasive systems where devices are constantly exchanging critical information through the network. The dynamic adaptation of the security policies at runtime is addressed using Aspect-Oriented Programming (AOP) that allows enforcing security requirements by dynamically weaving security aspects into the applications. However, a mechanism to guarantee the correct adaptation of the functionality that enforces the changing security policies is needed. In this paper,we present an approach based on the combination of monitoring and detection techniques in order to maintain the correlation between the security policies and the associated functionality deployed using AOP, allowing the INTERTRUST framework to automatically react when needed. European Union INTER-TRUST FP7- 317731 Ministerio de Economía y Competitividad TIN2012-34840 Ministerio de Economía y Competitividad FamiWare P09-TIC-5231 Ministerio de Economía y Competitividad MAGIC P12-TIC1814

International audience; This paper presents a technique for vulnerability detection in C programs. It is based on a vulnerability formal model called "Vulnerability Detection Conditions" (VDCs). This model is used together with passive testing techniques for the automatic detection of vulnerabilities. The proposed technique has been implemented in a dynamic code analysis tool, TestInv-Code, which detects the presence of vulnerabilities on a given code, by checking dynamically the VDCs on the execution traces of the given program. The tool has been applied to several C applications containing some well known vulnerabilities to illustrate its effectiveness. It has also been compared with existing tools in the market, showing promising performances

International audience; The service-oriented approach is becoming more and more popular to integrate highly heterogeneous systems. Web services are the natural evolution of conventional middleware technologies to support Web-based and enterprise level integration. Formal testing of such Web-based technology is a key point to guarantee its reliability. In this paper, we choose a non-intrusive approach based on monitoring to propose a conformance passive testing methodology to check that a composed Web service respects its functional requirements. This methodology is based on a set of formal invariants representing properties to be tested including data and time constraints. Passive testing of an industrial system (that uses a composition of Web services) is briefly presented to demonstrate the effectiveness of the proposed approach

International audience; Although the adoption of the IP Multimedia Subsystem (IMS) keeps growing, IMS applications are often integrated to the system without being formally tested. In this work, we are interested in the IMS Push over Cellular (PoC) service, an OMA standard. We propose a conformance passive testing approach to check that its implementation respects the main standard requirements. This approach is based on a set of formal invariants representing the most relevant expected properties to be tested. Two testing phases are applied: the verification of the invariants against the service specification and their testing on the PoC collected execution traces

International audience; Conformance testing is crucial to the quality and reliability of routing protocols for pervasive communications. Most of the works are devoted to their simulations in order to study their performance in a simulated context without taking into account their formal requirements and specifications. Our work tackles the formal methods to test the conformance of a ad hoc routing protocol (i.e. OLSR) deployed in a real network. A passive testing technique is applied taking into account the OLSR formal specification, formal description of properties and collected traces of the implementation. This approach is complementary to active testing techniques allowing then to reduce the inconclusive verdicts often observed in several experiments

International audience; In this paper we propose a passive conformance testing technique applied to a Mobile ad hoc network (MANET) routing protocol, OLSR, that is characterized by a dynamically changing topology and lack of centralized management. This makes it necessary to investigate new ways to test complex scenarios and configurations. The work here proposes a formal passive testing method to test the conformance and reliability of the protocol. The method developed has been performed on a real case study showing that the approach can be successful applied and that it allows reducing inconclusive verdicts often observed using other methods.

International audience