D2.2 - Initial Architecture of iTrust6G Platform

This deliverable, iTrust6G D2.2, reports on the first iteration of iTrust6G architectural activities led in work package 2 (WP2). It reports the work conducted in task 2.2 (T2.2) by detailing and justifying the initial version of the system architecture of iTrust6G, to serve as a baseline for all the technical work conducted in work WP3/4/5/6. A revised version of this architecture that accounts for lessons learnt will be reported in the upcoming iTrust6G D2.4. The key technological areas relevant to iTrust6G are identified and improvements over state-of-the-art, where applicable, are proposed toward an end-to-end system security architecture capitalising on zero-trust (ZT) principles to enable a trustworthy 6G service management platform, addressing dynamic network and application-level security requirements, aligned with the technical objective of the project. Besides the specification of the general system architecture, iTrust6G D2.2 provides the following: • Definition of the main processes for the continuous trust assessment between services, computing resources, and users;• Definition of the main processes for risk and threat evaluation on platform resources and mitigation;• Definition of the main processes for the cyber-threat intelligence generation and ingestion for trust assessment. Chapter 1 provides an overview of the intents of the document, the targeted audience, and explicates how it is expected to contribute to the execution of work in other WPs of the project. Chapter 2 positions the projects regarding the key enabling areas by presenting relevant state-of-the-art. Selected domains cover (i) intent-based security policy, (ii) collaborative threat intelligence, (iii) trust model and evaluation, and (iv) the security management. The state-of-the-art, ongoing R&D initiatives supported by Open-Source communities and European research programs, and relevant standardisation communities susceptible to benefits from those topics are analysed and identified. Chapter 3 explains the main iTrust6G doctrine to adapt ZT principles from traditional architecture to satisfy anticipated security and trust requirements for the next generation of mobile networks. Chapter 4 introduces the preliminary system architecture of iTrust6G aligned with the doctrine from Chapter 3 and the requirements stated in iTrust6G D2.1 [1]. Essentially, different planes and actors expected to interact with iTrust6G platforms, and their separation of concerns are defined. The different functional components and the information they exchange are then methodologically specified. Chapter 5 sets into motion the work described in Chapter 4 by detailing the main processes leveraging the functional architecture. Specifically, details of core processes related to trust assessment, cyber-risk, and threats to handle, and cyber-threat intelligence generation and ingestion for trust assessment are provided. This includes the formalisation via a sequence diagram involving the components of the platform. Chapter 6 summarises and closes the document.