A Secure Link-Layer Connectivity Platform for Multi-Site NFV Services

Vidal, Iván; Nogales, Borja; López, Diego; Rodríguez, Juan; Valera, Francisco; Azcorra, Arturo

doi:10.3390/electronics10151868

Cited by 4 publications

(8 citation statements)

References 26 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…References [21,22] discuss the deployment of VPN using OSM. In reference [21], the authors demonstrate how WireGuard can be incorporated into VNFs and compare the performance of WireGuard and OpenVPN.…”

Section: Related Workmentioning

confidence: 99%

“…On the other hand, Ref. [22] proposes the use of IPsec as a VPN solution to establish link-layer connectivity for multi-site deployments. In that work, multiple NSs are deployed using OSM and each NFV Infrastructure (NFVI) is connected through one VNF.…”

Section: Related Workmentioning

confidence: 99%

“…In addition, the initialization of VPN tunnels can also be delayed until the tenant manager completes the configuration process. Alternatively, the work in [22] proposes an approach that allows the application to send data right after Day-1 actions by inputting the necessary information, including keys. Another strategy is to use a Key Management System (KMS); however, OSM does not support this functionality.…”

mentioning

confidence: 99%

See 2 more Smart Citations

Orchestrating Isolated Network Slices in 5G Networks

Esmaeily,

Kralevska

2024

Electronics

View full text Add to dashboard Cite

Sharing resources through network slicing in a physical infrastructure facilitates service delivery to various sectors and industries. Nevertheless, ensuring security of the slices remains a significant hurdle. In this paper, we investigate the utilization of State-of-the-Art (SoA) Virtual Private Network (VPN) solutions in 5G networks to enhance security and performance when isolating slices. We deploy and orchestrate cloud-native network functions to create multiple scenarios that emulate real-life cellular networks. We evaluate the performance of the WireGuard, IPSec, and OpenVPN solutions while ensuring confidentiality and data protection within 5G network slices. The proposed architecture provides secure communication tunnels and performance isolation. Evaluation results demonstrate that WireGuard provides slice isolation in the control and data planes with higher throughput for enhanced Mobile Broadband (eMBB) and lower latency for Ultra-Reliable Low-Latency Communications (URLLC) slices compared to IPSec and OpenVPN. Our developments show the potential of implementing WireGuard isolation, as a promising solution, for providing secure and efficient network slicing, which fulfills the 5G key performance indicator values.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

mentioning

confidence: 99%

See 1 more Smart Citation

Orchestrating Isolated Network Slices in 5G Networks

Esmaeily,

Kralevska

2024

Electronics

View full text Add to dashboard Cite

show abstract

“…In this context, this article presents a novel inter-domain connectivity orchestration service for NFV ecosystems. The service design carefully considers the lessons learned from our previous work [7], proposing a new approach to support VNF connectivity in multi-domain scenarios. Our solution uses NFV and SDN technologies to automate the creation of virtual networks to which VNFs deployed in different NFV infrastructure domains can be connected.…”

Section: Introductionmentioning

confidence: 99%

Software-Driven Connectivity Orchestration for Multidomain Network Functions Virtualization Ecosystems

Nogales,

Vidal,

Valera

et al. 2024

IEEE Softw.

Self Cite

View full text Add to dashboard Cite

Network Functions Virtualization (NFV) is a fundamental enabler in 5G networks, automating service deployment through softwarization and virtualization. However, challenges remain in providing network connectivity to service components, commonly referred to as Virtual Network Functions (VNFs), deployed on different domains. A usual approach to enable such connectivity is to rely on layer-3 routing from Internet service providers. However, this approach presents limitations to preserve isolation among remote VNFs, and may require undesirable network configurations. This paper proposes a novel connectivity orchestration service for multi-domain NFV ecosystems to address these limitations. The service is based on a set of interconnected software components that are deployed on every NFV domain. Connectivity is automatically provided to remote VNFs over the overlay network formed by these components using Software-Defined Network (SDN) technologies. The service has been prototyped using open-source software, being validated on a real NFV ecosystem.

show abstract

“…Several studies are conducted on the security deployment of virtual networks. It is assumed that substrate and virtual nodes have different security demand levels and security levels 10 , 15 . Substrate links have different security levels, and virtual links have different security demand levels.…”

Section: Introductionmentioning

confidence: 99%

A security-aware service function chain deployment method for load balance and delay optimization

Zhai

Meng

et al. 2022

Sci Rep

View full text Add to dashboard Cite

Network function virtualization (NFV) decouples network functions from hardware devices. However, it introduces security challenges due to its reliance on software, which facilitates attacks. This security problem has a significant negative impact on the interests of users. Existing deployment methods are not suitable for SFC requests with a security demand, causing the use of substrate resources unreasonable and lower acceptance ratio. Moreover, a strict delay requirement is another challenge for NFV. To make the use of the substrate resources more reasonable and reduce the transmission delay, this paper proposes a security-constraint and function-mutex-constraint consolidation (SFMC) method for virtual network function (VNF) to reduce resource consumption and transmission delay. In addition, a security-aware service function chain (SASFC) deployment method for load balance and delay optimization is presented, which deploys service function chains according to the consolidated results of the SFMC method. The SASFC method first obtains a candidate server node set using resource, hosting capacity, security and node load constraints. It then obtains candidate paths according to the metric of the minimum transmission delay and link load constraint using the Viterbi algorithm. Finally, the path with the highest VNF security level match degree among the candidate paths is adopted to deploy virtual links, and the corresponding server nodes are employed to deploy VNFs. As a result, the SASFC method makes the use of substrate resources more reasonable. It improves the acceptance ratio and long-term average revenue to cost ratio, reduces transmission delay, and achieves load balancing. Experiment results show that when the number of VNFs is five, the acceptance ratio and long-term average revenue to cost ratio of the SASFC method are close to 0.75 and 0.88, which are higher than those of the compared methods. Its transmission delay and proportion of bottleneck nodes are 7.71 and 0.024, which are lower than those of the compared methods. The simulations demonstrate the effectiveness of the SASFC method.

show abstract

A Secure Link-Layer Connectivity Platform for Multi-Site NFV Services

Cited by 4 publications

References 26 publications

Orchestrating Isolated Network Slices in 5G Networks

Orchestrating Isolated Network Slices in 5G Networks

Software-Driven Connectivity Orchestration for Multidomain Network Functions Virtualization Ecosystems

A security-aware service function chain deployment method for load balance and delay optimization

Contact Info

Product

Resources

About