NFVGuard: Verifying the Security of Multilevel Network Functions Virtualization (NFV) Stack

Oqaily, Alaa; Sudershan, L T; Jarraya, Yosr; Majumdar, Suryadipta; Zhang, Mengyuan; Pourzandi, Makan; Wang, Lingyu; Debbabi, Mourad

doi:10.1109/cloudcom49646.2020.00003

Cited by 3 publications

(1 citation statement)

References 13 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…These properties simplify the management of network services and allow the automation of their life cycle. However, as some earlier studies [98], [117], [118] have shown, the multi-layer nature of NFV introduces inconsistencies issues between layers. For instance, consider a scenario where NFV Orchestrator sends configuration commands to other NFV components to deploy a network service.…”

Section: Gap Analysis and Future Research Directionsmentioning

confidence: 94%

Network Services Anomalies in NFV: Survey, Taxonomy, and Verification Methods

Zoure

Ahmed

Réveillère

2022

IEEE Trans. Netw. Serv. Manage.

View full text Add to dashboard Cite

Network Function Virtualization (NFV) has emerged as a disruptive networking architecture whose galloping evolution is prompting enterprises to outsource network functions to the cloud and ultimately harvest the fruits of cloud computing, including elasticity, pay-as-you-go billing model, and on-demand services provisioning. However, many reluctant enterprises oppose the benefits of this outsourcing to their critical and pressing concerns about security, trust, and compliance. The latter anticipate possible security and QoS policy violations stemming from dishonest behaviors by cloud providers, attacks by co-resident competitors, misconfiguration by cloud administrators, or implementations flaws by NFV developers. As a result, migrating sensitive workloads to the cloud requires enterprises to first assess risks by gaining knowledge of possible network services' anomalies and second, to build trust in the cloud by designing effective mechanisms to detect such anomalies.This survey provides scrutiny of network services anomalies that may occur in the NFV environments. We first present a taxonomy of network service anomalies and analyze their negative impacts on critical service attributes, including security and performance. Second, we compare and classify the existing anomalies' verification mechanisms from the literature. Finally, we point out the literature gap and identify future research directions for anomalies verification in NFV.

show abstract

Section: Gap Analysis and Future Research Directionsmentioning

confidence: 94%

Network Services Anomalies in NFV: Survey, Taxonomy, and Verification Methods

Zoure

Ahmed

Réveillère

2022

IEEE Trans. Netw. Serv. Manage.

View full text Add to dashboard Cite

show abstract

MLFM: Machine Learning Meets Formal Method for Faster Identification of Security Breaches in Network Functions Virtualization (NFV)

Oqaily¹,

Jarraya²,

Wang³

et al. 2022

Computer Security – ESORICS 2022

View full text Add to dashboard Cite

Zero-Cost In-Depth Enforcement of Network Policies for Low-Latency Cloud-Native Systems

Budigiri,

Baumann,

Truyen

et al. 2023

2023 IEEE 16th International Conference on Cloud Computing (CLOUD)

View full text Add to dashboard Cite

Packaging applications in containers and managing them dynamically using a cluster orchestrator is the de-facto approach for deployment of cloud-native applications. When containers run inside virtual machines (VMs) to protect infrastructural assets, network policies (NPs) at the container layer and security groups (SGs) at the VM layer provide complementary firewall mechanisms that strengthen defenses against lateral movement of attackers. However, least-privilege NPs at the container layer may not always be consistent with statically defined, over-permissive SGs at the VM layer. This is especially a problem with low-latency configuration of container networking solutions that requires every opened container protocol, port and traffic direction also to be opened at the VM layer. In any post-exploitation scenario where attackers escape from within an already compromised or infected container, such over-permissive SGs do not prevent the attacker from spreading across VMs to find powerful tokens for accessing the cluster orchestrator. In this paper, we introduce GrassHopper (GH), a fast and dynamic cross-layer enforcement approach for NPs, which automatically generates SG configurations from dynamically verified NPs. Given the low-latency context, the design of GH must ensure that dynamically generated SG rules are applied fast before the newly scheduled containers become ready to serve traffic. We evaluate GH on a Kubernetes cluster running on OpenStack. For a wide range of relevant low-latency applications and cluster setups, GH can reduce the network attack surface between VMs at a ratio of 75-to-99% while causing no application level performance overhead with respect to latency, throughput, and CPU utilization.

show abstract

NFVGuard: Verifying the Security of Multilevel Network Functions Virtualization (NFV) Stack

Cited by 3 publications

References 13 publications

Network Services Anomalies in NFV: Survey, Taxonomy, and Verification Methods

Network Services Anomalies in NFV: Survey, Taxonomy, and Verification Methods

MLFM: Machine Learning Meets Formal Method for Faster Identification of Security Breaches in Network Functions Virtualization (NFV)

Zero-Cost In-Depth Enforcement of Network Policies for Low-Latency Cloud-Native Systems

Contact Info

Product

Resources

About