Abstract:With the emergence of cloud native technology, the network slicing enables automatic service orchestration, flexible network scheduling and scalable network resource allocation, which profoundly affects the traditional security solution. Security is regarded as a technology independent of the cloud native architecture in the initial design, traditional passive defense such as “reinforced” and “stacked” is relied on to achieve system security protection. The lack of intrinsic security mechanisms makes the system capability insufficient when faces the uncertain threat brought by vulnerabilities and backdoors under the ecosystem of opening-up and sharing. The static nature of existing networks and computing systems makes them easy to be compromised and hard to defend, and thus it is urgent to provide intrinsic security and proactive protection against the unpredictable attacks. To this end, this paper proposes a novel paradigm named intrinsic cloud security (iCS) from the perspective of dynamic defense. The dynamic defense provides component-level security, and has complementary and consistency with the cloud native environment. In particular, iCS introduces mimic defense and moving target defense (MTD), and makes full use of the new features introduced by cloud native to implement an intrinsic and proactive defense mechanism with acceptable costs and efficiency. The iCS paradigm achieves seamless integration and symbiosis evolution between security and cloud native. We implement a trial of iCS based on 5GC commercial system and evaluate its performance on costs, efficiency and attack success. The result shows that the iCS enhanced mode always can provide a better and more stable defense effects.

Security Protection Architecture for Power Enterprise Information Integration Based on Technology of Distributed Intrusion Tolerance with Multi-Level Defense Line

Construction of security architecture of web services based EAI

Insights on Cooperative Defense for Multiple Industrial Security Technologies

Network Safeguard System Based on IDXP

Intrinsic Security and Self-Adaptive Cooperative Protection Enabling Cloud Native Network Slicing

Intrinsic Security: A Robust Framework for Cloud-Native Network Slicing via a Proactive Defense Paradigm

Study on Network Security Architecture for Power Systems

Integrated Database Security Architecture Based on Intrusion-Tolerance

Architecture for Database Security Based of Multi-layer Intrusion-tolerance

Research on the Security Defense Architecture of the Closed-source Power Industrial Control System

Construction of the Secure Enterprise Network Based on Multi-layer Protection

A Novel Architecture for Enterprise Network Security

A Distributed and Autonomous Guard System Based on Cloud Environments

Research on Key Technology of Industrial Network Boundary Protection based on Endogenous Security

Dual-structural network of active defense

Application Level Network Access Control System Based on TNC Architecture for Enterprise Network

Research on risk prevention and control strategy of power grid CPS system based on intrusion tolerance

Survey on Intrusion Detection Techniques

Agent-Based Intrusion Detection System for Integration.

A Data-Driven Based Security Situational Awareness Framework for Power Systems

Design and Implementation of Enterprise Network Security System Based on Firewall