Hybrid moving-target and deception defence system

Abstract

Proposed is a security module suitable for operating on a system comprising a set of resources, the system being suitable for managing at least one service in a cloud computing environment, the system being suitable for implementing cloning operations, a cloning operation involving a source resource contributing to the at least one service before the cloning operation and a target resource contributing to the at least one service at the end of the cloning operation as a replacement for the source resource, the module being configured to clone a resource from the set in accordance with a delay representative of an estimated vulnerability of the resource.

Description

Deceptive, moving, and hybrid defense system

[0001] The present disclosure relates to the field of computer system security. More specifically, it relates to a security module, as well as a corresponding method, computer program and recording medium.

[0002] The state of the art includes systems that use containerization technologies, such as "Docker" (trademark), and container orchestration technologies, such as "Kubernetes" (trademark).

[0003] These systems are designed to deploy applications and services on data processing agglomerations, or "clusters", by distributing them across multiple working environments, or "clouds".

[0004] In this context, there is a continuing need for security features that can prevent cyber attacks, confuse and deter attackers. Summary

[0005] This disclosure improves the situation.

[0006] A security module is provided for operating on a system comprising a set of resources, the system being adapted to manage at least one service in a cloud computing environment, the system being adapted to implement cloning operations, a cloning operation involving a source resource contributing to the at least one service before the cloning operation and a target resource contributing to the at least one service at the end of the cloning operation, replacing said source resource, the module being configured to perform a cloning of a resource of the set in accordance with a time limit representative of an estimated vulnerability of said resource.

[0007] According to another aspect, there is provided a method implemented by a security module adapted to operate on a system comprising a set of resources, the system being adapted to manage at least one service in a cloud computing environment, the system being adapted to implement cloning operations, a cloning operation involving a source resource contributing to the at least one service before the cloning operation and a target resource contributing to the at least one service at the end of the cloning operation, replacing said source resource, the method comprising: performing a cloning of a resource of the set in accordance with a time period representative of an estimated vulnerability of said resource.

[0008] According to another aspect, there is provided a computer program comprising instructions for implementing all or part of a method as defined herein when this program is executed by a processor. According to another aspect, there is provided a non-transitory, computer-readable recording medium on which such a program is recorded.

[0009] By allowing the cloning of resources based on their estimated vulnerability, the proposed technique increases the difficulty for attackers to compromise services, as it constantly generates a new system configuration unknown to them.

[0010] The features set out in the following paragraphs may, optionally, be implemented, independently of each other or in combination with each other:

[0011] In one example, the delay is determined based on security information of the resource. This allows the responsiveness of the security module to be customized based on the current security level of each individual resource. The security module may collect security information from a plurality of resources and prioritize resources that require more immediate attention, adapting the cloning delay to the volatility of their security status.

[0012] Resource security information can be obtained in a variety of ways. For example, an a priori vulnerability assessment can be performed through a risk analysis based on intrinsic resource characteristics, such as its complexity, network exposure, or history of security breaches. Real-time system monitoring can capture operational data that could signal abnormal behavior or suspicious access attempts, which are often precursors to imminent malicious exploitation. Regular resource health measurements and configuration assessments, combined with machine learning-based estimates of security trends, provide a dynamic dashboard of security status.Finally, consulting a library of known vulnerabilities allows the current state of the resource to be compared with documented flaws and exploits, thus enabling known vulnerabilities to be identified and responded to more effectively.

[0013] In one example, the timeframe is also representative of the criticality of the service. This allows for adapting protective measures based on the importance of the service, thus ensuring optimal allocation of resources available for IT security purposes. For example, the timeframe before cloning could be shortened for a bank's online payment processing service compared to a video streaming service, reflecting the difference in criticality of the services concerned.

[0014] In one example, the delay is determined based on a resource environment parameter. This ensures increased responsiveness to changes in the operational environment or new threats. For example, if a resource operates in a functional and / or geographic environment with a high rate of intrusion attempts, the delay before the next cloning from that resource may be reduced to respond quickly to the evolving threat.

[0015] In one example, the security module is configured to clone the resource before the timeout expires in response to a detection of a triggering event related to a security risk regarding the resource. This increases the resilience of the system by enabling proactive action against emerging security risks. For example, upon detection of suspicious network traffic indicating a possible attack, the resource may be cloned immediately, thereby reducing the window of opportunity for the attack to succeed.

