Security Management Architecture for NFV/SDN-Aware IoT Systems

5G networks represent a paradigm shift from their 4G predecessors, engineered to cater to the burgeoning demands of densely populated areas and the high data throughput requirements of the Internet of Things (IoT) and smart city infrastructures. Beyond enhancing fundamental network attributes such as reliability, availability, and security, 5G introduces architectural innovations to accommodate these advanced needs. This paper delves into the architectural nuances of 5G, focusing primarily on the Standalone (SA) deployment method, distinguished by its utilization of network slicing. This approach leverages cutting-edge virtual network technologies, including Software-Defined Networking (SDN) and Network Function Virtualization (NFV), to forge virtual network slices tailored to diverse consumer needs. Such customization is imperative for meeting the expansive and varied connectivity demands characteristic of 5G networks.To navigate the complexities of 5G architecture, this study advocates for the adoption of Reference Architectures (RAs), which provide a high-level abstraction framework for dissecting and understanding intricate systems. By proposing a model that outlines the standalone architecture of 5G networks, our research lays the groundwork for evolving this model into a comprehensive RA for 5G. This foundational work is instrumental in equipping system designers with the tools necessary for generalizing systems to manage design and deployment challenges effectively, as well as the heterogeneity inherent in system components. Additionally, our proposed model facilitates the establishment of a common vocabulary, promoting a coherent understanding of component interactions and offering a unified system perspective. Ultimately, this paper contributes a pivotal model that not only enhances our comprehension of 5G network architecture but also paves the way for future advancements in network design and deployment, promising to significantly impact the development of smart cities and IoT ecosystems.Keywords: 5G, 5G architecture, Reference architecture, patterns. Network slicing, Network Function Virtualization, Virtual Network Function.

Internet of Things (IoT) has been increasingly developed to provide essential IoT services ranging from personal health, smart homes to smart cities, and critical infrastructures. Sensor/IoT devices are indispensable elements in these systems/services. However, they are too rigid to permit reconfiguration for changes after their implementation. This makes it difficult to provision IoT services on demand and causes inefficient utilization of resources. Software-defined networking (SDN) and Network function virtualization (NFV) are emerging solutions to the programmability of network functions. Provisioning IoT services on demand is a natural utilization of programmability. Inspired by the benefits of SDN-NFV programmability, this paper proposes a softwaredefined virtual sensor (SDVS) that enables the programmability of IoT devices in accordance with IoT applications on demand. The paper presents the design and implementation of the proposed SDVS and demonstrates its use in an on-demand IoT services scenario.

The discovery process of OPC Unified Architecture (OPC-UA) is well defined but lacks flexibility when implemented in large networks. While the standard provides concepts for local and global discovery services, the core assumption is that all clients and servers are aware of the discovery server(s) in the network. This dependency is a barrier for Plug-and-Play installations and is overcome by self announces via the multicast Domain Name System (mDNS), however, this scales badly with an increasing number of network nodes and deployed servers. We propose a discovery approach based on Software-Defined Networking (SDN) and Network Function Virtualization (NFV), that installs a plug-and-play mechanism for global OPC-UA discovery in modern virtualized networks.

5G will provide broadband access everywhere, entertain higher user mobility, and enable connectivity of massive number of devices (e.g. Internet of Things (IoT)) in an ultrareliable and affordable way. The main technological enablers such as cloud computing, Software Defined Networking (SDN) and Network Function Virtualization (NFV) are maturing towards their use in 5G. However, there are pressing security challenges in these technologies besides the growing concerns for user privacy. In this paper, we provide an overview of the security challenges in these technologies and the issues of privacy in 5G. Furthermore, we present security solutions to these challenges and future directions for secure 5G systems.

