Search

Recently, zero trust security has received notable attention in the security community. However, while many networks use monitoring and security functions like firewalls, their integration in the design of zero trust architectures remains largely unaddressed. In this article, we contribute with respect to this aspect a novel network security architecture called Zero Trust Service Function Chaining (ZTSFC). With ZTSFC, we achieve three main improvements over zero trust architectures: (1) the zero trust components can directly integrate other monitoring and security functions into their access decisions, (2) an efficient flow of information between zero trust components, monitoring, and security functions are achieved, and (3) ZTSFC improves the performance with respect to hardware load and user experience. As proof of concept, we implemented a publicly available ZTSFC prototype based on HTTPS and the policy language ALFA. Using this prototype, we demonstrate the achievement of all three improvements in representative use cases. In addition, our performance evaluation compares ZTSFC with a regular zero trust network without ZTSFC. The results indicate that ZTSFC can reduce CPU usage by 25% for specific monitoring and security functions in certain scenarios. Overall, we also observed a 30% decrease in the time it takes to access services with ZTSFC.

Network function virtualization (NFV) utilizes IT virtualization technology to realize the functions of various network devices and realize the decoupling of hardware and software functions. Typically, a service request specifies the virtual network functions (VNFs) it needs and the order between them. A network flow needs to traverse a set of sequential VNFs called a service function chain (SFC). Although SFC can increase the flexibility of service orchestration to meet the needs of different users, network providers face many challenges due to the need to ensure service reliability and some constraints. Therefore, how orchestrating SFC and designing a suitable network architecture is a critical issue in this field at present. We propose an efficient network layer-based SFC orchestration method, called SFC-hierarchical orchestration (SFC-HO). Our method separates virtual and physical networks into layers and computes the availability of resources in each layer. We filter the VNFs of each layer and deploy them to the physical layer that meets the greatest benefit. To this end, we formulate the problem as an integer linear programming (ILP) problem to minimize the total deployment cost. In order to further optimize the layering strategy, we innovatively use the Benders decomposition method to decompose the SFC-HO problem into two sub-problems, which are the hierarchical mapping problem of VNFs and the routing problem between nodes. We propose two algorithms for the two problems respectively. The simulation results show that compared with the SFC orchestration process in the traditional network model. Our research can effectively improve the reliability of the SFC, reduce the delay of the routing process, and effectively reduce the cost consumption. Our research effectively solves the problem of difficult service orchestration for operators in the face of diverse service demands and a large number of service requests.

Cloud computing is now known as the most cost-effective platform for delivering big data and artificial intelligence services over the Internet to enterprises and cloud consumers. However, despite many recent security developments, many cloud consumers continue to express great concern about using these platforms because they still have significant vulnerabilities. Typically, Economic Denial of Sustainability (EDoS) attacks exploit the pay-as-you-go billing mechanisms used by cloud service providers, so that a cloud customer is forced to pay an extra fee for the additional resources triggered by the attack activities. In our previous work, we already proposed an system to mitigate such EDoS attacks. Overall, this previous work presented an effective system for detecting abnormal events; however, the false-alarm rates still remain relatively high and detection rates are low, because abnormal events could be caused by the cloud customer. Furthermore, our previous work still consumes a large number of computing resources. Therefore, in this paper, we propose an enhanced scheme to detect and mitigate EDoS attacks efficiently and reliably. Our proposed scheme is composed of online and offline phases, implementing a gated recurrent unit, which not only can capture complex temporal dependence relations in the data, but also can reduce the vanishing gradient problems in time series. First, to reflect the normal patterns, our proposed scheme learns accurate representations of multivariate time series. Next, these representations are used to reconstruct input data. Finally, the reconstruction probabilities not only can be used to find anomalies, but also can provide interpretations. The proposed scheme also introduces a self-adjusting threshold to reduce error rates, whereas existing solutions normally use a hard threshold to analyze the anomalies, which causes increasing error rates. Our comprehensive analysis of the results shows outstanding performance compared to other solutions and our previous work.

