Generic and agile service function chain verification on cloud

Zhang, Xiaoli; Li, Qi; Wu, Jianping; Yang, Jiahai

doi:10.1109/iwqos.2017.7969150

Cited by 18 publications

(5 citation statements)

References 22 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…18. With 100% detection rate, SDN-RDCD [22] shows an impressive results with 100% accuracy, while Generic [10] has 98%, Track [17] has more than 95.08% and FlowMon [19] has 77% accuracy. From the comparison, we can see that our mechanism is effective in detecting middleboxbypass attacks and compromised switches.…”

Section: B2 Results Evaluationmentioning

confidence: 99%

See 1 more Smart Citation

An efficient defense method for compromised switch and middlebox-bypass attacks in service function chaining

Thang

Park

2020

J. Commun. Netw.

View full text Add to dashboard Cite

Service function chaining (SFC) has a special and powerful ability to define an ordered list of required network services as a virtual chain and makes a network more flexible and manageable. However, there are many vulnerabilities to SFC, such as compromised switches and middlebox-bypass attacks, which can damage the operation and security of the network. In this study, we propose a mechanism that not only detects both middlebox-bypass attacks and compromised switch attacks in multiple service function chains scenario but also prevents such attacks and protects the network. The proposed mechanism uses both probe-based and statisticsbased methods to handle the probe packets and collect statistics from middleboxes for detecting any attacks in SFC. After detection, the mechanism changes the network topology to eliminate the compromised switches, while meeting the initial requirements of the service chains. By combining probe-based and statistics-based methods, our proposal overcomes the disadvantages of other proposed solutions and brings about a robust protection to SFC. As the experimental results indicate, the proposed mechanism is an effective and relevant approach for detecting and preventing compromised switches and middlebox-bypass attacks in SFC.

show abstract

Section: B2 Results Evaluationmentioning

confidence: 99%

“…There are several solutions to defeat this type of attack [9], [10]. With such solutions, tags are added to unused packet header fields to track the process on the middleboxes.…”

Section: B Middlebox-bypass Attackmentioning

confidence: 99%

An efficient defense method for compromised switch and middlebox-bypass attacks in service function chaining

Thang

Park

2020

J. Commun. Netw.

View full text Add to dashboard Cite

show abstract

“…Setting FPV' mechanisms may require modifying the internal logic of VNFs or the cloud framework [111], thus leading to complex and expensive development and deployment. To deal with such a challenge, Xiaoli Zhang [34] presented vSFC, a real-time FPV' scheme that exempts developers from modifying existing VNFs. Their verification scheme relies on a verification layer decoupled from VNFs' processing and embedded in VMs supporting VNFs.…”

Section: B Forwarding Paths Verificationmentioning

confidence: 99%

“…However, the proposed technique imposes significant overhead, likely induced by the hardware bottlenecks of Intel SGX. Running only the verification code in enclaves [34] could limit the overhead induced by Intel SGX.…”

Section: B Forwarding Paths Verificationmentioning

confidence: 99%

Network Services Anomalies in NFV: Survey, Taxonomy, and Verification Methods

Zoure

Ahmed

Réveillère

2022

IEEE Trans. Netw. Serv. Manage.

View full text Add to dashboard Cite

Network Function Virtualization (NFV) has emerged as a disruptive networking architecture whose galloping evolution is prompting enterprises to outsource network functions to the cloud and ultimately harvest the fruits of cloud computing, including elasticity, pay-as-you-go billing model, and on-demand services provisioning. However, many reluctant enterprises oppose the benefits of this outsourcing to their critical and pressing concerns about security, trust, and compliance. The latter anticipate possible security and QoS policy violations stemming from dishonest behaviors by cloud providers, attacks by co-resident competitors, misconfiguration by cloud administrators, or implementations flaws by NFV developers. As a result, migrating sensitive workloads to the cloud requires enterprises to first assess risks by gaining knowledge of possible network services' anomalies and second, to build trust in the cloud by designing effective mechanisms to detect such anomalies.This survey provides scrutiny of network services anomalies that may occur in the NFV environments. We first present a taxonomy of network service anomalies and analyze their negative impacts on critical service attributes, including security and performance. Second, we compare and classify the existing anomalies' verification mechanisms from the literature. Finally, we point out the literature gap and identify future research directions for anomalies verification in NFV.

show abstract

“…As for more advanced middleboxes, Zhang et al [50], [51] considered outsourced virtualized service function chaining (vSFC) and proposed the first scheme that could verify the correctness of the path traversal in vSFC hop by hop. This work focuses on path verification, and the correctness of the execution on middleboxes is not considered.…”

Section: F Verifiable Network Functionsmentioning

confidence: 99%