An SDN-based architecture for security provisioning in Fog-to-Cloud (F2C) computing systems

Fu u e Technologies Con e ence (FTC) 2017 29-30 No embe 2017 | Vancou e , Canada 732 | P a g e An SDN-based A chi ec u e o Secu i y P o isioning in Fog- o-Cloud (F2C) Compu ing Sys ems Sa ang Kah azadeh*, Vi o B. Souza§*, Xa i Masip-B uin*, E a Ma ín-To de a*, Jo di Ga cia*, Rod igo Diaz‡ *Ad anced Ne wo k A chi ec u es Lab (CRAAX), Uni e si a Poli ècnica de Ca alunya (UPC), Spain {skah aza, ba bosa, xmasip, e a, jo dig}@ac.upc.edu § In o ma ics Depa men (DPI), Uni e sidade Fede al de Viçosa (UFV), B azil ‡ Cybe secu i y Lab, A os Spain od igo.d[email p o ec ed] Abs ac —The uns oppable adop ion o cloud and og compu ing is pa ing he way o de eloping inno a i e se ices, some equi ing ea u es no ye co e ed by ei he og o cloud compu ing. Simul aneously, nowadays echnology e olu ion is easing he moni o ing o any kind o in as uc u e, be i la ge o small, p i a e o public, s a ic o dynamic. The og- o-cloud compu ing (F2C) pa adigm ecen ly came up o suppo o eseen and un o eseen se ices demands while simul aneously bene i ing om he sma capaci ies o he edge de ices. Inhe i ed om cloud and og compu ing, a challenging aspec in F2C is secu i y p o isioning. Un o una ely, secu i y s a egies employed by cloud compu ing equi e compu a ion powe no suppo ed by de ices a he edge o he ne wo k, whe eas secu i y s a egies in og a e ye on hei in ancy. Pu his way, in his pape we p opose So wa e De ined Ne wo k (SDN)-based secu i y managemen a chi ec u e based on a mas e /sla e s a egy. The p oposed a chi ec u e is concep ually applied o a c i ical in as uc u e (CI) scena io, hus analyzing he bene i s F2C may b ing o secu i y p o isioning in CIs. Keywo ds—IoT; cloud compu ing; og compu ing; og- o-cloud compu ing; secu i y; So wa e De ined Ne wo k (SDN); c i ical in as uc u es I. INTRODUCTION AND MOTIVATION Nowadays, he ope a ion be ween people and machines is being signi ican ly empowe ed h ough bo h inno a i e communica ion pa adigms and new sma de ices, such as sma phones, able s o wea ables, jus o name a ew. The g ow h o de ices connec i i y pa ed he way o coin he e m In e ne o Things (IoT), s anding o ― hings‖ communica ing anywhe e, a any ime, and o anyone – a ― hing‖ in IoT e e s o any ype o connec ed de ice. The explosion o IoT and, in pa icula , he apid g ow h o connec ed use s h ough a la ge a ie y o he e ogeneous de ices, ueled he deploymen o new applica ions wi h s ic demands in se e al key aspec s, such as secu i y, compu ing powe o s o age. In o de o ace ha se o demands, cloud compu ing eme ged as an on- demand sel -se ice, scalable, loca ion independen , pay-as- you-go online compu ing model, enabling he use o emo e physical compu ing esou ces loca ed a a da a cen e s [1], [2]. The ou sou cing o da a and se ices p ocessing up o he cloud, b ings no only economic bene i s bu also ees use s o ge conce ned on ela ed echnical aspec s. Howe e , handling ha olume and a ie y o da a, while simul aneously p o iding he eloci y demanded by IoT applica ions, equi es a new compu ing pa adigm ha can gua an ee low-la ency, as well as inc eased secu i y and ene gy-e iciency, among o he s. The og compu ing pa adigm [3] has been ecen ly p oposed as an ex ension o cloud compu ing, le e aging a highly dis ibu ed se o esou ces loca ed a he edge o he ne wo k, b inging compu ing, s o age and ne wo k capabili ies close o he end-use s, wha unques ionably acili a es o p o ide cha ac e is ics, such as low-la ency, loca ion awa eness, geo-dis ibu ion, inc eased da a secu i y and eal- ime p ocessing. Pu his way, in IoT scena ios, cloud makes cen aliza ion while og makes localiza ion. Le e aging cloud and og bene i s, og- o-cloud compu ing (F2C) has been ecen ly p oposed [4], as a new compu ing pa adigm p oposing an inno a i e hie a chical and dis ibu ed a chi ec u e. In he p oposed dis ibu ed a chi ec u e, use s’ de ices (i.e., edge de ices) may collec da a o be la e p ocessed in an ei he sequen ial o pa allel ashion a og, cloud