Okwuibe, Liyanage, Ahmad, and Ylianttila
390
Furthermore, inconsistent or irreconcilable ingress/egress firewall security policies
among roaming partners can equally prevent some roaming traffic bound for the
Internet from working correctly, if at all they happen to work. This is particularly important in 5G scenarios, where local breakouts will be much more prevalent. These local
break‐out scenarios will cause roaming IP traffic to be routed over a visited network,
where firewall security policies will very likely differ from the same policies deployed in
the home network. The reasons motivating the need for local break‐out scenarios in 5G
are due to the need to reduce latencies and the planned deployment of wireless functionality together with subscriber content at the edge of the network, such as in MEC.
16.5.4 VM Manipulation
This attack is typical for all virtualized and edge computing systems. In MEC, VM
manipulation mainly affects the virtualization infrastructures [38].The adversary in
VM manipulation is mostly a malicious insider with enough privileges or a VM that
has escalated privileges
8
. Such adversary tends to launch multiple attacks to the VMs
running inside it.
VM manipulation opens up the affected VMs to numerous other potential attacks such
as logic bombs, malware and other such malicious elements that could com promise the
security of other data centers when such VM migrates to other physical location on
the network [38]. In [42], authors present an attack called DKSM (Direct Kernel Structure
Manipulation), which can effectively alter the existing VM introspection solutions into
providing false information. VM introspection is a specialized technique for determining
specific aspects of a guest VM execution from outside the VM; however, with DKSM
attack, the VM introspection solution gets subverted.
16.5.5 Privacy Leakage
Illegitimate access to the MEC environment by an adversary could compromise the
privacy of certain information on both the network and the service infrastructures. On
the network infrastructure, the MEC paradigm limits the scope of privacy leakage
through some specialized functions at the edge data center. The data center mainly
stores information from local entities and is also able to extract more sensitive information regarding the user through context awareness; hence, it will be possible to detect a
malicious adversary on the network edge [38].
On the service infrastructure, the possibilities of adversaries accessing the information stored at the upper layer of the edge infrastructure could warrant substantial
concerns for privacy leakage. However, similar to the case of network infrastructure, the
potential damage of such a privacy breach is limited by the amount of information
the adversary is able to gain access to. Typically, edge data centers allow for bypass of the
central system and the exchange of information directly with each other, hence when
information is processed at the lower layer, there are chances that the upper layer would
only receive a subset of the processed information, thereby limiting the information
made available to potential adversaries [38].
8 Privilege escalation happens when a malicious VM takes control of certain elements of the host.
390
Furthermore, inconsistent or irreconcilable ingress/egress firewall security policies
among roaming partners can equally prevent some roaming traffic bound for the
Internet from working correctly, if at all they happen to work. This is particularly important in 5G scenarios, where local breakouts will be much more prevalent. These local
break‐out scenarios will cause roaming IP traffic to be routed over a visited network,
where firewall security policies will very likely differ from the same policies deployed in
the home network. The reasons motivating the need for local break‐out scenarios in 5G
are due to the need to reduce latencies and the planned deployment of wireless functionality together with subscriber content at the edge of the network, such as in MEC.
16.5.4 VM Manipulation
This attack is typical for all virtualized and edge computing systems. In MEC, VM
manipulation mainly affects the virtualization infrastructures [38].The adversary in
VM manipulation is mostly a malicious insider with enough privileges or a VM that
has escalated privileges
8
. Such adversary tends to launch multiple attacks to the VMs
running inside it.
VM manipulation opens up the affected VMs to numerous other potential attacks such
as logic bombs, malware and other such malicious elements that could com promise the
security of other data centers when such VM migrates to other physical location on
the network [38]. In [42], authors present an attack called DKSM (Direct Kernel Structure
Manipulation), which can effectively alter the existing VM introspection solutions into
providing false information. VM introspection is a specialized technique for determining
specific aspects of a guest VM execution from outside the VM; however, with DKSM
attack, the VM introspection solution gets subverted.
16.5.5 Privacy Leakage
Illegitimate access to the MEC environment by an adversary could compromise the
privacy of certain information on both the network and the service infrastructures. On
the network infrastructure, the MEC paradigm limits the scope of privacy leakage
through some specialized functions at the edge data center. The data center mainly
stores information from local entities and is also able to extract more sensitive information regarding the user through context awareness; hence, it will be possible to detect a
malicious adversary on the network edge [38].
On the service infrastructure, the possibilities of adversaries accessing the information stored at the upper layer of the edge infrastructure could warrant substantial
concerns for privacy leakage. However, similar to the case of network infrastructure, the
potential damage of such a privacy breach is limited by the amount of information
the adversary is able to gain access to. Typically, edge data centers allow for bypass of the
central system and the exchange of information directly with each other, hence when
information is processed at the lower layer, there are chances that the upper layer would
only receive a subset of the processed information, thereby limiting the information
made available to potential adversaries [38].
8 Privilege escalation happens when a malicious VM takes control of certain elements of the host.