Network Function Virtualization (NFV) is an approach that provides a network service provider with agility and cost-efficiency in managing 6G network services. Standard traffic engineering rules are known limited in assuring a very stringent delay requirement in NFV when a traffic flow is required to follow a sequence of network functions scattered in data center networks. This paper proposes an innovative model and algorithm of traffic engineering for service function chaining (SFC) to maximize cost-efficiency under a delay-guarantee constraint. We first formulate the problem as a mixed-integer linear programming model for obtaining the optimal solution. We then propose an algorithm based on the reinforcement learning principles for finding an approximation solution in a large-scale problem with the dynamics of service demands. Numerical results under both real-world datasets and synthetic network topologies demonstrate that our proposed model and algorithm allow an NFV service provider (NSP) to place a virtual network function and steer a traffic flow efficiently in terms of energy cost for a delay-guarantee SFC. Importantly, the results provide an insight into the optimal and approximation solutions for an NSP to select a suitable traffic engineering approach with regard to network dynamics.

This paper investigates a multi-service activation procedure for telecommunications carriers’ zero-touch provisioning workflows using access network virtualization technologies in an optical access network. We examine a procedure in which one network function or a set of functions is initiated depending on the services to be activated after a line is automatically opened in response to a customer’s action. The feasibility of this procedure is experimentally verified in a joint testbed environment between three Asia-Pacific telecommunications carriers. The results showed that even when 32 customers simultaneously request service activation, it takes less than 30 seconds for all of the customers’ requests to be completed. In addition, we discuss potential implementations for activating various multi-service provisioning in response to customer requirements and network isolation in terms of virtualized resources and infrastructure. We also propose an implementation that utilizes network resources shared by various services more efficiently than that presented in our previous conference report, and we experimentally verify its feasibility. In addition, the experimental configurations briefly described in the previous report are described in detail in this paper.

Service function chaining (SFC) is an indispensable technique for Internet service providers to efficiently manage their networks. However, SFC poses requirements of additional processing time of service functions (SFs) and increased routing time owing to detoured paths. In this paper, we introduce the use of a programmable data plane (PDP) to reduce the additional processing and routing times in SFC. We first classify the existing PDP-empowered SFC schemes and analyze their pros and cons. An optimization problem, to find the optimal SF embedding strategy minimizing the SFC completion time while efficiently utilizing the PDP switch resources, is formulated and a flow-aware SF embedding (FASE) algorithm that complementarily combines the redundant SF and re-circulation approaches is devised. FASE is implemented over a commercial PDP switch and experimental results demonstrate that FASE can reduce the SFC completion time by up to 33% compared with conventional approaches while utilizing the switch resources efficiently.

Network Service Providers (NSPs) envisage to support the divergent and stringent requirements of future services by instantiating these services as service chains, commonly referred to as Service Function Chains (SFCs), that are customized and configured to meet specific service requirements. However, due to the limited footprint of the Infrastructure Providers (InPs), these SFCs may have to transcend multiple InPs/domains. In this regard, determining the optimal set of InPs in which to embed the SFC request emerges as a complex problem for several reasons. First, the large number of possible combinations for selecting the InPs to embed the different sub-chains of the request makes this problem computationally complex, rendering optimal solutions only after long computations, especially in large scale networks, which is unfeasible for delay sensitive applications. Second, the unwillingness of InPs to disclose their internal information, which may be vital for making embedding decisions, usually implies the provisioning of single-domain solutions, which are unsuitable in this working scenario. In this regard, this paper first formulates the multi-domain service deployment problem under multiple request constraints, such as bandwidth or delay, among others. Then, due to the NP-hardness nature of the above problem, this paper proposes an algorithm that is aided by a multi-stage graph for computing a request embedding solution in a distributed manner, solving the problem in acceptable run-times. Results from different simulations reveal that the proposed algorithm is optimized in terms of acceptance ratio and embedding cost, with up to 60.0% and 88.7% improvements in terms of embedding cost and execution time, respectively, for some scenarios, in comparison with a benchmark state-of-the-art algorithm.

This paper considers service provider network design with a view of meeting application availability. Our primary goal is to design a service provider network using disparate network components and low-availability Virtual Network Functions (VNFs) while achieving high-availability Service Function Chains (SFCs). To this end, we attempt to answer the questions as to how much redundancy, and what type of redundancy should be incorporated in the network. Initially, we model a state-of-the-art provider architecture that is spread across the access, metro-core and backbone networks with associated discrete components such as switches, routers, optical equipment and data-centers. Our network design model leads to computing the amount of over-the-top (OTT) services that can be provisioned over a given network while achieving a particular availability. To this end, we formulate a constrained optimization model whose objective is profit maximization subject to availability measures that OTT services demand. We provide constraints of robustness that facilitate traffic churn. Four heuristics are also proposed with objectives that consider the breadth of the three key impacting parameters: VNF licensing cost, server utilization and delay optimization and the case for dynamic traffic. A simulation model presents comparative data for efficiency, latency and server utilization as well as validates our optimization model. The results stress the importance of an efficient optimization model in planning the network, as well as planning VNF placement ahead in time.

