A novel approach for integrating security policy enforcement with dynamic network virtualization

Attack-aware Security Function Management

<p>Network Functions Virtualization (NFV) has been a key part of evolving communication systems in the last few years. However, the life-cycle management of Virtual Network Functions (VNF) is still a not trivial task. Blockchains (BC), due to their decentralization and immutability characteristics, together with the automation provided by Smart Contracts (SC), can be employed to enable such automated and trustworthy VNF management.Thus, this paper proposes VeNiCE to automate the deployment and life-cycle management of VNFs using events emitted on SCs. VeNiCE provides automation and auditability by relying on a BC to provide a decentralized approach for VNF management, which performs management actions, such as VNF deployment and deletion, and based on events and communicates with an SC to provide immutable logging of the VNF life-cycle. VeNiCE provides (i) a frontend for user interaction, (ii) a backend implementing the communication with the NFV framework, and (iii) an SC that emits events, stores VNF allocations, and authenticates users. A prototype of VeNiCE was developed and deployed in the Ethereum BC using OpenStack Tacker as an NFV platform. Experiments were conducted in a real-world deployment of such a prototype to analyze the economic costs of using SCs and the time required to process requests by each component of VeNiCE and the BC. Those results obtained show VeNiCE’s feasibility, highlight its benefits achieved with the automation and provide insights on reducing costs by exploring additional BC platforms and different deployment types, which introduce centralization and management concerns.</p>

Security functions are usually deployed on proprietary hardware, which makes the delivery of security service inflexible and of high cost. Emerging technologies such as software-defined networking and network function virtualization go in the direction of executing functions as software components in virtual machines or containers provisioned in standard hardware resources. They enable network to provide customized security service by deploying Security Service Chain (SSC), which refers to steering flow through multiple security functions in a particular order specified by individual user or application. However, SSC Deployment Problem (SSC-DP) needs to be solved. It is a challenging problem for various reasons, such as the heterogeneity of instances in terms of service capacity and resource demand. In this paper, we propose an SSC-based approach to deliver security service to users without worrying about physical locations of security functions. For SSC-DP, we present a three-phase method to solve it while optimizing network and security resource allocation. The presented method allows network to serve a large number of flows and minimizes the latency seen by flows. Comparative experiments on the fat-tree and Waxman topologies show that our method performs better than other heuristics under a wide range of network conditions.

The integration of software-defined networking (S-DN) and network function virtualization (NFV) is expected to achieve the convenient management and flexible deployment of various sophisticated network functions, and support user applications with guaranteed quality of service (QoS). In this paper, we jointly study route selection and network function placement problem. To stress the service sensitivity on delay, we formulate an optimization problem which minimizes the total end-to-end delay subject to data transmission, service requirement and various available resource constraints. As the formulated problem is an NP-hard problem, which cannot be solved easily, we transform it into three subproblems, i.e., route selection subproblem, network function placement subproblem and resource sharing subproblem of user flows, and solve the three subproblems by applying the K-shortest paths algorithm, Kuhn-Munkres (K-M) algorithm and Lagrangian dual method, respectively. Numerical results demonstrate the effectiveness of the proposed algorithm.

The discovery process of OPC Unified Architecture (OPC-UA) is well defined but lacks flexibility when implemented in large networks. While the standard provides concepts for local and global discovery services, the core assumption is that all clients and servers are aware of the discovery server(s) in the network. This dependency is a barrier for Plug-and-Play installations and is overcome by self announces via the multicast Domain Name System (mDNS), however, this scales badly with an increasing number of network nodes and deployed servers. We propose a discovery approach based on Software-Defined Networking (SDN) and Network Function Virtualization (NFV), that installs a plug-and-play mechanism for global OPC-UA discovery in modern virtualized networks.

With the large-scale commercial application of data center networks, the security problem of data center network is attracting more and more attention. However, security functions are usually placed on proprietary hardware, which makes the delivery of security service inflexible and of high cost. The emerging software-defined networking and network function virtualization in a joint manner are promising technology that can solve these outlined problems through a process named security service chaining (SSC) composition. Determining the composition of SSC that optimizes the resource allocation is a challenging problem, particularly without violating security and resource requirements. This problem is called the dynamic SSC composition problem, and an integer linear programming formulation with implementation in GLPK is provided. A novel heuristic solution is provided based on the breadth first search algorithm. The obtained experimental results show that the proposed algorithm can perform better than the compared ones, and the advantage of the proposed mechanism is also demonstrated via NetFPGA-10G prototype.