[0016] In one example, the target resource is chosen upon timeout from a plurality of previously identified candidate resources. This improves service continuity by having predefined recovery options, which speeds recovery from an attack. For example, after an attack that compromises a resource, it may be planned to quickly failover to an already identified clone, minimizing service downtime. This also allows for a deceptive strategy to be implemented by creating decoys.

[0017] Other features, details and advantages will become apparent upon reading the detailed description below, and upon analyzing the attached drawings, in which: Fig. 1

[0018] is a flowchart representing an algorithm of a computer program suitable for implementing a moving defense strategy according to one embodiment. Fig. 2

[0019] shows a clustered computing architecture following a cloning operation implemented by applying a moving defense strategy with the use of decoys according to one embodiment. Fig. 3

[0020] shows a series of exchanges implemented before and during a cloning procedure implemented by applying a moving defense strategy according to one embodiment.

[0021] In the following description, like reference numerals designate identical elements or elements having similar functions.

[0022] The present disclosure relates to a technique for supporting a system comprising a set of resources, such system being further adapted to manage one or more services deployed in a cloud computing environment, specifically in telecommunications systems.

[0023] It should be noted as a preamble that the term "service" is used in this document in a general way to encompass a service itself, one or more microservices, or even a complete application. An "application" is understood to mean a set of software functionalities that meet a specific need. An application may be composed of one or more services or microservices that work together to provide the overall functionality. It should be noted that the distinction between a "service" and a "microservice" is mainly based on the scale and functional division of an application's software architecture. A service is a self-contained functional unit that can cover a broad set of functionalities and can either form part of a larger application or be used by several applications.A microservice is smaller in terms of resources and is usually responsible for a specific functionality of an application.

[0024] The management of said service(s) is carried out in particular by the implementation, by the system, of cloning operations in order to replicate configurations supporting said service(s).

[0025] For reference, examples of suitable cloning systems are detailed in the prior art techniques. Such cloning systems include, among other things, a manager, an orchestrator, and, optionally, a virtual service configured as a routing device.

[0026] The manager plays a key role in triggering the cloning process of a configuration supporting a service. It is able to detect a triggering event resulting from the application of a service management policy. Following the detection of this event, the manager defines one or more constraints associated with the event and sends cloning instructions to the orchestrator.

[0027] The orchestrator, in the cloud computing environment, is designed to receive from the manager one or more cloning instructions and said one or more constraints. The orchestrator is also capable of collecting one or more information on the use of individual resources from various data processing agglomerations. This or these information are obtained with sufficient granularity to allow a detailed analysis of the use of each individual resource. The interpretation of the instruction(s) by the orchestrator allows it to designate one or more resources defining an initial deployment of a service within an initial communication infrastructure (or initial working environment).Taking into account the cloning instruction(s), the received constraint, and the gathered information(s), the orchestrator can then identify one or more target resources in the same communication infrastructure, possibly in the same cluster, or in at least one new communication infrastructure. This allows cloning of the designated resource(s), thus facilitating a new deployment of the service that meets the specified constraint(s).

[0028] The virtual service configured as a routing device can be configured to redirect, after a cloning operation, all or part of the network traffic from the initial deployment of the affected service to the new deployment, transparently for the orchestrator and the manager. This allows for a smooth and efficient transition between the initial deployment and the new deployment, thus contributing to service continuity.

[0029] In the context of the present technique, cloning is part of a migration process, involving not only a new deployment of a service, but also a temporary or permanent deletion or deactivation of the initial deployment of the service, so as, for example, to ensure continuity of service in anticipation of maintenance involving taking a server offline.

[0030] One aspect of the technique proposed in this document is a security module adapted to operate on a computer system comprising a set of resources, including a resource called a "source resource" contributing to at least one service before the cloning operation and a resource called a "target resource" contributing to the at least one service at the end of the cloning operation, replacing the source resource.

[0031] Any suitable hardware and / or software means may be used for the practical implementation of the security module. Generally, although aspects of the proposed technique may be described in this document as a process, a device, a system, a procedure or a method, it should be noted that the proposed technique may also cover a computer memory capable of being connected to a processor possibly connected to a communication interface, the memory storing instructions which, when executed by such a processor, make it possible to carry out the processes, devices, systems, procedures or methods described in this document.

[0032] It is understood that, in the context of assisting a cloning operation, the security module may be integrated with the cloning system described above and / or may be configured to communicate with the cloning system in such a way as to facilitate the identification by the orchestrator of one or more target resources.

[0033] Some terms specific to computer systems and cloud computing environments are now clarified for a better understanding of the proposed technique.