Residential networks play a critical role in assuring that services or applications such as tele-work, tele-education, medical care, entertainment, home automation, among others, have the required resources to obtain an optimal performance. Although current residential gateways try to meet the Quality of Service (QoS) demands, the traditional networking paradigm does not have the appropriate mechanisms to address the heterogeneous and dynamic nature of the services running at home. In this context, a feasible solution consists of leveraging the flexibility and adaptability of the Software Defined Networking (SDN) and Network Functions Virtualization (NFV) paradigms to provide a differentiated traffic treatment intended to improve the QoS support of residential networks. The proposal takes advantage of the Service Function Chaining (SFC) concept intrinsic to NFV as well as the capacity of an SDN-based residential gateway to differentiate the traffic of a certain application. Thus, an association between an SFC and the differentiated traffic is stablished to apply a specific treatment. Besides, a comprehensive architecture composed of the software defined residential network (SDRN), the software defined access network (SDOAN) and the NFV-compliant ISP's edge cloud infrastructure is envisioned. This architecture would allow dramatically improving the life cycle management of the residential network from a centralized point which follows a user-centric approach.

Service function chaining (SFC) focuses mainly on deploying various network functions in geographically distributed data centers and providing interconnect routing among them. Traditional (convex optimization-based) SFC algorithms exhibit some disadvantages on the scalability and accuracy. Recently, researches have shown the effectiveness of deep reinforcement learning (DRL) in the field of SFC. However, current DRL-based algorithms possess an extremely large action space, which leads to slow convergence and poor scalability. Some researchers relieve this issue by reformulating the SFC problem, which usually results in low utilization and high cost. To address this issue, we develop a hybrid DRL-based framework which decouples the VNF deployment and flow routing into different modules. In the proposed framework, a DRL agent is only responsible for learning the policy of VNF deployment. We customize the structure of the agent base on deep deterministic policy gradient (DDPG) and adopt several techniques to improve the learning efficiency, such as adaptive parameter noise, wolpertinger policy, and prioritized experience replay. The flow routing is conducted in a game-based module (GBM). We design a decentralized routing algorithm for the GBM to address the scalability. The end-to-end latency of flows is minimized while the resource capacity and location constraints are satisfied. During the learning process of the proposed framework, the DRL agent improves its deployment policy with the reward from the GBM (the value of reward depends on flow routing). Thus, the VNF deployment and flow routing are still jointly optimized. Compared to existing DRL-learning algorithms, the proposed hybrid DRL framework can achieve a lower cost since 1) the action space is significantly reduced due to flow routing decoupling; 2) the flow routing procedure is more efficient (the GBM adopts model-based information, e.g., the gradient). Through trace-driven simulations, we show the efficiency of our algorithm compared to existing DRL-based algorithms.

Multi-access Edge Computing (MEC) is a key solution that enables operators to open their networks to new services and IT ecosystems to leverage edge-cloud benefits in their networks and systems. Located in close proximity from the end users and connected devices, MEC provides extremely low latency and high bandwidth while always enabling applications to leverage cloud capabilities as necessary. In this article, we illustrate the integration of MEC into a current mobile networks' architecture as well as the transition mechanisms to migrate into a standard 5G network architecture. We also discuss SDN, NFV, SFC and network slicing as MEC enablers. Then, we provide a state-of-the-art study on the different approaches that optimize the MEC resources and its QoS parameters. In this regard, we classify these approaches based on the optimized resources and QoS parameters (i.e., processing, storage, memory, bandwidth, energy and latency). Finally, we propose an architectural framework for a MEC-NFV environment based on the standard SDN architecture.

Network slicing has been viewed as a key enabler for the next-generation software-defined and cloud-based network (e.g., 5G and beyond) to accommodate diverse services in a flexible and cost-efficient fashion. Network slicing allows a network slice provider (NSP) to operate on a common network infrastructure to create customized isolated logical networks (i.e., network slices) for network slice customers (NSCs), (i.e., service providers). NSP and NSCs are independent operators who pursue profit maximization, while in the literature, only network cost optimization is intensively investigated in terms of service function chain embedding, i.e., virtual network function (VNF) placement and flow routing. Therefore, slices should be dimensioned (i.e., resources allocated to slices) according to the resource availability and the economic mechanism in the network, so as to optimize the resource utilization and improve the profit of NSP/NSCs. In this paper, we study elastic slice dimensioning with resource pricing as a Stackelberg pricing game, in which the NSP sells slices by pricing resources and NSCs adjust their slice's resource demand on VNF capacity and bandwidth, while both are trying to maximize their profit. Then, we formulate optimization problems for the pricing game and find that a closed form solution of the optimal price cannot be obtained for a non-trivial network. Hence, we propose a resource pricing algorithm that aims to maximize the NSP's profit and the network's social welfare. Compared with existing usage-based pricing method and two heuristic methods, our proposed pricing algorithm for slice dimensioning strikes a trade-off between maximizing NSP's profit and other metrics, including the resource utilization. Hence, it will helpfully exploiting the benefits of network slicing.

