Threat Model¶

This document outlines the threat model for the Edge Computing LLM platform, identifying potential attack vectors and the mitigations implemented to secure the system.

Attack Surface Diagram¶

flowchart TD
    subgraph External[External Network]
        User[User / Client]
        Attacker[Malicious Actor]
    end

    subgraph EdgeNode[Edge Node (Ubuntu)]
        subgraph K3s[K3s Cluster]
            subgraph WebUI_NS[Namespace: default]
                WebUI[Open WebUI :8080]
            end

            subgraph LLM_NS[Namespace: llm-observability]
                Ollama[Ollama API :11434]
                Prometheus[Prometheus :9090]
                Grafana[Grafana :80]
            end

            subgraph GPU_NS[Namespace: gpu-operator]
                DevicePlugin[NVIDIA Device Plugin]
                DCGM[DCGM Exporter]
            end
        end
        HostOS[Host OS / Kubelet]
        GPU[NVIDIA GPU]
    end

    User -->|HTTPS/TLS| WebUI
    Attacker -->|Probing| EdgeNode
    WebUI -->|HTTP Internal| Ollama
    Prometheus -->|Scrape| Ollama
    Prometheus -->|Scrape| DCGM
    Ollama -->|CUDA| GPU

Asset Classification¶

Threat Categories (STRIDE Mapping)¶

1. Spoofing¶

• Threat: An attacker masquerades as a legitimate user or internal service.
• Example: A rogue pod attempting to access the Ollama API directly, bypassing Open WebUI authentication.
• Mitigation: NetworkPolicies restrict access to Ollama on port 11434 only to the Open WebUI pod. Mutual TLS (mTLS) can be enabled via service mesh if required.

2. Tampering¶

• Threat: Malicious modification of model weights, configurations, or system binaries.
• Example: Modifying the Modelfile to inject a malicious system prompt.
• Mitigation: Container images are pinned by SHA256 digests. PodSecurityStandards (PSS) restrict root filesystem write access. The node OS should utilize immutable file systems or FIM (File Integrity Monitoring).

3. Repudiation¶

• Threat: Actions performed by a user or attacker cannot be traced back to them.
• Example: A user submits harmful prompts, but there is no log tying the prompt to their identity.
• Mitigation: Open WebUI maintains audit logs of user interactions. edge-cli logs aggregates systemic logs centrally.

4. Information Disclosure¶

• Threat: Exposure of sensitive user prompts, model outputs, or system metrics.
• Example: An attacker intercepts traffic between Open WebUI and Ollama.
• Mitigation: TLS termination at the ingress controller. Internal traffic is isolated within the cluster network. Evidence collection tools (edge-llm-tests) sanitize all exported logs.

5. Denial of Service (DoS)¶

• Threat: Exhaustion of system resources (CPU, RAM, VRAM), rendering the platform unavailable.
• Example: Sending massive context windows to the LLM, causing an OOM (Out Of Memory) killer event on the GPU or node.
• Mitigation: ResourceQuotas and LimitRanges are enforced via Kubernetes. Ollama is configured with strict num_ctx limits per model profile.

6. Elevation of Privilege¶

• Threat: An attacker gains elevated permissions, potentially escaping a container to compromise the host.
• Example: Exploiting a vulnerability in the NVIDIA container toolkit to gain root on the Ubuntu host.
• Mitigation: Pods run with securityContext.runAsNonRoot: true where possible. The NVIDIA GPU operator uses strict RBAC and drops unneeded capabilities.

Ongoing Security Lifecycle¶

• CVE Scanning: Container images are scanned via Trivy during the CI build process.
• Updates: k3s-nvidia-edge handles automated patching of core components.