[0034] The term "computer system" refers, in the context of this document, to a physical and / or software medium that enables communication and sharing of resources and services in the cloud computing environment. This system may refer to a communication infrastructure or one or more of its subparts, including data processing and storage systems, servers and networks, data centers, cloud systems, telecommunications equipment, etc. This system may refer to the communication infrastructure within a specific organization, such as an internal network of computers and servers, or to a broader infrastructure, such as a telecommunications network or the cloud. The proposed technique is applicable to any type of computer system and any type of network architecture.

[0035] A computer system comprises a set of resources that can be reserved for the purpose of operating one or more services. This set of resources may include resources of various types, in particular computing times at the level of one or more processors, locations of one or more memories, or even usage slots, expressed for example in time and / or frequency, of one or more communication channels.

[0036] An IT system can be extended across multiple sites and benefit from the efficiency of a multi-site architecture. Such architectures are well established and allow for increased robustness and resource management across the entire IT system. Distributed edge architectures, i.e., at the periphery of a network or system, represent a further development that is particularly relevant for telecommunications systems such as Cloud-RAN where they are currently being deployed.

[0037] Cloud computing environments rely on one or more computer systems as defined above. In particular, cloning systems may be combined with, include, or be integrated with one or more computer systems as defined above.

[0038] In cloud computing environments, the basic hosting unit is often called a "container." These containers are lightweight software units that encapsulate the code and all its dependencies, allowing an application to run reliably from one computing environment to another.

[0039] To manage these containers, a solution called "Kubernetes" (registered trademark), K8S, is frequently used. "Kubernetes" (registered trademark) is a system that facilitates the deployment, scaling, and management of containerized applications.

[0040] In the "Kubernetes" (trademark) architecture, containers are grouped into "pods," which are the basic unit representing an application deployment. Multiple pods can be grouped into a "node," which symbolizes a server. The definition of "node" in the "Kubernetes" (trademark) architecture corresponds to that of "node" in the NUMA (non-uniform memory access) system. These nodes are then grouped into "clusters," which are sets of servers that work together and can be thought of as a single system.

[0041] In the context of "Kubernetes" (registered trademark), a cluster consists of a group of "Masters" and Nodes. Masters are the components of the "Kubernetes" (registered trademark) cluster that provide the control interface for the cluster, and manage pod scheduling, failure detection and management, and deployment of new versions of applications. Nodes, on the other hand, are the servers that run the applications and provide the runtime environment for the containers.

[0042] To manage network communications between containers in an application deployed on a Kubernetes (trademark) cluster, proxy-like sidecar containers are attached to each of the application's main containers. Sidecar proxies are responsible for intercepting and managing network communications. Each sidecar proxy acts as an intermediary between the main container to which it is attached and the rest of the network. To enhance security, sidecar proxies can include functions such as request and response validation, authorization and identity management, and monitoring.

[0043] ISTIO (https: / istio.io / ) is an example of an open source service mesh, commonly used by networking and security operators for running distributed microservices-based applications, and provides a uniform way to connect, manage, and secure these microservices using sidecar proxies.

[0044] The proposed technique relates to the implementation of cloning operations, for example by a cloning system as described above. A described cloning operation modifies the arrangement of the resources that support the services or micro-services by transforming them. For this purpose, it is possible, for example, to define an initial state of the computer system at an initial time before an implementation of a cloning operation relating to a service and a final state of the computer system at a final time after the implementation of the cloning operation. At the initial time, the computer system is configured such that one or more resources from the set of resources intervene for an initial deployment of the service, this or these resources are referred to as source resources.At the final moment, the computer system is configured in such a way that one or more resources from the set of resources, different from and replacing the source resource(s), intervene for a new deployment of the service, this or these resources are qualified as target resources or destination resources.

[0045] The proposed technique is particularly suited to microservice architectures, such as containers and virtual network functions. These are commonly used in telecommunications systems and cloud-based computing environments. Cloning operations, at the heart of the proposed technique, offer security benefits for critical applications. They change the topology of systems, forming part of a moving defense strategy. In addition, they allow duplication or creation of redundant copies of certain service deployments, which helps improve the overall performance of these services.

[0046] Selecting the target resource from the available set of resources can advantageously rely on the recognition and dynamic management of elements such as container groups or pods, sets of servers or clusters, and the applications themselves. Scenarios benefiting from efficient management of the "Kubernetes" (registered trademark) environment are particularly suitable. This efficient management can include managing permissions through a role-based access control (RBAC) system, ensuring the security of container images, and the use of virtual clusters backed by a single physical cluster, or "namespaces" in English, to isolate different clients.In summary, the selection of a target resource intended to contribute to a new deployment of a service following a cloning operation to replace a source resource can take into account several factors, such as the type of actors involved, the category of customers, the chain of micro-services concerned, as well as the technical and functional aspects related to hosting.

