In this paper, we propose a modular approach to implement the zero-trust principles in a 5G network. As more and more critical applications take advantage of 5G features, such as industrial controls and remote manufacturing, zero trust security approach is a valid solution to harden the defense of a potentially extended attack surface in 5G interconnected critical systems. The Cybersecurity and Infrastructure Security Agency (CISA) provides a Zero Trust Maturity Model that is based on five different pillars (user, device, network, application and workload/data) and we argue that we can exploit the service-based architecture of the 5G core to implement each of these pillars incrementally as additional services of 5G networks. Specifically, we propose additional network functions (NFs) in the 5G core to implement the CISA recommendations, namely User-Identity Management System (UIMS), User Authentication System (UAS), Access Authorization System (AAS), Endpoint Detection and Response System (EDRS), User-Behavior Analysis Function (UBAF), Security Assessment Report Generator (SARG). We take advantage of the Packet processing at user level (UPF) to provide an holistic packet processing to decide and enforce controls for each new and existing connection towards critical resources. Aware of limited resources for each traffic analysis, we leverage a risk-based prioritization of network traffic flows to enforce zero trust access controls to critical asset and resources.

This paper addresses the challenges of delivering fine-grained Quality of Service (QoS) and communication determinism over 5G wireless networks for real-time and autonomous needs of Industrial Internet of Things (IIoT) applications while effectively sharing network resources. Specifically, this work presents DANSM, a software-defined, dynamic and autonomous network slice management middleware for 5G-based IIoT use cases, such as adaptive robotic repair. The novelty of our approach lies in (1) the use of multiple M/M/1 queues to formulate a 5G network resource scheduling optimization problem comprising service-level and system-level objectives; (2) the design of a heuristics-based solution to overcome the NP-hard properties of this optimization problem, and (3) the implementation of a software-defined solution that incorporates the heuristics to dynamically and autonomously provision and manage 5G network slices that deliver predictable communications to IIoT use cases. Empirical studies evaluating DANSM on our testbed comprising a Free5GC-based core and UERANSIM-based simulations reveal that the software-defined DANSM solution can efficiently balance the traffic load in the data plane thereby reducing the end-to-end response time and improve the service performance by completing 34% more subtasks than a Modified Greedy Algorithm (MGA), 64% more subtasks than First Fit Descending (FFD) and 22% more subtasks than Best Fit Descending (BFD) approaches all while minimizing operational costs.

Protecting data-in-use from privileged attackers is challenging. New CPU extensions (notably: Intel SGX) and cryptographic techniques (specifically: Homomorphic Encryption) can guarantee privacy even in untrusted third-party systems. HE allows sensitive processing on ciphered data. However, it is affected by i) a dramatic ciphertext expansion making HE unusable when bandwidth is narrow, ii) unverifiable conditional variables requiring off-premises support. Intel SGX allows sensitive processing in a secure enclave. Unfortunately, it is i) strictly bonded to the hosting server making SGX unusable when the live migration of cloud VMs/Containers is desirable, ii) limited in terms of usable memory, which is in contrast with resource-consuming data processing. In this article, we propose the VIrtual Secure Enclave (VISE), an approach that effectively combines the two aforementioned techniques, to overcome their limitations and ultimately make them usable in a typical cloud setup. VISE moves the execution of sensitive HE primitives (e.g., encryption) to the cloud in a remotely attested SGX enclave, and then performs sensitive processing on HE data-outside the enclave-leveraging all the memory resources available. We demonstrate that VISE meets the challenging security and performance requirements of a substantial application in the Industrial Control Systems domain. Our experiments prove the practicability of the proposed solution.

Availability of the interconnection network in high-performance computing (HPC) systems is fundamental to sustaining the continuous execution of applications at scale. When failures occur, interconnect recovery mechanisms orchestrate complex operations to recover network connectivity between the nodes. As the scale and design complexity of HPC systems increase, so does the system's susceptibility to failures during execution of interconnect-recovery procedures. This study characterizes the recovery procedures of the Gemini interconnect network, the largest Gemini network built by Cray, on Blue Waters, a 13.3 petaflop supercomputer at the National Center for Supercomputing Applications (NCSA). We propose a propagation model that captures interconnect failures and recovery procedures to help understand types of failures and their propagation in both the system and applications during recovery. The measurements show that recovery procedures occur very frequently and that the unsuccessful execution of recovery procedures, when additional failures occur during recovery, causes system-wide outages (SWOs, 28 out of 101) and application failures (3.4 percent of all running applications).

Electronic Health Records (EHR) are digital documents containing citizen medical information that can be used for advanced eHealth services, like emergency patient summary retrieving, historical data and events analysis, remote medical report access, e-Prescription. In this work we present the case study of an EHR management infrastructure, namely the InFSE, which implements a federated network of regional autonomous districts deployed on national scale. Despite the adoption of access control mechanisms based on authenticated transactions and assertions, the InFSE can be illegitimately used to retrieve patient health data and violate the citizen's privacy. We propose an enhanced Security Information and Event Management (SIEM) system, namely MASSIF, which is able to discover business logic anomalies and protect the identities of involved parties. In particular we focus on the software modules that perform sophisticated data aggregation and analysis, and provide fault and intrusion tolerant storage facilities, namely the Generic Event Translator, the Security Probes and the Trustworthy Event Storage. The components have been integrated on the widely used open source OSSIM SIEM and validated on a realistic test bed based on elements of the InFSE infrastructure.

In the era of the global economy the container shipping represents a fundamental link of the logistic chain of the multimodal transport. The optimization of the cargo handling and, generally, of the port operations becomes a challenge for improving the performance of the whole supply chain. The adoption of Information and Communication Technologies can largely support operations management in a container terminal. On the other hand, the terroristic threats have dramatically increased the need for protecting critical infrastructures like ports, railway stations, airports. In this paper we describe the case study of the SIS-TEMA project which aims at designing a secure integrated framework for management of port operations. An architecture which guarantees both the efficiency of terminal operations and the security of the overall critical infrastructure is presented.

The heterogeneity and complexity of modern networks and services urge the requirement for flexible and scalable security systems, which can be dynamically configured to suit the everchanging nature of security threats and user behavior patterns. In this paper we present a distributed architecture for an Intrusion Detection System, allowing for traffic analysis at different granularity levels, performed by using the best available techniques. Such architecture leverages the principle of separation of concerns, and hence proposes to build up a system comprising entities specialized in performing different tasks, appropriately orchestrated by a broker entity playing the crucial role of the mediator. This paper stresses the point that a distributed system, besides being inherently more scalable than a centralized one, allows for better detection capabilities thanks to the effective exploitation of the inner heterogeneity of the involved detection engines. In order to support our findings, we will describe the design, implementation and deployment of the proposed solution in the framework of the INTERSECTION FP7 European Project.