o bo h, ueling he c ea ion o a la ge se o new se ices. The F2C compu ing model is in ended o join ly manage cloud and og esou ces in a coo dina ed way, demanding o a no el con ol and managemen s a egy, add essing some o he limi a ions inhe en o cloud and og compu ing. Many challenges a e ye unsol ed in he F2C compu ing model, om coo dina ed esou ces managemen a cloud and og o he challenges imposed when acing secu i y p o isioning. This pape ocuses on he secu i y aspec s o F2C, p oposing a no el SDN-based secu i y a chi ec u e ha is concep ually applied o a c i ical in as uc u e (CI) scena io, o uel discussion on he en isioned bene i s F2C may b ing o help secu e such a highly demanding scena ios. I mus be highligh ed ha besides he unsol ed secu i y issues om he seed cloud and og compu ing models, new F2C speci ic secu i y challenges come up. Thus, p oposing a solu ion o F2C undoub edly equi es a s ong backg ound on secu i y aspec s bo h in he cloud and og scena ios. On he cloud a ea, he ou sou cing o se ice p ocessing exposes well-known secu i y aspec s equi ing wide a en ion. Fo example, he dis ance be ween he end use and he cloud esou ces is no only adding long delays, bu also impac ing on he o e all secu i y. On he o he hand, al hough heo e ically og should b ing mo e p i acy — as a consequence o i s p oximi y o end-use s — i s dis ibu ed na u e makes og compu ing o ace no only secu i y challenges inhe i ed om cloud (shi ed om cloud o he edge), bu some o he inhe en Fu u e Technologies Con e ence (FTC) 2017 29-30 No embe 2017 | Vancou e , Canada 733 | P a g e o og compu ing. Fi s , og compu ing b ings i ualiza ion close o he use s, hus og compu ing mus also deal wi h secu i y issues ela ed o he i ualiza ion en i onmen as i usually happens in cloud compu ing. Second, ecognized he dis ibu ed s a egy adop ed by og compu ing, au hen ica ion in di e en le els u ns in o one o he main secu i y challenges in og. Indeed, he ac ha og compu ing shi s some compu a ional capabili ies, da a analysis, da a agg ega ion, da a il e ing and s o age o edge de ices, d i es he edge o he ne wo k o handle p i a e, sensi i e o con iden ial in o ma ion —such as, pe sonal in o ma ion o c i ical in as uc u es da a. Thus, secu e communica ions mus be g an ed in o de o gua an ee da a p i acy a he edge o he ne wo k. Thi d, he e is a high he e ogenei y in he de ices a he edge—nodes, se e s, ga eways, access poin s, e c.—, wha makes he design o an a chi ec u e g an ing secu i y p o isioning a ha d challenge. Mo eo e , we mus conside ha al hough adi ional cloud secu i y p o ocols may heo e ically p o ide some secu i y o og compu ing sys ems, he cons ain s on p ocessing capaci ies o he edge de ices undoub edly limi he e iciency o such exis ing p o ocols. On he o he hand, secu i y ini ia i es designed o og compu ing canno mee he huge amoun o p ocessing and s o age cloud equi emen s. In addi ion, he design o secu e ogs and clouds wi h exis ing secu i y a chi ec u es and p o ocols wi hou conside ing he coo dina ed na u e o F2C (in e ope abili y, he e ogenei y, e c.), may cause addi ional secu i y p oblems when conside ing he whole se o esou ces en isioned in F2C. This is he i s wo k dealing wi h comple e secu i y a chi ec u e o F2C compu ing sys ems. The challenging ques ion is: how can we design a new secu i y a chi ec u e p o iding secu e communica ion, con iden iali y, in eg i y, a ailabili y, mu ual og, cloud and nodes au hen ica ion, and access con ol o F2C? In his pape we assess ha he highly dis ibu ed F2C na u e can be p ope ly managed by using a So wa e De ined Ne wo k (SDN) based s a egy, le e aging a se o dis ibu ed con olle nodes, h ough a mas e -sla e s a egy. The pape is s uc u ed as ollows. Sec ion 2 desc ibes he ela ed wo k, Sec ion 3 desc ibes he new SDN-based secu i y o F2C, Sec ion 4 p esen s he ob ained esul s, and inally Sec ion 5 concludes he pape . II. RELATED WORK Many ecen wo ks ha e assessed he design o secu i y p o ocols and a chi ec u es o secu e og compu ing and cloud compu ing