[0047] The deployment of services and data, facilitated by cloning operations, can efficiently scale across various clusters in multiple clouds. This distribution strategy can encompass different geographical tiers, from the centralized cloud to more decentralized tiers such as fog, edge, and far edge, and can differentiate resources from various cloud providers, enabling flexible and efficient resource management. This versatility can be aligned with a quality of service policy based on the specific needs of the deployed services and designed to ensure optimal load distribution and better service continuity in scalable architectures.

[0048] By way of illustration, patent application FR2306267 provides a procedure for identifying destination resources for implementing cloning according to a resource-aware policy. Patent application FR2310610 further provides a procedure for taking into account the affinity between processes and data for determining within the resource set one or more appropriate destination resources from a larger set of potential resources. The procedures detailed in these patent applications are oriented towards performance research.

[0049] However, these patent applications do not disclose any specific computer security strategy.

[0050] Meanwhile, CHO, JH et al. Toward Proactive, Adaptive Defense: A Survey on Moving Target Defense. IEEE Communications Surveys & Tutorials, 22, 2019, pages 709-745 presents, in a context of proliferation of cyberattacks, a set of proactive and adaptive defense solutions to confuse, discourage attackers and prevent attacks. These solutions fall under the general concept of moving target defense (MTD).

[0051] Cyberattacks that can target computer systems in cloud computing environments vary in nature. Common types of cyberattacks include distributed denial of service (DDoS) attacks and intrusion attempts through various means. Some cyberattacks can be particularly sophisticated, particularly advanced persistent threats (APTs).

[0052] It appears particularly advantageous to implement a proactive and adaptive system of moving defense based on cloning capabilities in the context of IT systems in cloud computing environments.

[0053] For this purpose, a security module is provided, configured to trigger, initiate, control, schedule or perform a cloning operation of a resource from the set of resources of such a computer system. The security module is guided in this task by a time delay calculated, determined, estimated, chosen or obtained based on an estimated vulnerability of the resource.

[0054] The "vulnerability" of a resource can be understood as its susceptibility to being compromised or negatively affected. This vulnerability can manifest itself in different ways, such as the ease with which a service can be hijacked, the likelihood of detection by attackers, or the ease of location and access by unauthorized parties.

[0055] The “estimated vulnerability” of a resource is defined based on one or more attributes relating to a potential or estimated effort to compromise or affect damage to that resource. The number of these attributes is arbitrary. One or more of these attributes may, for example, contribute to defining a signature of the resource or the service to which it contributes, such as a number of active sessions, a rate of utilization in terms of load and / or memory, a type and volume of data processed, or a frequency of interactions with other nodes or services.

[0056] These various attributes, each of which captures a specific aspect of a resource's vulnerability, can be grouped into a general quantitative metric called "attack surface." A resource's attack surface can thus be defined as representative of all untrusted entry points, channels, and data elements—in other words, the amount of opportunities that attackers can exploit to compromise or negatively affect the resource.

[0057] In practice, the attack surface of a resource can be calculated by assigning numerical values ​​to the attributes of the service or resource, based on knowledge of the system and its environment in terms of clusters, proxies, nodes, or pods. Examples include, but are not limited to, a number of clients using the service, a number of physical resources involved, such as pods, proxies, nodes, or clusters, a number of data flows or inter-node messages involved, a degree of criticality of these physical resources, data flows, or inter-node messages, or a degree of ease of access to these physical resources or ease of interception of these data flows or inter-node messages.

[0058] By extension, the attack surface of a service can be calculated based on the attack surfaces of each of the resources contributing to the service.

[0059] Reducing a resource's attack surface means reducing the likelihood of attackers detecting the resource by acting on one or more controllable parameters. Among these parameters, one of the simplest to control is the presence or location time, defined as the duration between the assignment of a source resource to a service before the cloning operation and the assignment of a target resource to this service after the cloning operation, replacing the source resource.

[0060] A central aspect of the proposed technique is based on the use of the estimated vulnerability or attack surface as an indicator to set a delay indicating the optimal moment to trigger a cloning operation. This delay can be chosen according to the identified risks and the need to maintain the continuity and efficiency of the services concerned. The value chosen for the delay is determined, calculated or chosen in a differentiated manner for each resource or for each service. For example, with reference to a particular resource or a particular service, the value chosen for the delay can be selected from a range of possible values ​​predefined according to the estimated vulnerability of this resource or this service. Each of the possible values ​​can for example be associated in advance, in a correspondence table, with a range of estimated vulnerabilities.

