Versions Compared

Old Version 12

changes.mady.by.user Ta Chen

Saved on

compared with

New Version 13

changes.mady.by.user Rajesh Krishnan

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

What is KubeArmor? KubeArmor is a runtime security enforcement system that restricts the behavior (such as process execution, file access, and networking operations) of pods, containers, and nodes (VMs) at the system level. KubeArmor leverages Linux security modules (LSMs) such as AppArmor, SELinux, or BPF-LSM to enforce user-specified policies. KubeArmor generates rich alerts/telemetry events with container/pod/namespace identities by leveraging eBPF.

The intention is to use SEDIMENT as a containerized application for which KubeArmor will provide Our objective is to demonstrate the 5G SBP Use Case - Remote Attestation Use Case 1- IoT Device Security and Authentication, where SEDIMENT RA Verifier and an example Relying Party application are containerized and deployed with KubeArmor providing visibility and protection policies. Initially the result of attestation is to used to control access to the example application.  In the future this may be a third parry application or may be used to control network access through integration with the 5G ONAP AMF.  The onboarding of the device to be attested is outside the purview of this use case, and a separate use case will address that concern.

Architecture Topology

** XXX: integrate both diagrams into a single view **

Note: In Phase 1, we will target only the Gateway security and not work on the device side of things.

Systems Requirements

** XXX: state this for verifier, app server, and device separately **

OS Distribution: Ubuntu >= 18.04

...

Network: The following TCP ports needs to be open for the corresponding containers, Relying Party: 8000 and 8101, Verifier: 8100, Application Server: 8001. Browser based GUIs for Application Server and Verifier are hosted elsewhere on the container host or other PC(s).

** XXX: use open-source tools such as drawio and include sources if possible **

External Access: ssh access to the node would be required

...

Deployment Mode

SEDIMENT Deployment Mode

** XXX: discuss each of the three parties **

  • Containerized app deployed using docker container

...