A New Approach for Delivering Customized Security Everywhere: Security Service Chain

Abstract

Security functions are usually deployed on proprietary hardware, which makes the delivery of security service inflexible and of high cost. Emerging technologies such as software-defined networking and network function virtualization go in the direction of executing functions as software components in virtual machines or containers provisioned in standard hardware resources. They enable network to provide customized security service by deploying Security Service Chain (SSC), which refers to steering flow through multiple security functions in a particular order specified by individual user or application. However, SSC Deployment Problem (SSC-DP) needs to be solved. It is a challenging problem for various reasons, such as the heterogeneity of instances in terms of service capacity and resource demand. In this paper, we propose an SSC-based approach to deliver security service to users without worrying about physical locations of security functions. For SSC-DP, we present a three-phase method to solve it while optimizing network and security resource allocation. The presented method allows network to serve a large number of flows and minimizes the latency seen by flows. Comparative experiments on the fat-tree and Waxman topologies show that our method performs better than other heuristics under a wide range of network conditions.

Designing Security-Aware Service Requests for NFV-Enabled Networks

“…Namely, the authors of [13] tackled the problem of efficient Security Service Chain (SSC) deployment. A SSC is an ordered set of security functions composing a logical security service.…”

A Novel Method for Resource Efficient Security Service Chain Embedding Oriented to Cloud Datacenter Networks

“…To further demonstrate the effectivity of the proposed PSO algorithm, we compare our proposed algorithm with three other algorithms, and the compared approaches are all implemented in MATLAB. Since our proposed PSO algorithm consists of three parts, i.e., k-Dijkstra algorithm, the security level selection algorithm and the VSNF embedding algorithm, we combine some previous classical algorithms (e.g., greedy biased approaches [22], tabu search (TS)-based approach [32]) to generate the other three algorithms. The details are as follows.…”

“…The authors also demonstrate the effectivity the novel architecture. Liu et al [32] propose an SDN/NFV-enabled SSC orchestration architecture. Based on the architecture, the authors further present a meta-heuristic-based Tabu search algorithm, which aims to minimize the end-to-end delay and security resource cost.…”

“…Towards the end of the simulation (at approximately 100 SSC requests) in Fig.10(a), the algorithm run time of the ILP's solution is 92115.6 ms, the run time of the proposed PSO algorithm is 174.1 ms, the run time of the TS algorithm is 273.6 ms, and the run time of the GFP algorithm is 686.9 ms. The run time of the TS algorithm is mainly determined by the length of SSC || and the number of the substrate node || s , which performs the details, refer to[32]), where λ is the length of the Tabu list. Then, based on the ILP model for SSC-DMP, both Boolean variables and nonlinear constraints in the model are interactable for the large-scale network scenarios, with the computational complexity of…”

SDN/NFV tabanlı 5G ağlarında enerji-etkin güvenlik yönetimi ve trafik yönlendirme için kontrolcü tasarımı ve değerlendirmesi

“…Literatürdeki çalışmalarda, VNSF yerleştirme problemi için [3,7] çoğunlukla, yerleştirilen VNSF sayısı [8][9][10], bant genişliği [11][12][13] ve linklerin sayısı [14][15][16] gibi parametrelerin bir kombinasyonu olarak tanımlanan maliyetin [16][17][18] en aza indirgenmesi hedeflenmiştir. Fakat VNSF yerleştirme probleminde ele alınması gereken en önemli operasyonel amaçlardan biri, ağdaki enerji tüketiminin minimize edilmesidir.…”