communica ions in an independen ashion. Ne e heless, none o hem conside ed a coo dina ed secu i y scheme, as demanded by new compu ing models, such as og- o-cloud. In his sec ion, we e isi some ele an wo ks on he secu i y a ea o cloud and og compu ing pa adigms, somehow ela ed o he speci ic F2C demands. I mus be highligh ed ha none o he e isi ed wo ks a e designed o be applied o F2C; hence he li e a u e e iew is in ended o lea n om pas e o s in ela ed a eas. In he way, secu ing og and cloud, au ho s in [5] p opose iden i y-based au hen ica ion o IoT assuming he cen al da abase, con olle s, ga eways and hings dis ibu ed in a hie a chical way. Key cha ac e is ics o his p oposal a e: 1) con olle s use an Ellip ic Cu e C yp og aphy (ECC) key es ablishmen me hod o gene a e keys; 2) ga eways ake hei ce i ica es om he con olle ; 3) hings a e egis e ed by ga eways; and 4) hings and ga eways go h ough he au hen ica ion phase. The p oposed solu ion p o ides a secu e hie a chical a chi ec u e and p o ocol o og and cloud communica ion, al hough secu i y o in e og communica ion is no g an ed. The solu ion p oposed in [6] aims a gua an eeing secu e end- o-end communica ions in IoT scena ios. The p esen ed a chi ec u e is spli in o de ice laye , og laye (ga eways) and cloud laye , and uses he ull ini ial ce i ica e-based Da ag am T anspo Laye Secu i y (DTLS) p o ocol be ween end-use and sma ga eways o au hen ica ion and au ho iza ion. Unlike he wo k in [5], he p oposed secu i y a chi ec u e only p o ides a secu e in e og communica ion wi hou conside ing he secu i y on he communica ion be ween og and cloud nodes. The wo k in [7] p oposes a og use / og se e mu ual au hen ica ion. In his a chi ec u e, og use s s o e a long-li ed mas e sec e key, which allows hem o oam h ough he ne wo k and mu ually au hen ica e o any og se e unde cloud se ice p o ide au ho iza ion. Un o una ely, his wo k p o ides secu i y in og communica ions wi hou ema king cloud secu i y. In [8], a ga eway-based og compu ing (mas e /sla e) o wi eless senso s and ac ua o ne wo ks is p oposed. Simila o he wo k in [7] his wo k is ocused on og so wi h no oom o be applied o cloud, no o F2C. Se e al solu ions al eady ocus on he SDN concep . The a chi ec u e in [9] includes a de ice laye (con ains senso s o da a collec ion), communica ion laye (includes SDN ga eways and ou e s), compu ing laye (con ains a con olle wi h accoun ing and billing mechanisms) and se ice laye (whe e IoT se ices a e buil by de elope s and ope a o s h ough p og amming he SDN con olle s) o he cons uc ion o an SDN-based a chi ec u e o ho izon al IoT. The p oposed a chi ec u e aces og communica ions h ough ga eways wi hou con empla ing cloud in a coo dina ed way. The wo k in [10] ocuses on an SDN app oach o secu ing IoT ga eways. The p oposed a chi ec u e includes 3 laye s: 1) Edge node, unning some se ices a he edge o he ne wo k o educe he amoun o da a o be ans e ed o he cloud o analysis, p ocessing, and s o age; 2) SDN con olle , suppo ing open- low swi ch; and 3) E2E applica ion, b inging moni o ing capaci ies o anomaly de ec ion. Al hough, au ho s only p o ide secu i y o IoT ga eways — wi hou conside ing cloud secu i y — hey p opose o use a cen alized SDN con olle wi h no capaci y o handle secu e mobili y issues. Au ho s in [11] p opose me ging Fog compu ing and so wa e- de ined ne wo king in o he IoT a chi ec u e. Au ho s a gue ha he p oposed combined s a egy acili a es a ic con ol, esou ce managemen , scalabili y, mobili y and eal- ime da a deli e y. O he challenges add essed by such a combined s a egy a e: 1) SDN con olle o ches a ion un angle og o ches a ion issues; 2) og compu ing would sol e scalabili y issues in SDN; 3) og b ings low-la ency o he whole IoT a chi ec u e. Howe e , secu i y p o isioning is no discussed in ha pape . Fu u e Technologies Con e ence (FTC) 2017 29-30 No embe 2017 | Vancou e , Canada 734 | P a g e Fig. 1. New SDN-based secu i y a chi ec u e. Taking in o accoun he no el y o F2C compu ing, his is he i s pape aimed a designing a