The human element is often found to be the weakest link in the information security chain. The Personal Information Security Assistant project aims to address this by improving the privacy and security awareness of end-users and by aligning the user's personal IT environment to the user's security requirements. It does this by elicitation of a user's privacy and security requirements (risk appetite) as well as a user's risk perception. The PISA then takes action by aligning the user's requirements and perceptions, thereby improving user awareness regarding privacy and security. This article outlines the research questions, methodology and current results associated with the PISA project.

Network Function Virtualization (NFV) has promoted the implementation of network functions from expensive hardwares to software middleboxes. These software middleboxes, also called Virtual Network Functions (VNFs), are executed on switch-connected servers. Efficiently deploying such VNFs on servers is challenging because the traffic rate of flows must be fully processed by their requested VNFs when they reach destinations, and the deployed positions of VNFs are restricted by the server capacity. In addition, each network function offers non-uniform VNF models (types) with different configurations of processing volumes and costs. This paper focuses on minimizing the total cost of deploying VNFs for providing a specific network function to all flows in tree-structured networks. First, we prove the NP-hardness of non-uniform VNF deployment in a tree topology and propose a dynamic programming based solution with a pseudo-polynomial time complexity. Then we narrow it down to three simplified cases by focusing on either uniform VNFs or the linear line topology. Specifically, three algorithms are introduced: an improved dynamic programming based algorithm for deploying uniform VNFs in a tree topology, a performance-guaranteed algorithm for deploying non-uniform VNFs in a linear line topology, and an optimal greedy algorithm for deploying uniform VNFs in a linear line topology. Additionally, we generalize our approach to a case of deploying a service chain, which consists of multiple network functions applied to flows in a specific order. We propose two solutions: one is optimal but time-consuming while another is heuristic but efficient. Extensive simulations are conducted to evaluate our algorithms.

5G networks represent a paradigm shift from their 4G predecessors, engineered to cater to the burgeoning demands of densely populated areas and the high data throughput requirements of the Internet of Things (IoT) and smart city infrastructures. Beyond enhancing fundamental network attributes such as reliability, availability, and security, 5G introduces architectural innovations to accommodate these advanced needs. This paper delves into the architectural nuances of 5G, focusing primarily on the Standalone (SA) deployment method, distinguished by its utilization of network slicing. This approach leverages cutting-edge virtual network technologies, including Software-Defined Networking (SDN) and Network Function Virtualization (NFV), to forge virtual network slices tailored to diverse consumer needs. Such customization is imperative for meeting the expansive and varied connectivity demands characteristic of 5G networks.To navigate the complexities of 5G architecture, this study advocates for the adoption of Reference Architectures (RAs), which provide a high-level abstraction framework for dissecting and understanding intricate systems. By proposing a model that outlines the standalone architecture of 5G networks, our research lays the groundwork for evolving this model into a comprehensive RA for 5G. This foundational work is instrumental in equipping system designers with the tools necessary for generalizing systems to manage design and deployment challenges effectively, as well as the heterogeneity inherent in system components. Additionally, our proposed model facilitates the establishment of a common vocabulary, promoting a coherent understanding of component interactions and offering a unified system perspective. Ultimately, this paper contributes a pivotal model that not only enhances our comprehension of 5G network architecture but also paves the way for future advancements in network design and deployment, promising to significantly impact the development of smart cities and IoT ecosystems.Keywords: 5G, 5G architecture, Reference architecture, patterns. Network slicing, Network Function Virtualization, Virtual Network Function.

Traditional network resident functions (e.g., firewalls, network address translation) and middleboxes (caches, load balancers) have moved from purpose-built appliances to software-based components. However, L2/L3 network functions (NFs) are being implemented on Network Function Virtualization (NFV) platforms that extensively exploit kernel-bypass technology. They often use DPDK for zero-copy delivery and high performance. On the other hand, L4/L7 middleboxes, which usually require full network protocol stack support, take advantage of a full-fledged kernel-based system with a greater emphasis on functionality. Thus, L2/L3 NFs and middleboxes continue to be handled by distinct platforms on different nodes.This paper proposes MiddleNet that seeks to overcome this dichotomy by developing a unified network resident function framework that supports L2/L3 NFs and L4/L7 middleboxes. MiddleNet supports function chains that are essential in both NFV and middlebox environments. MiddleNet uses DPDK for zero-copy packet delivery without interrupt-based processing, to enable the ‘bump-in-the-wire’ L2/L3 processing performance required of NFV. To support L4/L7 middlebox functionality, MiddleNet utilizes a consolidated, kernel-based protocol stack processing, avoiding a dedicated protocol stack for each function. MiddleNet fully exploits the event-driven capabilities provided by the extended Berkeley Packet Filter (eBPF) and seamlessly integrates it with shared memory for high-performance communication in L4/L7 middlebox function chains. The overheads for MiddleNet are strictly load-proportional, without needing the dedicated CPU cores of DPDK-based approaches. MiddleNet supports flow-dependent packet processing by leveraging Single Root I/O Virtualization (SR-IOV) to dynamically select packet processing needed (Layer 2 to Layer 7). Our experimental results show that MiddleNet can achieve high performance in such a unified environment.

