Towards the Dynamic Provision of Virtualized Security Services

Abstract

When network operators want to offer security services to a large number of customers (potentially tens of million) with current technologies face several limitations in terms of infrastructure management and costs. Network Functions Virtualization (NFV) and Software-Defined Networks (SDN) paradigms try to overcome these limitations by allowing more flexibility, configurability and agility. Unfortunately, the problem of deciding which security services to use, where to place and how to configure them is a multi-dimensional problem that has not an easy solution. This paper provides a preliminary model that can be used to determine the best allocation for the security applications that are needed to satisfy, globally, the requests coming from users while minimizing the cost for the network operator, subject to the different levels of constraints expressed by the involved actors. This model can be exploited either to pursue an initial dimensioning and setup of the system infrastructure or to dynamically adapt it to support the security policies requested by users. Initial validation shows that allocations generated with our model have considerable advantages in terms of costs and performance compared to traditional approaches.

On the Optimality of Virtualized Security Function Placement in Multi-Tenant Data Centers

“…It uses horizontal scaling to leverage performance, however, it only considers functions that process traffic at the flow level. The authors in [10], address the allocation of security services in virtualized environments and discuss their challenges. They model the allocation problem for ISP networks to minimise the cost of operators as a Mixed-Integer Linear Programming (MILP) problem but no results for the implementation are reported.…”

Application-Centric provisioning of virtual security network functions

“…Several studies in the peer-reviewed literature tackle the problem by proposing architectural and mathematical solutions with the aim of optimizing the utilization of network and computational resources and minimizing the operational costs [2], [3]. As reported in Section IV, recent works go beyond the simple cost and resource optimization by introducing more specific constraints, either to enforce the security of the network [4], [5], or to guarantee QoS parameters such as minimum bandwidth and maximum end-to-end latency [6], [7].…”

“…In [5], the authors provide a model to determine the best placement of security VNFs based on the user requirements and the cost for the network operator. However, the proposed approach does not take into account the specific QoS requirements of the user's applications.…”

Resource-aware placement of softwarised security services in cloud data centers

“…The authors in [1] address the allocation of security services in virtualized environments and discuss their challenges. They model the allocation problem in ISP networks to minimise the cost of network operators as a mixedinteger linear programming (MILP) problem but no results are reported.…”

“…A typical security system for a Data Center (DC) usually consists of a combination of bespoke hardware-based (middleboxes) e.g., Firewalls and Intrusion Detection and/or Prevention Systems (IDS/IPS), and Deep Packet Inspection (DPI) appliances, deployed in fixed locations [1] which restricts the ability of the infrastructure to react rapidly to changes or respond to attacks [2]. These middleboxes are expensive high-performance vendor-specific appliances with limit extensible functionality and results in vendor lock-in.…”