solu ion o secu i y p o isioning in F2C. The p oposed SDN-based solu ion is he i s con ibu ion speci ically analyzing he cha ac e is ics imposed by he hie a chical F2C a chi ec u e. Indeed, ou p oposal sugges s using a F2C con olle (in he cloud) as a mas e , and dis ibu ed og-con olle s as sub-mas e s, all e icien ly managed in a coo dina ed ashion. To ha end a p o ocol mus also be designed de ining how dis inc elemen s in he a chi ec u e in e ac wi h each o he . III. THE PROPOSED SDN-BASED SECURITY ARCHITECTURE The coo dina ed managemen o og and cloud esou ces en isioned by F2C compu ing exace ba es adi ional cloud secu i y issues, such as au hen ica ion, communica ions p i acy among F2C laye s, con iden iali y, o in eg i y, jus o name a ew. In his sec ion, we in oduce he ounda ions o an SDN-based secu i y a chi ec u e o F2C compu ing sys ems. As epo ed in he s a e o he a sec ion, applying SDN o secu i y p o isioning is no a no el app oach and some exis ing wo ks al eady bene i om he decoupling concep b ough by SDN [12]. The s a egy loa ed in he pape le e ages he SDN concep by p oposing a cen alized F2C con olle in cloud, as a mas e , and se e al dis ibu ed con olle s co e ing he di e en ogs. Fig. 1 illus a es he p oposed SDN-based secu i y a chi ec u e, se ing ou le els, as ollows: 1) F2C con olle (Mas e ): A cen alized mas e con olle loca ed a cloud, is esponsible o managing, moni o ing and g an ing a secu e communica ion in he a chi ec u e. This F2C con olle gi es au ho iza ion o all componen s in he a chi ec u e o p o ide coo dina ed secu e managemen and communica ion among hem. 2) Con ol A eas (Sub-mas e 1): We conside a dis ibu ed secu i y con ol di ided in o dis inc con ol a eas, each one con aining one Con ol A ea Uni associa ed o one og. The e o e, each Con ol A ea Uni is esponsible o implemen ing he equi ed con ol unc ionali ies [13]. They a e esponsible o he es ablishmen o secu e coo dina ed managemen and communica ion be ween ogs in di e en a eas, as well as ogs o cloud, bo h equi ing F2C con olle au ho iza ion. The sub-mas e 1 con olle s a e dis ibu ed acco ding o each og loca ion, enabling a mobili y-awa e a chi ec u e. 3) Clus e -head (Sub-mas e 2): This is an edge de ice endo sed wi h high capaci y, in e ms o ne wo king, compu ing, and s o age, i compa ed o o he edge de ices loca ed in he same a ea. Each selec ed sub-mas e 2 is a middlewa e be ween nodes (IoT edge de ices) and con ol a eas on di e en ogs and is able o make da a p ocessing a he edge o he ne wo k acco ding o i s esou ce capaci y. 4) Nodes (Sla es): Loca ed a he edge o he ne wo k, he sla e laye is o med by he IoT de ices, which may include bo h end-use mobile de ices and deployed de ices, such as ixed senso s. The di e en a chi ec u al le els mus coo dina ely ope a e o success ully gua an ee secu i y p o isioning. To ha end, a o mal handshaking p o ocol mus be de ined, se ing he o mal p ocedu es o sys ems communica ion. Nex , we in oduce he main a ionale o he p o ocol pe o mance. In he p oposed a chi ec u e, con ol a eas (sub-mas e 1) mus egis e and au hen ica e o F2C con olle in o de o con ol ogs in di e en a eas. In a simila way, each clus e -head (sub- mas e 2), posi ioned in dis inc ogs, mus egis e in con ol a eas, while nodes mus egis e in he clus e -head. In he egis a ion phase, we assume all con ol-a eas o be egis e ed a he F2C con olle h ough a long- e m sec e -key, so hey can con ol he dis ibu ed ogs. Simul aneously, each clus e - head is also egis e ed in i s co esponding dis ibu ed con olle . A e he egis a ion phase, each con ol-a ea akes o e secu i y managemen in he dis ibu ed ogs, hence educing he usual complexi y when done a cloud. I is wo h men ioning ha , as illus a ed in Fig. 1 by he dashed line, he clus e -head may communica e di ec ly wi h he F2C con olle in some speci ic si ua ions (as desc ibed in he ollowing pa ag aphs), hus also equi ing he egis a ion o clus e - heads in he F2C con olle . A e he egis a ion phase, he communica ion be ween dis inc componen s o his a chi ec u