[0061] Determining the delay can be adaptive. It can be based on real-time monitoring, taking into account factors such as the frequency of attacks and the need to avoid involving a compromised parent node. It can also be based on information representative of an ability to respond to events. Cloning operations that are too frequent can impact the availability of services for users, hence the need for an optimal balance between a system security objective and a performance objective in terms of, for example, quality of service and / or experience.

[0062] The proposed technique can adopt a hybrid strategy for cybersecurity. Cloning operations can be implemented by default according to a periodic schedule, such as cloning all resources contributing to the deployment of one or more services at regular time intervals. In addition to periodic scheduling approaches, the technique can integrate non-periodic cloning operations to improve security. For example, cloning can be triggered randomly, at irregular intervals to reduce predictability. Another approach could be based on heuristic models or machine learning algorithms that determine the optimal time for cloning by analyzing complex security trends.These algorithms could take into account not only security events but also variable operational parameters, such as system load or resource availability, to optimize both security and system efficiency. Such periodic or non-periodic scheduling, also known as "IP shuffling," creates constant movement in the structure of the cloud environment, making it difficult for attackers to target and compromise specific nodes.

[0063] Independently of or in addition to the possibility of such periodic activation, cloning can also be triggered by indicators of compromise or predefined thresholds, where the system reacts automatically when a certain condition is met, thus adding an additional layer of adaptive response to constantly evolving threats. For example, cloning operations can be triggered event-driven, immediately or at short notice, in response to the detection of attacks or anomalies such as abnormal energy consumption or excessive inter-node messages.

[0064] In addition to setting a specific deadline for cloning, additional IT security strategies can be implemented. One potential strategy involves creating fake nodes in the pre-deployment phase, i.e., before the actual cloning operation is implemented. This deceptive strategy makes it possible to mask the true structure and activity of the network and thus mislead potential attackers.

[0065] Independently or in addition to this deceptive strategy based on fake nodes, cloning operations can also implement a simple reincarnation of nodes, i.e. the use of a single target node to replace a source node, corresponding to a form of redundancy, i.e. the use of several target nodes to replace a single source node. Redundancy contributes not only to performance improvement, but also to IT security by modifying the service signature.

[0066] In addition to cloning operations, another possible IT security strategy is the installation of a microservices network designed to be isolated from the rest of the physical infrastructure. This isolation is achieved through secure and exclusive communications within each group of containers or pods. To secure these communications, a known encryption and / or authentication method can be used, such as mTLS, or "Mutual Transport Layer Security."

[0067] Reference is made to the, which represents a possible example of an algorithm allowing the implementation of the proposed technique at the level of a cloning system adapted to implement cloning operations within one or more computer systems in a cloud computing environment.It is planned: a module 1 for defining and updating security policy (DEF POL SEC), a module 2 for deploying the security policy (DEPL POL SEC), a module 3 for preparing the infrastructure (PREP INFRA), a module 35 for managing situations where the security policy cannot be implemented (DEFT), a module 4 for identifying the resources necessary for the secure deployment of services (ID RES), a module 45 for applying the security policy (APPL POL SEC), a module 5 for real-time monitoring (SURV), a module 6 for updating topology information after cloning operations (MAJ TOPO), and a module 7 for updating service routing (MAJ INFO ROUT).

[0068] Security policy definition and update module 1 is configured to implement a security policy on a computer system, for example a telecommunications server. The security policy includes, at least, a moving defense mechanism that can be encompassed in a hybrid defensive strategy. This combines, for example, redundancy, by dispersing resources across multiple clusters and periodic reincarnation of nodes, to renew and protect the telecommunications network, or the creation of decoys adding a layer of complexity to the actual network structure. Faced with denial of service attacks, a proactive response may involve a periodic change of hosting cluster, such that for each cloning operation, the cluster comprising the source resource and the cluster comprising the target resource are not co-located.A reactive response could combine this inter-cluster reincarnation with the generation of decoy nodes in the initial cluster to confuse attackers. To counter intrusions, it is possible to implement the cloning of resources from a specifically affected cluster to other clusters. A deceptive approach can be coupled with this cloning in the event of intrusion detection across multiple clusters, creating a more complex environment that is harder for attackers to exploit. Higher-critical services, likely to be targeted by advanced persistent threats, can benefit from a strengthened proactive and reactive strategy.This strategy includes redundant distribution of resources across multiple clusters for isolation and instant response in the event of an incident, as well as performing cloning operations periodically and / or in response to specific events identified by continuous monitoring. Less sensitive services can rely on lightweight security, for example, avoiding the need to distribute resources across multiple clusters.

