Adding Support for Automatic Enforcement of Security Policies in NFV Networks

This paper introduces an approach toward the automatic enforcement of security policies in network functions virtualization (NFV) networks and dynamic adaptation to network changes. The approach relies on a refinement model that allows the dynamic transformation of high-level security requirements i...

Full description

Saved in:
Bibliographic Details
Published in:IEEE/ACM transactions on networking 2019-04, Vol.27 (2), p.707-720
Main Authors: Basile, Cataldo, Valenza, Fulvio, Lioy, Antonio, Lopez, Diego R., Pastor Perales, Antonio
Format: Article
Language:English
Subjects:
Adaptation models
Communication networks
Enforcement
IEEE transactions
Mathematical models
Network security
NFV
NFV management and orchestration
Optimization
Performance tests
Policies
policy refinement
Resource allocation
Resource management
Security
security policy
Virtual networks
Virtual private networks
Citations: Items that this one cites
Items that cite this one
Online Access:Get full text
Tags: Add Tag
No Tags, Be the first to tag this record!
Description
Summary:This paper introduces an approach toward the automatic enforcement of security policies in network functions virtualization (NFV) networks and dynamic adaptation to network changes. The approach relies on a refinement model that allows the dynamic transformation of high-level security requirements into configuration settings for the network security functions (NSFs), and optimization models that allow the optimal selection of the NSFs to use. These models are built on a formalization of the NSF capabilities, which serves to unequivocally describe what NSFs are able to do for security policy enforcement purposes. The approach proposed is the first step toward a security policy aware NFV management, orchestration, and resource allocation system-a paradigm shift for the management of virtualized networks-and it requires minor changes to the current NFV architecture. We prove that our approach is feasible, as it has been implemented by extending the OpenMANO framework and validated on several network scenarios. Furthermore, we prove with performance tests that policy refinement scales well enough to support current and future virtualized networks.
ISSN:1063-6692
1558-2566
DOI:10.1109/TNET.2019.2895278