e may be pe o med hie a chically, u ning in o h ee dis inc ca ego ies, as Fu u e Technologies Con e ence (FTC) 2017 29-30 No embe 2017 | Vancou e , Canada 735 | P a g e in oduced in ou p e ious wo k in [14]. He e, we discuss he p oposed a chi ec u e in an illus a i e sma ci y scena io in o de o alida e he dis ibu ed con olle s app oach. In he sma ci y scena io shown in Fig. 2, we assume a cen alized F2C con olle loca ed a he cloud owned by he sma ci y. The F2C con olle is esponsible o managing, con olling and p o iding a secu e communica ion o all sma ci y componen s. We assume a global opology including dis ibu ed con olle s deployed in a a ic ligh , a s o e ( og1), a gas s a ion, and a bus s a ion. These dis ibu ed con olle s would au hen ica e and ake au ho iza ion om he F2C con olle in he egis a ion and ini ializa ion s ep. The e o e, all con olle s a e able o in e -communica e in o de o p o ide secu e manageable communica ion o all sma ci y componen s, deployed in dis inc ogs. Fo he sake o simplici y, we conside ha in each og, he de ice wi h mo e capaci y in e ms o ne wo k, s o age and compu ing is he one selec ed as clus e -head. In Fig. 2, og 1 is a s o e, whe e og use s’ de ices can be con olled and au hen ica ed by he co esponding con ol a ea uni deployed in he s o e. Le ’s suppose a og 1 use wan s o communica e secu ely wi h a og use in og 4. Indeed, hey can communica e in a secu e and manageable way h ough he co esponding s o e con ol a ea uni and bus s a ion con ol- a ea uni . These dis ibu ed con olle s acili a e og o og au hen ica ion and communica ion. Hence, assuming ha a og 1 use in he s o e wan s o ake in o ma ion abou bus a i als, using ou dis ibu ed con olle s, he use can ge secu e in o ma ion h ough he co esponding con ol-a ea uni in he s o e ( his con ol-a ea uni has secu e in e communica ion wi h bus con ol a ea uni ). In ano he example, le ’s assume og 2 o be buil upon a se o ca s mo ing in he same di ec ion (see ed ca s in Fig. 2) and og 3 buil upon ano he se o ca s all mo ing in he same di ec ion, bu pe pendicula o ca s in og 2 (see g ay ca s in Fig. 2). Wi hin each o hese ogs, one ca shall be selec ed as a clus e - head and og 2 and og 3 can communica e in a secu e manageable way h ough hei espec i e con ol-a ea uni ( a ic-ligh ). Fu he mo e, whe he he co esponding con ol- a ea uni ( a ic-ligh ) ge s comp omised, a acked o down, he selec ed clus e -head, o ins ance in og 2, which ob ained a mas e key o di ec ly communica e o he F2C con olle du ing he egis a ion s ep, makes use o his con olle o ge a nea es and sa es con ol-a ea uni (suppose gas s a ion o bus s a ion con ol-a ea uni ). The e o e, og 2 would be con olled and managed by one o hem. Mo eo e , he p oposed a chi ec u e also enables he og use s in og 4 o be au hen ica ed o he sma ci y cloud h ough he bus con ol a ea uni wi h less au hen ica ion delay. Indeed, by deploying dis ibu ed con olle s o ogs managemen , we dec ease he dis ance be ween ogs and cloud which can be help ul o achie ing less au hen ica ion delay as well as highe secu i y by a oiding known a acks, such as man in he middle. Ano he p i ilege o dis ibu ed con olle s is secu e mobili y and hando e . Fig. 2. Sma ci y scena io. Fo ins ance, assume ha og 2, og 3, og 4 and og 5 a e on he mo e. Wi h he deploymen o dis ibu ed con olle s, we a e able o manage secu e mobili y and hando e h ough con ol a ea uni s in e communica ion. IV. REVIEWING CRITICAL INFRASTRUCTURES SECURITY NEEDS I is widely ecognized and la gely epo ed he ele ance C i ical In as uc u es (CIs) ha e o he unc ioning o a socie y. A CI can be de ined as a se o asse s, be i ei he physical o i ual, playing a i al ole in p o iding coun y’s needs, o he ex en ha i s incapaci y o des uc ion would ha e a de as a ing impac on secu i y, economy o public heal h. The e a e many in as uc u es ha may be ca ego ized as CI, such as (wi h no aim o be an exclusi e lis ) eme gency se ices, wa e supply sys ems, ag icul u e and ood, go e nmen , de ense indus y, in o ma ion echnology and