This paper encloses an in-depth investigation of a novel cost-efficient reliability-guaranteed deployment scheme for service function chains (SFCs) to tackle the drawbacks of the existing studies for the virtual network function (VNF) redundancy allocation. We model the VNF redundancy allocation as a cost minimization problem using the integer linear programming (ILP). For the VNF redundancy allocation, we first examine various reliability importance measures in the system reliability theory for the VNF environments. We then propose a novel cost-aware criticality-based priority index (CCI) to evaluate the priority level of VNFs in the SFC level and the network level for the VNF redundancy allocation. Based on CCI, we design a cost-efficient VNF redundancy allocation algorithm, namely, CCI-RA. Through our comprehensive simulation and analysis results, we show that the proposed scheme achieves a significant improvement in terms of the cost efficiency, scalability, and the percentage of the admitted services compared to the existing approaches.

5G network is envisioned to provide massive connectivity for a wide range of applications, such as ultra-clear media, internet of vehicles, and smart home. The traditional way of providing security services is difficult to support these new 5G applications flexibly and effectively. In our previous work, we proposed a SFC-based framework that chains security functions in different domains to provide security services on demand. However, creating cross-domain service function chains will inevitably result in the additional network latency. In this paper, we study this problem of minimizing the end-to-end latency when deploying cross-domain service function chains for 5G applications. First, an exact approach, consisting of service chain partition and service subchain embedding, is proposed to derive an optimal solution for cross-domain service function chain placement. Second, we improve the Viterbi algorithm and propose an efficient heuristic approach to derive near-optimal solutions for large networks. We also compare the performance of the proposed exact approach, the proposed heuristic approach, and the simple greedy approach in different scales of network infrastructures. Simulation results are presented to demonstrate the effectiveness of the proposed approaches.

Cyber-physical-social systems exploit the relationship between humans, computers, and the physical environment to provide high-quality real-time and personalized services. Provisioning services for applications in networks of large datacenters (DCs) is carried out as service function chaining (SFC) by linking ordered list of functions. With the development of software, defined networks and network function virtualization, SFC has gained more attention in the industry for deploying larger applications. Provisioning different service functions (SFs) of an SFC in different DC in a multi DC environment is a challenging task. Existing works on serving SFC select a service function path (SFP) along which the SFs are executed. However, none of the works provide the optimal solutions considering both the execution and data-transfer delay along with electric-optic-electric (EOE) conversion delay. In this paper, an optimal solution for SFP selection has been developed considering processing, transmission, and EOE conversion delay. The proposed dynamic solution can work in a heterogeneous environment. Performance evaluation of the proposed algorithm shows that, significant performance improvement in terms of total end-to-end execution delay of an SFC can be achieved compared with the state-of-the-art works.

Service function chaining (SFC) is able to provide customizable network function services to the traffic flows of different IoT subjects. Nowadays, SFC becomes profound to implement the service requirements of different IoT devices with the flexibility and programmability provided by emerging technologies, software defined network (SDN) and network function virtualization. These techniques play an increasingly important role for service deployment and allow the service requirement for certain IoT device to be specified by different subjects, including SDN applications and network managers. However, independent generation of SFC policies by multiple policy makers over the same device may introduce several problems in the process of deploying SFCs to IoT network. Turning the individual considerations into coherent global SFC policies can be challenging. It requires special process of composition and transition, considering the scenario of combining policies with different concerns specified by different entities who have no insight into the policies of others. In this paper, we propose a composition method to solve the anomalies existing in the process of composing distinct policies in the environment of IoT network with multiple IoT service managers. We design two algorithms for the proposed anomaly-free policy composition method, and implement a prototype. Extensive experiment results show that our proposed method can eliminate the anomalies between policies and only induces trivial overhead in the process of generating data plane rules.