Internet of Things (IoT) enables intelligent services varying with the complex and realtime environment to achieve network benefits, where Network Function Virtualization (NFV) can dynamically provide Virtualized Network Functions (VNFs) for IoT devices. In NFV-enabled IoT architecture, a service function chain (SFC) consists of an ordered set of virtual network functions (VNFs). However, the energy consumption of the VNF migration and SFC reconfiguration is one major issue owing to the dynamic characteristic of IoT network. In this paper, we propose a new paradigm digital twin (DT) to create the virtual twin of physical objects in IoT network, then, we formalize the problem as a mathematical model, which aims to minimize the energy consumption. To this end, we prove this problem is NP-hard and propose an algorithm Bidirectional Gated Recurrent Unit (Bi-GRU) based on federated learning to predict the resource requirement. Further more, according to the prediction result, which utilizing the deep reinforcement learning (DRL) algorithm for decision making of the VNF migration. Simulation results show that our proposed method can effectively reduce the number of VNFs to be migrated and economize the energy consumption of the digital twin IoT network.

The multi-mode green internet of things (IoT) provides a communication support for social assets of smart park connecting to power grid for low-carbon operation. Software defined networking (SDN) and network function virtualization (NFV) can flexibly integrate heterogeneous communication modes through network resource scheduling and route management. However, the joint optimization of virtual network functions (VNF) embedding and flow scheduling faces several challenges of differentiated QoS guarantee, coupling and externality of VNF embedding, and route selection conflicts. In this work, a multi-timescale VNF Embedding and floW Scheduling algorithm named NEWS is proposed to maximize throughput while reducing VNF embedding cost and energy consumption. Specifically, the joint optimization problem is transformed into three subproblems, i.e., large-timescale VNF embedding, small-timescale admission control, small-timescale route selection and computation resource allocation. A swap matching-based low-cost VNF embedding algorithm is proposed for the first subproblem. Then, a queue backlog threshold-based admission control strategy is proposed for the second subproblem. Next, the third subproblem is decomposed into two stages, where a collaborative Q-learning-based backpressure-aware algorithm is presented in the first stage, and a greedy-based computation resource allocation algorithm is given in the second stage. Simulations demonstrate that NEWS performs superior in throughput, embedding cost, and energy consumption.

With the recent progress in development of low-budget sensors and machine-to-machine communication, the Internet of Things (IoT) has attracted considerable attention. Unfortunately, many of today’s IoT devices are rushed to market with little consideration for basic security and privacy protection making them easy targets for various attacks. As a result, number of malware and their variants designed for IoT devices has been constantly increasing. Traditional intrusion detection approaches are unsuitable for IoT networks due to limited computational capacity of smart devices and diversity in their technology. In this paper, we propose a defense system for IoT networks based on software-defined networking and network function virtualization. The defense system core component is a reinforcement machine learning agent that evaluates risks of potential attack and takes the most optimal action in order to mitigate it.

Network Function Virtualization (NFV) has promoted the implementation of network functions from expensive hardwares to software middleboxes. These software middleboxes, also called Virtual Network Functions (VNFs), are executed on switch-connected servers. Efficiently deploying such VNFs on servers is challenging because the traffic rate of flows must be fully processed by their requested VNFs when they reach destinations, and the deployed positions of VNFs are restricted by the server capacity. In addition, each network function offers non-uniform VNF models (types) with different configurations of processing volumes and costs. This paper focuses on minimizing the total cost of deploying VNFs for providing a specific network function to all flows in tree-structured networks. First, we prove the NP-hardness of non-uniform VNF deployment in a tree topology and propose a dynamic programming based solution with a pseudo-polynomial time complexity. Then we narrow it down to three simplified cases by focusing on either uniform VNFs or the linear line topology. Specifically, three algorithms are introduced: an improved dynamic programming based algorithm for deploying uniform VNFs in a tree topology, a performance-guaranteed algorithm for deploying non-uniform VNFs in a linear line topology, and an optimal greedy algorithm for deploying uniform VNFs in a linear line topology. Additionally, we generalize our approach to a case of deploying a service chain, which consists of multiple network functions applied to flows in a specific order. We propose two solutions: one is optimal but time-consuming while another is heuristic but efficient. Extensive simulations are conducted to evaluate our algorithms.

