Salo and Liyanage
410
Security needs to be everywhere within SDN. It needs to be built into the architecture, as well as delivered as a service to protect the availability, integrity and privacy of
all connected resources and information [31].
17.4.4 Summary of Security and Privacy Issues in the Context
of Technologies under Study (Clouds, NFV, SDN)
The future networks are a part of the critical information infrastructure, and it has
to be ensured that they meet the requirements set for such infrastructures. It is
clear that Security and Privacy will be of utmost importance for the critical infrastructures, and certainly they are among the key aspects to pay attention to when
designing the new mobile network concepts and exploiting the related new
technologies.
From the previous sections, we can conclude that the new mobile network concepts
will open up numerous new Security and Privacy challenges. Those challenges, or
issues, which are assumed to be the most relevant from the regulatory actions point of
view, have been listed here for the further analysis. The focus is on the issues that can
be resolved by the mutual agreements by the involved parties, or the intervention of the
Regulatory Authority. Such issues, which are purely technical in nature, have been left
out of the discussion.
Many of the issues listed here originate from the issues identified in the context of the
Clouds concepts. However, they are also relevant to other concepts, as the implementation of those concepts are very much exploiting the clouds technologies.
Security and Privacy issues, which are assumed to be the most relevant in the context
of regulation work in 5G networks, are listed below. Their importance against the regulatory objectives is further assessed in Section 17.4.4:
A) Responsibility ambiguity: Different user roles, such as Cloud Service Provider, cloud
service user, client IT admin and data owner, may be defined. Ambiguity of such
roles and responsibilities may induce business or legal dissension.
Very similar to Responsibility ambiguity is Data ownership. The organization’s
ownership rights over the data must be firmly established in the service contract
to enable a basis for the trust and privacy of data. The Cloud Service Provider
shall not be able to acquire and may not claim any interest in the data due to
security.
B) Bylaw conflict/Location of legal disputes: Depending on the bylaw of the hosting
country, data may be protected by different applicable jurisdiction. There are at
least three possible locations to choose from: that of the victim; that of the offender;
or that of the Service Provider:
1) Location of sensitive asset/information;
2) lack of physical control for data storage; and
3) reliability of data backup.
C) Shared environment: The resources are virtualized and different Cloud Service
Users (including MVNOs) – possibly competitors – share the same infrastructure.
Any unauthorized and violent access to sensitive data may compromise both the
integrity and confidentiality.
410
Security needs to be everywhere within SDN. It needs to be built into the architecture, as well as delivered as a service to protect the availability, integrity and privacy of
all connected resources and information [31].
17.4.4 Summary of Security and Privacy Issues in the Context
of Technologies under Study (Clouds, NFV, SDN)
The future networks are a part of the critical information infrastructure, and it has
to be ensured that they meet the requirements set for such infrastructures. It is
clear that Security and Privacy will be of utmost importance for the critical infrastructures, and certainly they are among the key aspects to pay attention to when
designing the new mobile network concepts and exploiting the related new
technologies.
From the previous sections, we can conclude that the new mobile network concepts
will open up numerous new Security and Privacy challenges. Those challenges, or
issues, which are assumed to be the most relevant from the regulatory actions point of
view, have been listed here for the further analysis. The focus is on the issues that can
be resolved by the mutual agreements by the involved parties, or the intervention of the
Regulatory Authority. Such issues, which are purely technical in nature, have been left
out of the discussion.
Many of the issues listed here originate from the issues identified in the context of the
Clouds concepts. However, they are also relevant to other concepts, as the implementation of those concepts are very much exploiting the clouds technologies.
Security and Privacy issues, which are assumed to be the most relevant in the context
of regulation work in 5G networks, are listed below. Their importance against the regulatory objectives is further assessed in Section 17.4.4:
A) Responsibility ambiguity: Different user roles, such as Cloud Service Provider, cloud
service user, client IT admin and data owner, may be defined. Ambiguity of such
roles and responsibilities may induce business or legal dissension.
Very similar to Responsibility ambiguity is Data ownership. The organization’s
ownership rights over the data must be firmly established in the service contract
to enable a basis for the trust and privacy of data. The Cloud Service Provider
shall not be able to acquire and may not claim any interest in the data due to
security.
B) Bylaw conflict/Location of legal disputes: Depending on the bylaw of the hosting
country, data may be protected by different applicable jurisdiction. There are at
least three possible locations to choose from: that of the victim; that of the offender;
or that of the Service Provider:
1) Location of sensitive asset/information;
2) lack of physical control for data storage; and
3) reliability of data backup.
C) Shared environment: The resources are virtualized and different Cloud Service
Users (including MVNOs) – possibly competitors – share the same infrastructure.
Any unauthorized and violent access to sensitive data may compromise both the
integrity and confidentiality.