VNF API Security Requirements for VOLTHA

As a managed virtualized environment, VOLTHA should derive and leverage security requirements, security architecture, security best practices and open source security solutions from other open communities
• ONF is a member of Linux Foundation
• In the ONAP project in Linux Foundation, the ONAP requirements for Security, and ONAP architecture and work in progress do provide much of these elements
• Some service providers plan to integrate VOLTHA with ONAP. Although a service provider may not deploy VOLTHA under ONAP, the maturity of the ONAP security requirements, and ONAP security solutions being developed in open source provide a good foundation for security requirements and user stories for VOLTHA

There will be five (5) VOLTHA EPICs corresponding to the organization of the ONAP VNF Security, under VNF Development Requirements-

1) VNF General Security Requirements

2) VNF Identity and Access Management (IDAM) Requirements

3) VNF API Security Requirements

4) VNF Security Analytics Requirements

5) VNF Data Protection Requirements

The following ONAP requirement for VNF API Security is not included, as it adds no actual new requirement and only refers to Analytics Requirements:

R-02137 The VNF MUST implement all monitoring and logging as described in the Security Analytics section.

The following ONAP requirement for VNF API Security is not included. Law enforcement can be a use case for an IP device, but does not have a precedent for an access device -

R-78066 The VNF MUST support requests for information from law enforcement and government agencies.