It is our great pleasure to welcome you to the 2018 ACM International Workshop on Security in Software Defined Networks & Network Function Virtualization - SDN-NFV Security'18. SDN-NFV Security'18 offers a unique opportunity by bringing together researchers from academic, industry, as well as government agencies to discuss security challenges faced by two emerging networking paradigms, Software-Defined Networking (SDN) and Network Function Virtualization (NFV). SDN-NFV Security'18 solicits the submission of original unpublished ideas in 6-page long papers and 4-page short papers that address the latest practices, experiences, and lessons learned on SDN and NFV security. The call for papers attracted submissions from Europe and the United States. SDN-NFV Security'18 accepted 3 full papers be presented in this workshop, after a rigorous review process (at least 4 reviews for each paper) and discussion phase. In addition, we have invited 8 papers (5 full papers and 3 short papers) from domain experts to be presented in the workshop.

The Internet of Things (IoT) is increasingly creating new market possibilities in several industries’ sectors such as smart homes, smart manufacturing, and smart cities, to link the digital and physical worlds. A key challenge in an IoT system is to ensure network performance and cost-efficiency when a plethora of data is generated and proliferated. The adoption of Network Function Virtualization (NFV) technologies within an IoT environment enables a new approach of providing services in a more agile and cost-efficient way. We address the problem of traffic engineering with multiple paths for an NFV enabled IoT system (vIoT), taking into account the fluctuation of traffic volume in various time periods. We first formulate the problem as a mixed linear integer programming model for finding the optimal solution of link-weight configuration and traffic engineering. We then develop heuristic algorithms for a vIoT system with a large number of devices. Our solution enables a controller to adjust a link weight system and update a flow table at an NFV switch for directing IoT traffic through a service function chain in a vIoT system. The evaluation results under both synthetic and real-world datasets of network traffic and topologies show that our approach to traffic engineering with multiple paths remarkably improves several performance metrics for a vIoT system.

Attack-aware Security Function Management

SummaryAs an emerging technology, blockchain (BC) has been playing a promising role in today's software‐defined networking (SDN)‐enabled Internet of Things (IoT) applications. Because of the salient feature of the network function virtualization (NFV) techniques, SDN can ensure an IoT system runs efficiently and smoothly in a cloud‐driven ecosystem. When cloud‐enabled systems encounter immense security and operational challenges caused mainly by third‐party dependency, large‐scale data communication, and maintenance, BC offers effective and robust data transfer solutions without incorporating intermediaries over the distributed network. With the increased SDN‐BC convergence in the IoT domain, the underlying challenges and perspectives deserve proper attention methodically and structurally. From the motivation of addressing such issues, this study provides necessary insights to combine those for successful plug‐and‐play. Therefore, the study includes purposefully investigating current state‐of‐the‐art to extract the research trends, future directions, and perspectives in this domain. This study provides a comprehensive survey of IoT, SDN, NFV, and BC‐enabled emerging technologies. More importantly, the authors intelligently integrated the four different technologies—IoT, SDN, BC, and NFV based on characteristics, scopes, challenges, taxonomies, and tables in numerous areas. Initially, the authors introduce the SDN‐IoT ecosystem in brief and address the features and applications. We took a close look at the SDN's overall taxonomy based on security, environment, scopes, and challenges. We also briefly describe the integration of SDN‐IoT with the NFV ecosystems. Moreover, we review the prospect of BC technology from security perspectives, its extent, challenges of practical implementation, and the possible integration of IoT regarding smart applications. Finally, this study highlights several future directions based on these technologies.

Fault tolerant placement of stateful VNFs and dynamic fault recovery in cloud networks

Chapter 3 - HetNet/M2M/D2D communication in 5G technologies

5G is raising high expectations, offering new avenues for research, and paving the way to a safer and highperforming set of innovative use-cases. For use-cases related for instance to Internet of Things (IoT), self-driving vehicles, or unmanned aerial vehicles (UAVs), the programming and management of the underlying network resources will be carried out in a dynamic and scalable manner. In this vein, many enabling technologies are adopted by service providers, cloud providers and enterprises, such as Software Defined Networking (SDN) and Network Function Virtualization (NFV).