[0069] Arrow 'a' indicates a process of passing security policy directives from Module 1 to Security Policy Deployment Module 2 for implementation.

[0070] The functions of Module 2 can be performed centrally, for example by a manager or orchestrator of a cloning system. It collects metrics to monitor real-time activity within the IT system and defines security rules whose application triggers the determination of specific deadlines for cloning resources based on their respective estimated vulnerability. The determination of specific deadlines is carried out in a differentiated manner per service as well as per resource contributing to the service. The determination of specific deadlines by application of a security rule corresponding to the application of a reactive strategy also depends on the type of event detected.

[0071] Arrow 'b' represents communication between Module 2 and Module 3 for preparing the infrastructure, to ensure that the infrastructure is ready to apply the security policy.

[0072] Module 3 is configured to implement a mechanism for real-time collection of indicators to monitor the effectiveness of the security policy and / or its impact on other aspects such as the performance of deployed services, resource utilization rate or energy consumption.

[0073] The arrow 'c' represents a communication from module 3 to module 4, symbolizing a transfer of information necessary for identifying resources after preparing the infrastructure.

[0074] The arrow 'j' represents a communication from module 3 to module 35 indicating a situation where it is not possible to apply the security policy.

[0075] Module 4 for identifying the resources necessary for the secure deployment of the services may be configured to identify not only the initial resources, called source resources, which are currently in service, but also to designate the replacement resources, or target resources, as well as any decoy resources used in deceptive strategies by simulating false targets. Module 4 may be configured to identify, in addition to the resources as such (for example nodes, pods or clusters), other elements associated with them (for example DNS information) and involved in the topology changes resulting from the implementation of cloning operations.Module 4 may be configured to actively participate in security strategies involving topology modification actions, such as deleting, moving, or activating nodes, in order to respond flexibly, proactively, and / or reactively to various threat situations. For example, as part of a reactive strategy, if a denial-of-service attack or intrusion attempt is detected on a specific node, Module 4 is able to quickly determine whether the targeted node is a decoy or a genuine operational resource. If the targeted node is genuine, the module may be configured to initiate its secure deletion and activate a replacement resource, thereby maintaining service delivery while eliminating the point of vulnerability exploited by the attack.Module 4 may further be configured to identify target resources by taking into account a set of needs and constraints, for example using a joint optimization algorithm for these needs and constraints. These needs and constraints may relate, for example, to the operation of a service to which source resources contribute, to the joint operation of other services, to security requirements or to technical requirements of the IT infrastructure. The identification of target resources may include the implementation of geo-replication rules, by identifying target nodes in different geographical locations in the event of a node failure or compromise.

[0076] The arrow 'd' represents a communication from module 4 to module 45. This communication makes it possible to report to module 45 the resources previously identified by module 4 and thus to allow module 45 to implement the security policy by managing these resources previously identified by module 4. The arrow 'e' indicates an initiation of real-time monitoring relating to the resources previously identified by module 4 and managed by module 45.

[0077] The real-time monitoring module 5 is configured to implement monitoring, including for example obtaining measurements and / or an attack detection mechanism. It can be configured to allow immediate stopping of nodes affected by an attack, thus triggering their reincarnation without their participation, to minimize the impact on distributed applications. The module 5 can be configured to prevent an initially planned cloning operation in certain situations. For example, in a scenario where a resource contributing to the operation of a service is considered compromised, i.e. potentially controlled by a malicious third party, it can be planned to isolate this resource by preventing it from continuing its contribution to the operation of a service and not trigger the cloning of this resource to a target resource.In another example, a cloning operation that would cause excessive performance degradation may be delayed or canceled.

[0078] The arrow with the annotation "Nk" indicates a communication from module 5 to module 4 when real-time monitoring detects an event related to a security risk concerning the resource. This communication allows triggering, at module 4, a reconsideration of the resources necessary for the secure deployment of the services in view of the detected problem, potentially including a new identification of target resources and / or decoys for a future cloning operation.

[0079] The arrow 'f' with the annotation "Ok" going from module 5 to module 6, illustrates a procedure for cloning and triggering an update of the topology information following a successful real-time monitoring and not detecting any events related to a security risk concerning the resource.