elecommunica ion, heal hca e, banking sys em, ene gy, anspo a ion sys em, chemical indus y, pos al se ices, na ional ai po s o mili a y sys ems. Indeed, b eaking secu i y ulne abili ies in a CI causes c i ical in o ma ion leaks and e ible disas e s in no mal coun ies ope a ion. The e o e a comp ehensi e and exhaus i e iden i ica ion o he key secu i y equi emen s in c i ical in as uc u es is a mus o any coun y o se he p ope p ocedu es o secu i y p o isioning. Fu u e Technologies Con e ence (FTC) 2017 29-30 No embe 2017 | Vancou e , Canada 736 | P a g e Fig. 3. De ice-cloud au hen ica ion (Scena io 1). Fig. 4. End- o-end au hen ica ion (Scena io 2). In ac , we ca ego ize mos common secu i y equi emen s in c i ical in as uc u es in o [15]: s ong ne wo k secu i y managemen , s ong iden i ica ion and au hen ica ion mechanism, i m secu i y policy, da a con iden iali y, o ensics analysis, ope a ional echnology (OT) p o ec ion, OT ne wo k p o ec ion, secu e communica ion channel, cascading a ec p o ec ion, anomaly beha io de ec ion mechanism, high ne wo k a ic de ec ion mechanism ( o DoS/DDoS a acks), secu i y in o ma ion and e en managemen (SIEM), an imalwa e and an i i uses p o ec ion mechanism, ha dwa e secu i y, da a p i acy, da a in eg i y, and IT ne wo k p o ec ion. F om a secu i y pe spec i e CIs use o sha e a common, dis ibu ed, coo dina ed scena io, in ended o be an ex emely secu e amewo k including global policies and solu ions o gua an ee he equi ed pe o mance. The dis ibu ed policy de ined in he SDN-based secu i y a chi ec u e p oposed in his pape seems o be a p ope solu ion o be applied in CI scena ios. Indeed, he cen alized and dis ibu ed con olle s in ou a chi ec u e will help CIs: 1) ease componen s au hen ica ion; 2) ease sys ems au ho iza ion h ough a mas e - sla e s a egy; and 3) p o ide a coo dina ed managemen be ween di e en CIs o communica e in a secu e way. V. PRELIMINARY EXPERIMENTAL RESULTS This sec ion p esen s p elimina y a chi ec u e e alua ions aiming a alida ing he bene i s o he p oposed SDN-based a chi ec u e o secu i y p o isioning. To ha end, we pu he ocus on analyzing he delay equi ed o au hen ica ion pu poses, conside ing a adi ional s a egy based on cloud au hen ica ion and ano he one in e ed om he p oposed SDN-based secu i y a chi ec u e. Two scena ios a e analyzed, one demanding og-cloud au hen ica ion and he o he one demanding og- og (end- o-end) au hen ica ion. Scena io 1. Fog-cloud au hen ica ion: Le us assume a empe a u e-senso ) in a nuclea powe s a ion wan s o au hen ica e wi h he nuclea powe cloud o communica ion. Two dis inc app oaches may be deployed, as illus a ed in Fig. 3. A adi ional cloud au hen ica ion scheme is shown in ed-lines whils ou p oposal is shown in b own-lines. The adi ional au hen ica ion p ocedu e pe o ms as ollows:  S ep 1: Fog node ( empe a u e-senso ) exchange au hen ica ion messages wi h cloud (nuclea -powe cloud).  S ep 2: Tempe a u e senso and nuclea powe da acen e a e au hen ica ed. On he o he hand, he p oposed au hen ica ion p ocedu e pe o ms as ollows:  S ep 1*: Tempe a u e-senso exchange au hen ica ion messages wi h he Con ol-A ea uni is linked o. As Con ol-A ea uni s ake pe mission om he F2C con olle o con ol dis ibu ed Fogs du ing egis a ion phase, he con olle can do au hen ica ion o Fogs wi h hei p imi i e F2C con olle au ho iza ion.  S ep 2*: Nuclea powe cloud and empe a u e-senso a e au hen ica ed o communica ion. The senso ecei es acknowledgmen om cloud. Scena io 2. End- o-end au hen ica ion: Fo a scena io equi ing end- o-end au hen ica ion, such as a powe sys em willing o es ablish a secu e communica ion wi h a hospi al, we illus a e in Fig. 4 he adi ional au hen ica ion in ed-line and he p oposed au hen ica ion scheme in b own-line. The adi ional end- o-end au hen ica ion p ocedu e pe o ms as ollows:  S ep 1: Fog 1 (Powe sys em) exchange au hen ica ion messages wi h he cloud aiming a se ing secu e communica ion wi h Fog N (Hospi al).  S ep 2: Fog N au hen ica e om cloud o ha e communica ion wi h Fog 1.  