The traffic for O&M, signaling, trusted payload, and untrusted payload uses separate vNICs. Virtual switch traffic separation is also a requirement in the cloud environment for vMRF. For more information on security requirements in the cloud environment, see vMRF Infrastructure Requirements.

The Northbound Interface (NBI) is assumed to be accessed from a trusted O&M network. O&M traffic is secured using various security protocols, see Services, Ports, and Protocols for the details. Other protocols, for example, Telnet or FTP, are not permitted on the O&M interface.

It is recommended to configure a rate limit in an external firewall for protection of the NBI. For a description of the O&M traffic architecture, see Security Management for ECLI, NETCONF, and SFTP Users.

vMRF uses Role-Based Access Control (RBAC) with different rules that can be granted to various role groups. vMRF uses an external Lightweight Directory Access Protocol (LDAP) server to provide user authentication. It is recommended to follow the security policy of the operator when defining O&M users and assigning specific roles to them. It is recommended that access to sensitive information is restricted to those roles and operations personnel who need the access.

Table 1 shows the default roles defined in vMRF:

Users are given access to CLI commands based on their roles as shown in Table 1. A user can be assigned multiple roles simultaneously. MrfApplicationSftpUser is a special role that restricts all other access and allows only SFTP access even when combined with other roles. Media Stream Recording (MSR) access must only be granted to Ericsson troubleshooters.

An SSH session is an interval that starts when a user is authenticated and can start operations. It ends when the user exits, or when the connection to the VNF is closed because of user inactivity. If the session ends because of inactivity, the situation is called idle session time-out.

Idle session time-out is a fixed time of 30 minutes and is enforced for all CLI command, NETCONF, and file access sessions. Traffic is monitored only in the client-to-server direction.

The vMRF SSH interface uses a mechanism to protect against password cracking with brute-force attacks. The mechanism temporarily bans login attempts from IP addresses that reach the maximum allowed number of failed login attempts. The ban period and the maximum allowed number of failed login attempts are preconfigured in vMRF.

The ban period is set to 10 minutes, and the maximum allowed number of failed login attempts is five. This means that after five unsuccessful login attempts, no more login attempts are allowed from the given IP address for 10 minutes.

This section provides the instructions for operating the security functionality of the product.

Even though vMRF has been installed and hardened securely, administrator and user activity over time can introduce security exposures. Also, new vulnerabilities which need to be mitigated are frequently found in the existing products. Therefore it is necessary to maintain the security posture of the product in service on a regular, ongoing basis.

This section describes recommended periodic operations.

• Take system backups regularly according to the vMRF Backup and Restore Guideline.

• Restrict access to backup files so that unauthorized persons cannot view or modify the included sensitive data. This recommendation also refers to backups stored in an external server.

• Apply password policies on the LDAP server to enforce password complexity, aging, and recovery.

• Ensure that no unnecessary accounts exist.

• Ensure that no unnecessary listening ports are open.

• Ensure that no shared user accounts are used.

• Ensure that the emergency user password is not known by more people than necessary.

• Ensure that user rights are assigned only to real needs.

• Monitor the log of access and authorization events in the system by using the following commands:

  • journalctl _COMM=sshd – sshd access logs

  • journalctl SYSLOG_FACILITY=10 – authentication logs

  • journalctl _COMM=com – NBI audit logs

Patches are delivered as new vMRF software packages. A new software package is deployed as a new vMRF VNF, and if needed, the old VNF can be deleted.

Furthermore, it is assumed that all personal privacy related information is handled by the operator according to all applicable local and international laws and regulations in the countries in which they operate.