[0080] Module 6 for updating topology information after cloning operations is configured to keep information about the current network configuration up to date, reflecting changes made by applying the security policy.

[0081] The 'g' arrow from module 6 to module 7 illustrates communication to ensure that any topology updates are reflected in the service routing update.

[0082] Service Routing Update Module 7 is configured to adapt routing to new server configurations and network topology.

[0083] The arrow 'h' with the annotation "Timer 4" going from Module 7 to Module 4 illustrates feedback after the routing update, confirming that target resources previously identified by Module 4 can be considered as new source resources following the performance of cloning operations.

[0084] The arrows 'j', 'g', and 'h' with the annotation "i, Timer 1", going from modules 35, 6, and 7 to module 1, respectively, represent feedback allowing a re-evaluation of the security policy by module 1.

[0085] Reference is now made to which schematically illustrates two "Kubernetes" (registered trademark) clusters 100, 200.

[0086] Each cluster consists of a control plane and several nodes.

[0087] The control plane 102, 202 is responsible for the management and coordination of the various elements of the cluster.

[0088] Specifically, the control plane includes controllers that are responsible for monitoring the cluster's state and performing actions to maintain, or achieve, the desired state. For example, there are controllers to manage deployments, services, replicas, and more. A controller manager is responsible for executing these controllers.

[0089] Other components of the control plane play specific roles.

[0090] An API Server is intended to expose the "Kubernetes" (trademark) API and serves as the main entry point for interacting with the cluster. A Load Balancer is used to distribute the load of incoming traffic to different services by distributing traffic between cluster nodes or between pods running on different nodes. A Scheduler is responsible for assigning pods to cluster nodes based on defined resource requirements, constraints, and policies. A database called ETCD stores the real-time state of the "Kubernetes" (trademark) cluster, including information about nodes, pods, services, configurations, etc. It makes this information readable and writable by all cluster components in real-time.

[0091] It is considered that at a given instant, the entire control plane of a given cluster, or at least one of its components, such as the control module manager, a specific control module, the API server, the load balancer, or the scheduler, plays the role of an orchestrator implementing a cloning procedure triggered by a security module according to the proposed technique.

[0092] Each cluster 100, 200 also comprises several nodes 110, 120, 130, 210, 220, 230 which themselves contain pods 112, 122. Each pod may correspond to the deployment of an application, represented by a cube. Certain pods of interest 114, corresponding to specific application deployments, are also represented with sidecar proxies 116, represented by circles near the cubes.

[0093] La represents a topology of the clusters 100, 200 at the end of a cloning procedure, in an exemplary embodiment. The control plane 102 of a cluster comprising a node 110 as a source resource has identified in this same cluster a node 130, as well as a pod 122 as decoys.

[0094] The control plane 102 of the cluster comprising the source node 110 interacted with the control plane 202 of another cluster 200, which made it possible to designate a node 230 located in this other cluster as a target resource. In the absence of an attack and upon expiration of a predefined time period depending on an estimated vulnerability of the source node 110, or upon detection of an attack targeting the node 130 or the pod 122, the cloning procedure was implemented, replicating the source node 110 in the target node 230.

[0095] This is to be considered as illustrating a simplified example of a moving defense strategy. Complementary actions may be implemented, for example it may be planned to designate a plurality of target nodes located in one or more clusters as target resources and to replicate the source node 110 in each target node thus designated.

[0096] In addition to the resulting redundancy, an adapted routing strategy to target nodes can provide an additional layer of security. This strategy may include adopting intelligent routing that analyzes the threat profile and risk level associated with each target node in real time. By adjusting routing based on these assessments, the system can direct traffic to the nodes deemed most secure at a given time. Overall, moving defense can combine an advanced, adaptive cloning and routing strategy to create a defense-in-depth system, making the cloud computing system's security landscape much more resilient and less predictable for attackers.

[0097] Reference is now made to which describes a procedure for managing services in a cloud computing environment that uses a moving defense strategy. The procedure is represented by a series of exchanges between an orchestrator, a database, a cluster 100 hosting a source resource contributing to an old instance of a service and a cluster 200 intended to host, at the end of the procedure, a target resource contributing to a new instance of the service.

[0098] The orchestrator (ORCH) asks 11 the database (DB) to look up a service (SRC SRVID) by its name or identifier and the database responds 12 by providing the identifier (SRVID) of the service.

