5G MEC/Slice System to Support Cloud Gaming, HD Video and Live Broadcasting Blueprint

AI/ML and AR/VR applications at Edge

• ELIOT AIoT in Smart Office Blueprint

• ELIOT IoT Gateway Blueprint

1. Performing test ID BOOT-5122 (Check for GRUB boot password)  ## After setting up grub boot password --> Cloud Vms won’t boot properly. Lead to unstable VMs
2. Performing test ID AUTH-9229 (Check password hashing methods) ## Not possible, will impact SHA_MIN_CRYPT_ROUNDS test.  Currently using maximum security hashing method SHA512
3. Performing test ID USB-2000 (Check USB authorizations)  ## N/A:  Using cloud VMs, no baremetal involved.
4. Performing test ID USB-3000 (Check for presence of USBGuard)  ## N/A:  Using cloud VMs, no baremetal involved.
5. Test: Checking MaxSessions  ## Max session set to 4, this is the bare minimum level that can be used.
6. Test: Checking Port  ## Can't change during testing, BluVal requires SSH to be tcp/22.  This port should be changed after testing, but prior to production.

The following exceptions must be fixed prior to maturity review:

1. sysctl key kernel.core_uses_pid contains equal expected and current value (1)
2. sysctl key kernel.kptr_restrict has a different value than expected in scan profile. Expected=2, Real=0
3. sysctl key kernel.sysrq has a different value than expected in scan profile. Expected=0, Real=16
4. sysctl key net.ipv4.conf.all.log_martians contains equal expected and current value (1)
5. sysctl key net.ipv4.conf.all.send_redirects contains equal expected and current value (0)
6. sysctl key net.ipv4.conf.default.accept_redirects contains equal expected and current value (0)
7. sysctl key net.ipv4.conf.default.log_martians contains equal expected and current value (1)
8. sysctl key net.ipv6.conf.all.accept_redirects has a different value than expected in scan profile. Expected=0, Real=1
9. sysctl key net.ipv6.conf.default.accept_redirects has a different value than expected in scan profile. Expected=0, Real=1

The following exceptions must be fixed prior to maturity review:

1. CAP_NET_RAW Enabled - CAP_NET_RAW is enabled by default for pods.  If an attacker manages to compromise a pod, they could potentially take advantage of this capability to perform network attacks on other pods running on the same node.

• ELIOT SD-WAN/WAN Edge/uCPE Blueprint

1. Performing test ID AUTH-9229 (Check password hashing methods) ## Not possible, will impact SHA_MIN_CRYPT_ROUNDS test.  Currently using maximum security hashing method SHA512
2. Performing test ID USB-2000 (Check USB authorizations)  ## N/A:  Using cloud VMs, no baremetal involved.
3. Performing test ID USB-3000 (Check for presence of USBGuard)  ## N/A:  Using cloud VMs, no baremetal involved.
4. Test: Checking MaxSessions  ## Max session set to 4, this is the bare minimum level that can be used.
5. Test: Checking Port  ## Can't change during testing, BluVal requires SSH to be tcp/22.  This port should be changed after testing, but prior to production.

The following exceptions must be fixed prior to maturity review:

1. sysctl key kernel.kptr_restrict has a different value than expected in scan profile. Expected=2, Real=0
2. sysctl key kernel.sysrq has a different value than expected in scan profile. Expected=0, Real=16
3. sysctl key kernel.yama.ptrace_scope has a different value than expected in scan profile. Expected=1 2 3, Real=0
4. sysctl key net.ipv4.conf.all.log_martians contains equal expected and current value (1)
5. sysctl key net.ipv4.conf.all.send_redirects contains equal expected and current value (0)
6. sysctl key net.ipv4.conf.default.accept_redirects contains equal expected and current value (0)
7. sysctl key net.ipv4.conf.default.log_martians contains equal expected and current value (1)
8. sysctl key net.ipv6.conf.all.accept_redirects has a different value than expected in scan profile. Expected=0, Real=1
9. sysctl key net.ipv6.conf.default.accept_redirects has a different value than expected in scan profile. Expected=0, Real=1

The following exceptions must be fixed prior to maturity review:

1. CAP_NET_RAW Enabled - CAP_NET_RAW is enabled by default for pods.  If an attacker manages to compromise a pod, they could potentially take advantage of this capability to perform network attacks on other pods running on the same node.

• IEC Type 1 for Integrated Edge Cloud (IEC) Blueprint Family

• IEC Type 2 for Integrated Edge Cloud (IEC) Blueprint Family

• IEC Type 3: Android cloud native applications on Arm servers in edge for Integrated Edge Cloud (IEC) Blueprint Family

• IEC Type 4: AR/VR oriented Edge Stack for Integrated Edge Cloud (IEC) Blueprint Family

• IEC Type 5: SmartNIC for Integrated Edge Cloud (IEC) Blueprint Family

Micro-MEC

• Radio Edge Cloud (REC)

• SDN Enabled Broadband Access (SEBA) for Telco Appliance Blueprint Family

Time-Critical Edge Compute

Akraino Blueprint Validation Framework

Akraino Portal Feature Project

API Gateway