CB-Manager and LCP: enhance the Security Cloud with the Programmability
Creators: name: Carrega, Alessandro
name: Repetto, Matteo
Publisher: name: Zenodo
Year: 2021
Subjects: cloud, security, programmability, agents, manager, context broker, elasticsearch

description: ASTRID is a multi-tier architecture, where a common, programmable, and pervasive context fabric feeds a powerful set of multi-vendor detection and analysis algorithms (business logic). On the one hand, the challenge is deep visibility over multiple software components by real-time collection of massive events from a multiplicity of capillary sources, while maintaining essential properties such as forwarding speed, scalability, autonomy, usability, fault tolerance, resistance to compromises, and responsiveness. On the other hand, the ambition is to support better and more reliable situational awareness by inter- and intra-domain data correlation in both space and time, in order to timely detect and respond even the more sophisticated multi-vector and interdisciplinary cyberattacks. The Context Broker (CB) is the logical component to manage the security context. We define the security context as the set of information, data, and measurements that describe the service and can be used for security-related purposes. The scope includes the description of the service components (namely, software deployed in each virtual function) and its topology (network links and communication channels), as well as operational data from the execution of the service (logs, system metrics, measurements, events, software traces). The CB-Manager function implements a REST API that provides a uniform access interface to multiple components and the information stored in the CB's database: (<em>i</em>) detection and monitoring agents deployed in virtual functions: location, capability, properties; (<em>ii</em>) external service orchestrator: service topology, run-time parameters; (<em>iii</em>) security services: capability, parameters; and (<em>iv</em>) data stored in the CB, as reported by the running agents: retrieval, queries. The Local Control Plane (LCP) gives the CB access to the configuration of agents. It is designed to support multiple configuration methods (through configuration file, command line, REST API) but to remain unaware of specific protocols. The LCP acts as the single point of contact for the CB and exposes the list of available agents. The architecture includes a number of components to be deployed in the execution environment of Virtual Functions (VFs), and the internal structure of the CB. All components are organized in a data plane and a control plane; the management plane is not shown in the picture because it is entirely implemented by the external software orchestration tool. The overall design is based on the Elastic Stack framework, a collection of open source projects for data acquisition, processing, and storage. It was originally composed of Elasticsearch, Logstash, and Kibana (for which it was formerly known as ELK) and is now evolving to include additional components. Though these tools were originally conceived to work statically, i.e. with minimal or no possibility to change the configuration at run-time, we are implementing an additional dimension of programmability in the control plane, so to easily support the definition of new inspection and monitoring tasks at run-time.