S ep 3: Powe sys em and hospi al may es ablish secu e communica ion a e au hen ica ion. The p oposed end- o-end au hen ica ion p ocedu e pe o ms as ollows: Fu u e Technologies Con e ence (FTC) 2017 29-30 No embe 2017 | Vancou e , Canada 737 | P a g e  S ep 1*: Powe sys em exchange au hen ica ion messages wi h i s Con ol-A ea uni in o de o es ablish secu e communica ion wi h he hospi al.  S ep 2*: Hospi al au hen ica e om i s Con ol-A ea uni o es ablish secu e communica ion wi h he powe sys em. Is i wo h men ioning ha , as in Scena io 1, all Con ol-A ea uni s a e al eady egis e ed in F2C con olle , he e o e, dis ibu ed con olle s has pe mission o au hen ica e Fogs wi h no need o each ou o he cloud.  S ep 3*: Powe sys em and hospi al may se a secu e communica ion a e au hen ica ion. In bo h scena ios, he deploymen o he p oposed s a egy o au hen ica ion le e ages he low delay au hen ica ion p o ided by he dis ibu ed con olle s loca ed close o he end- use s. Indeed, Table 1 shows ha he au hen ica ion ime in og nodes a e signi ican ly lowe han he au hen ica ion in cloud when using adi ional schemes, such as he SSL Au hen ica ion P o ocol (SAP). The es ima ed delays o bo h og and cloud au hen ica ion we e based on wo ks in he li e a u e, such as [16], [17]. Consequen ly, Table 2 shows he es ima ed delays o he wo scena ios analyzed, clea ly highligh ing he bene i s in e ms o educed delay when applying he SDN-based secu i y a chi ec u e. F om he ob ained esul s we may in e he e ec s he p oposed a chi ec u e may ha e in pa icula CI scena ios. Recognized he signi icance au hen ica ion has in CI scena ios, we may s a e ha acco ding o ou e alua ion, he educed delay o bo h og and cloud au hen ica ion b ough by ou a chi ec u e will be ex emely bene icial in CI scena ios. Le us conside wo well-known CI scena ios, such as a hospi al (eHeal h sec o ) and a ain p o ide ( anspo sec o ). In bo h scena ios low delay au hen ica ion is key o gua an ee he eal ime pe o mance, manda o y in bo h domains. Fo ins ance, le us assume a pa ien needs o communica e p i a ely wi h his/he doc o . Acco ding o he solu ion p oposed in his pape , he au hen ica ion phase would be execu ed a bo h he dis ibu ed con olle s ( ogs) and he cen alized con olle (cloud), hus wi h a s ong impac on delay educ ion. Mo ing o he anspo scena io, a ain mus communica e wi h se e al s a ions o check a ic and in e locking sys ems o a oid acciden s. This equi es mu ual ain and s a ions au hen ica ion wi h e y low delay o gua an ee a as eac ion, hus p e en ing undesi ed disas e s o come. The SDN-based secu i y a chi ec u e p oposed in his pape le e aging he deploymen o dis ibu ed con olle s, would undoub edly help dec ease he au hen ica ion delay, hus con ibu ing o a mo e secu e pe o mance. I is also wo h no icing ha he p oposed secu i y a chi ec u e would no impac only on indi idual CI scena ios bu also on he communica ion among hem. Indeed, CIs a e usually dependen each o he , so secu e communica ion among hem is a mus . Fo example, hospi al in as uc u e is s ongly dependen on he powe p o ide , same o a ain company, o a mili a y sys em wi h he eme gency con ol sys em. To make dependencies eliable and e icien , a secu e communica ions s a egy mus be deployed among hem. TABLE I. AUTHENTICATION DELAY COMPARISON IN FOG AND CLOUD Loca ion La ency Fog au hen ica ion ~ 300 ms Cloud au hen ica ion ~ 1000 ms TABLE II. AUTHENTICATION DELAY COMPARISON IN THE TWO SCENARIOS ANALYZED Scena io La ency Cloud s a egy SDN-based s a egy Fog-cloud au hen ica ion ~ 1000 ms ~ 300 ms end- o-end au hen ica ion ~ 2000 ms ~ 600 ms In his sec ion he p oposed a chi ec u e has been p elimina y alida ed in e ms o delay. Howe e , beyond he bene i s in oduced in esponse ime, we en ision many o he ad an ages, pa icula ly e e ing o a c i ical ask, such as he complexi y b ough by managing huge cen alized da abases loca ed a cloud. Assuming an IoT scena io whe e housands o he e ogeneous de ices a e e e asking o communica ion, keeping s ong secu i y gua an ees equi es a