[0099] The orchestrator commands 13 the creation of a new service instance (CR SRVID) in the cluster 200 using the provided service identifier and the cluster 200 confirms 14 the creation of the new service instance (SRVID).

[0100] The orchestrator requests 15 the creation of a new target for the service (CR SRVTGTID) in the cluster 200 and the cluster 200 confirms 16 that the service target has been created with the service identifier (SRVTGTID). The creation of the new target involves identifying a target resource within the cluster 200 and then implementing a cloning procedure from the source resource within the cluster 100 to the target resource. The creation of the new service target may further include the creation of one or more fake or decoy targets to divert or confuse potential attackers, adding an additional layer of security.

[0101] The orchestrator modifies 17 the weight of the new service instance in routing (SRV WGT 100) so that all traffic is directed to the new instance. This represents the activation of the new service or the redirection of traffic as part of the rolling defense strategy. Cluster 200 confirms 18 that the weight (WGT 100) of the virtual service has been modified, indicating that the new instance is now up and serving traffic.

[0102] The orchestrator reduces the weight of the old service instance to 0 (SRV WGT 0) so that no more traffic is directed to it. This represents a retirement or rotation of instances from the service, again in the spirit of the rolling defense strategy. Cluster 100 confirms that the weight (WGT 0) of the old virtual service instance has been reduced to 0, completing the failover process to the new instance.

[0103] In the context of the moving defense strategy, the request 15 to create the new target, as well as the modifications 17 and 19 of the respective weights of the new and old service instance in the routing represent possible results of a trigger action implemented by a security module integrated or connected to the orchestrator to perform a cloning of the source resource to the target resource.

[0104] By incorporating the shifting defense strategy, this procedure not only clones services, but actively manipulates traffic routing to make it harder for an attacker to target or compromise a specific service. By alternating between service instances and changing their weight, i.e., their priority in traffic routing, the network environment remains constantly evolving, making it more difficult to attack effectively.

[0105] These technical solutions can be applied to operators and companies wishing to strengthen the security of their applications and services operating in environments based on containers and micro-services.

[0106] They are particularly suitable for managing systems within cloud computing environments, whether private or hybrid, combining private and public elements.

[0107] They play a key role in protecting databases, whose access points often constitute vulnerabilities. Although these databases are located in highly secure locations, they are often accessed via infrastructure shared between private and public domains, which can pose risks.

[0108] These solutions are suitable for various cluster configurations, whether located on a single site or distributed across multiple sites and managed by different actors, as in the case of Cloud-RAN configurations.

[0109] Examples of applications can involve a wide variety of systems and infrastructures, for example clusters operated by multiple actors, distributed over different geographical areas, and extended across multiple data centers, or a main cluster with replicas distributed across multiple data centers, or multi-actor and multi-area clusters connecting satellites to terrestrial data centers.

[0110] This disclosure is not limited to the examples described above, only as an example, but it encompasses all the variations that a person skilled in the art may envisage within the framework of the protection sought.

Claims

Security module adapted to operate on a system comprising a set of resources, the system being adapted to manage at least one service in a cloud computing environment, the system being adapted to implement cloning operations, a cloning operation involving a source resource (110) contributing to the at least one service before the cloning operation and a target resource (230) contributing to the at least one service at the end of the cloning operation, replacing said source resource, the module being configured to perform a cloning of a resource of the set in accordance with a time limit representative of an estimated vulnerability of said resource. Security module according to claim 1, wherein the delay is determined on the basis of security information of the resource. The security module of claim 1 or 2, wherein the delay is further representative of a criticality of the service. The security module of claim 3, wherein the delay is determined based on an environmental parameter of the resource. Security module according to one of claims 1 to 4, configured to perform the cloning of the resource before the expiration of the time limit in response to a detection of a triggering event linked to a security risk concerning the resource. Security module according to one of claims 1 to 5, in which the target resource is chosen at the end of the time limit from a plurality of previously identified candidate resources. A method implemented by a security module adapted to operate on a system comprising a set of resources, the system being adapted to manage at least one service in a cloud computing environment, the system being adapted to implement cloning operations, a cloning operation involving a source resource (110) contributing to the at least one service before the cloning operation and a target resource (230) contributing to the at least one service at the end of the cloning operation, replacing said source resource, the method comprising: performing a cloning of a resource of the set in accordance with a time period representative of an estimated vulnerability of said resource. Computer program comprising instructions for implementing the method according to claim 7 when this program is executed by a processor. Non-transitory recording medium readable by a computer on which is recorded a program for implementing the method according to claim 7 when this program is executed by a processor.

Images