Today, the digital economy is pushing new business models, based on the creation of value chains for data processing, through the interconnection of processes, products, services, software, and things across different domains and organizations. Despite the growing availability of communication infrastructures, computing paradigms, and software architectures that already effectively support the implementation of distributed multi-domain value chains, a comprehensive architecture is still missing that effectively fulfills all related security issues: mutual trustworthiness of entities in partially unknown topologies, identification and mitigation of advanced multi-vector threats, identity management and access control, management and propagation of sensitive data. In order to fill this gap, this work proposes a new methodological approach to design and implement heterogeneous security services for distributed systems that combine together digital resources and components from multiple domains. The framework is designed to support both existing and new security services, and focuses on three novel aspects: (i) full automation of the processes that manage the whole system, i.e., threat detection, collection of information and reaction to attacks and system anomalies; (ii) dynamic adaptation of operations and security tasks to newest attack patterns, and (iii) real-time adjustment of the level of detail of inspection and monitoring processes. The overall architecture as well as the functions and relationships of its logical components are described in detail, presenting also a concrete use case as an example of application of the proposed framework.

Telecom operators have recently started to deploy massive computing and storage resources at the very edge of their access networks, hence evolving their infrastructures into large, distributed, and capillary computing environments, capable of placing applications very close to users and terminals and well-suited to effectively fulfill the challenging requirements for delay-sensitive applications. Edge computing is the emerging paradigm that pervasively brings computing in the environment, by shifting processing from data centers to the network edge, allowing a large class of applications in growing fields, like Big Data and the Internet of Things, to be deployed in a very effective way. In this paper, we propose middleware for running applications over heterogeneous environments, made of telecom networks and legacy data centers. We briefly review an emerging architecture for edge computing and describe an integrated solution for developing and deploying modular applications in an automatic way.

The convergence towards the IP protocol has made Internet access available almost everywhere; this has leveraged new expectations about continuous and seamless communication, especially when portable devices are involved. Mobility management is a key issue in this context. The original IP specification does not account for mobility. Nevertheless, since the beginning of the Internet there has been a continuous interest in managing nomadic hosts; this has brought to a large number of approaches and protocols that have faced the problem from different perspectives. This paper reviews different approaches to mobility management that have arisen during the years. It is intended to serve as a tutorial for this topic, which draws out the lesson learned until now and depicts a comprehensive picture to foster new ideas and solutions while avoiding duplication of past work.

The growing interest in agentless and serverless environments for the implementation of virtual/container network functions makes monitoring and inspection of network services challenging tasks. A major requirement concerns the agility of deploying security agents at runtime, especially to effectively address emerging and advanced attack patterns. This work investigates a framework leveraging the extended Berkeley Packet Filter to create ad-hoc security layers in virtualized architectures without the need of embedding additional agents. To prove the effectiveness of the approach, we focus on the detection of network covert channels, i.e., hidden/parasitic network conversations difficult to spot with legacy mechanisms. Experimental results demonstrate that different types of covert channels can be revealed with a good accuracy while using limited resources compared to existing cybersecurity tools (i.e., Zeek and libpcap).