It is our great pleasure to welcome you to the 2018 ACM International Workshop on Security in Software Defined Networks & Network Function Virtualization - SDN-NFV Security'18. SDN-NFV Security'18 offers a unique opportunity by bringing together researchers from academic, industry, as well as government agencies to discuss security challenges faced by two emerging networking paradigms, Software-Defined Networking (SDN) and Network Function Virtualization (NFV). SDN-NFV Security'18 solicits the submission of original unpublished ideas in 6-page long papers and 4-page short papers that address the latest practices, experiences, and lessons learned on SDN and NFV security. The call for papers attracted submissions from Europe and the United States. SDN-NFV Security'18 accepted 3 full papers be presented in this workshop, after a rigorous review process (at least 4 reviews for each paper) and discussion phase. In addition, we have invited 8 papers (5 full papers and 3 short papers) from domain experts to be presented in the workshop.

Fault tolerant placement of stateful VNFs and dynamic fault recovery in cloud networks

Various real-time, latency-sensitive, and high-speed mobile applications are evolving as 5G applications. These applications are realized using Multi-access Edge Computing (MEC) and Network Function Virtualization (NFV) technologies in the 5G system. MEC platform, MEC service, and MEC application are the main components of an MEC Framework. NFV Orchestrator, Virtualized Infrastructure Manager (VIM), and virtualization technologies such as Virtual Machines (VM) and Containers are the main pillars of the NFV technology. In this paper, we study the impact of the virtualization technologies in the deployment of the MEC framework and its components while. We also study the impact of virtualization technologies on NFV and MEC KPIs such as onboarding time, instantiation time, MEC service and application response times. The experiments and its analysis show that containers perform better than VM to instantiate/terminate MEC components in the NFV framework. The observed MEC service KPIs show that the edge application’s performance will be improved to meet the QoE of the applications irrespective of the virtualization technology used. These results can be used as a reference while deploying the MEC components based on their granular functionalities.

With the growth of network applications such as 5G and artificial intelligence, network security techniques, i.e., the techniques that detect various attacks (e.g., well-known denial-of service (DDoS) attacks) and prevent production networks (e.g., data center networks) from being attacked, become increasingly essential for network management and have gained great popularity in the networking community. Generally, these techniques are built on proprietary hardware appliances, i.e., middleboxes, or the paradigm that combines both software-defined networking (SDN) and network function virtualization (NFV) to implement security functions. However, the techniques built on middleboxes are proven to be hard-to-manage, costly, and inflexible, thereby making them an out-of-date choice in network security. For the techniques built on SDN and NFV, they virtualize and softwarize security functions on commodity servers, leading to non-trivial performance degradation. Fortunately, the recent emergence of programmable switches brings new opportunities of empowering network security techniques with the characteristics of easy-tomanage, low cost, high flexibility, and Tbps-level performance. In this survey, we focus on this promising trend in network security. More precisely, this survey first presents the preliminaries of programmable switches, which are the primary driver of next-generation network security techniques. Next, we comprehensively review existing techniques built on programmable switches, classify these techniques, and discuss their background, motivation, design, implementation, and limitations case-by-case. Finally, we summarize open issues and future research directions in this promising research topic of network security.

Diverse proprietary network appliances increase both the capital and operational expense of service providers, meanwhile causing problems of network ossification. Network function virtualization (NFV) is proposed to address these issues by implementing network functions as pure software on commodity and general hardware. NFV allows flexible provisioning, deployment, and centralized management of virtual network functions. Integrated with SDN, the software-defined NFV architecture further offers agile traffic steering and joint optimization of network functions and resources. This architecture benefits a wide range of applications (e.g., service chaining) and is becoming the dominant form of NFV. In this survey, we present a thorough investigation of the development of NFV under the software-defined NFV architecture, with an emphasis on service chaining as its application. We first introduce the software-defined NFV architecture as the state of the art of NFV and present relationships between NFV and SDN. Then, we provide a historic view of the involvement from middlebox to NFV. Finally, we introduce significant challenges and relevant solutions of NFV, and discuss its future research directions by different application domains.