huge da abase o be managed. The p oposed dis ibu ed a chi ec u e elie es he complexi y o e head in oduced by such a managemen , h ough he deploymen o local da abases a og p emises. VI. CONCLUSIONS Dis inc ne wo k pa adigms such as Cloud compu ing, og compu ing and, in special, he ecen ly p oposed combined og- o-cloud (F2C) compu ing a e imposing new secu i y challenges in dis inc aspec s. This pape add esses secu i y aspec s in F2C compu ing by illus a ing, in e ms o au hen ica ion delay, how isola ed og and cloud secu i y solu ions a e no su icien o gua an ee he deploymen o a us able F2C coo dina ed managemen solu ion. In o de o con ibu e o ha p oblem, we in oduce an SDN-based secu i y a chi ec u e suppo ed by mas e /sla e s a egies augmen ed by deploying a se o well-de ined dis ibu ed con olle s. The pape a gues ha h ough he deploymen o his s a egy, we can dec ease he au hen ica ion delay in bo h og and cloud communica ions. Finally, we conclude assessing ha he e a e s ill many challenges o so ou , hus s ong e o s mus be alloca ed by he scien i ic communi y o p o ide a solu ion add essing he speci ic equi emen s b ough by he en isioned F2C scena io. ACKNOWLEDGMENT This wo k is suppo ed by he H2020 CIPSEC p ojec (700378). Fo UPC au ho s by he Spanish Minis y o Economy and Compe i i eness and by he Eu opean Regional De elopmen Fund unde con ac TEC2015-66220-R (MINECO/FEDER), and o V. Ba bosa by CAPES Founda ion, no 11888/13-0. REFERENCES [1] J.Gonzalez-Ma ínez, e al., Cloud compu ing and educa ion: A s a e-o - he-a su ey, Compu e s & Educa ion 80 (2015) 132-151, 2014. [2] S.Singh, Y. Jeong, J. H. Pa k, A su ey on cloud compu ing secu i y: Issues, h ea s, and solu ions, Jou nal o Ne wo k and Compu e Applica ions 75 (2016) 200–222, 2016 Else ie . [3] F. Bonomi, e al., Fog Compu ing: A Pla o m o In e ne o Things and Analy ics, Big Da a and In e ne o Things: A Roadmap o Sma En i onmen s Vol. 546 o S udies in Compu a ional In elligence 2014. Fu u e Technologies Con e ence (FTC) 2017 29-30 No embe 2017 | Vancou e , Canada 738 | P a g e [4] X. Masip-B uin, e al., Foggy clouds and cloudy ogs: a eal need o coo dina ed managemen o og- o-cloud (F2C) compu ing sys ems, IEEE Wi eless Communica ion Magazine, Oc obe 2016. [5] O. Salman, e al., Iden i y-Based Au hen ica ion Scheme o he In e ne o Things, 2016 IEEE Symposium on Compu e s and Communica ion. [6] S.R.Moosa i, e al., End- o-end secu i y scheme o mobili y enabled heal hca e IoT, Fu u e Gene a ion Compu e Sys ems 64 2016. [7] M. H. Ib ahim, Oc opus: An Edge-Fog Mu ual Au hen ica ion Scheme, In e na ional Jou nal o Ne wo k Secu i y, Vol.18, No.6, No . 2016. [8] W. Lee, e al., A Ga eway based Fog Compu ing A chi ec u e o Wi eless Senso s and Ac ua o Ne wo ks, ICACT 2016. [9] Y. Li, e al., A SDN-based A chi ec u e o Ho izon al In e ne o Things Se ices, Communica ions (ICC), 2016. [10] R. Vilal a, R.Ciungu. A.Mayo al, R.Casellas, R. Ma inez, D.Pubill, J.Se a, R.Munoz, and C.Ve ikoukis, Imp o ing Secu i y in In e ne o Things wi h So wa e De ined Ne wo king, Globcom Decembe 2016 [11] S.Tomo ic, K.Yoshigoe, I.Malje ic, I.Radusino ic, So wa e-De ined og Ne wo k A chi ec u e o IoT, Wi eless pe s Commun (2017). [12] F. Hu, Q. Hao, K. Bao, A Su ey on So wa e-De ined Ne wo k and OpenFlow: F om Concep o Implemen a ion, IEEE Communica ions Su e eys & Tu o ials, Vol. 16, N. 4, 2014. [13] V. Souza, e al., Insigh s in o he Se ice Execu ion in a Combined Fog- o-Cloud (F2C) Compu ing Sys em. 2016, Technical epo . h p://www.ac.upc.edu/app/ esea ch- epo s/h ml/RR/2016/10.pd [14] S. Kah azadeh, e al., Secu ing combined Fog- o-Cloud sys em Th ough SDN App oach, C osscloud , Se bia, 2017. [15] CIPSEC p ojec a www.cipsec.eu [16] H. Li, e al., Iden i y-based au hen ica ion o cloud compu ing. In IEEE In e na ional Con e ence on Cloud Compu ing. Sp inge , 2009. 157-166. [17] C. Dsouza, e al.. Policy-d i en secu i y managemen o og compu ing: P elimina y amewo k and a case s udy. IEEE 15 h In e na ional Con e ence on In o ma ion Reuse and In eg a ion (IRI). 2014.