Security challenges with network functions virtualization

Future Generation Computer Systems

Volumn 67, Issue , 2017, Pages 315-324

  Daghmehchi Firoozjaei, Mahdi ^a   Ko, Hoon ^a   Kim, Hyoungshick ^a  

^a Sungkyunkwan University   (South Korea)

^b Paul)   (South Korea)

Author keywords

Network functions virtualization; Network security; Security threats; Virtualized network function

Indexed keywords

SECURITY SYSTEMS; SIDE CHANNEL ATTACK; TRANSFER FUNCTIONS; VIRTUAL REALITY;

NETWORK BASED APPLICATIONS; NETWORK FUNCTIONS; NETWORK SERVICES; PRACTICAL SOLUTIONS; SECURITY CHALLENGES; SECURITY THREATS; SHARED RESOURCES; VIRTUALIZATIONS;

NETWORK SECURITY;

EID: 84995887335     PISSN: 0167739X     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.future.2016.07.002     Document Type: Article

References (65)

1. [1] ETSI. Network Functions Virtualisation; Introductory White Paper. Technical Report., 2012, SDN and OpenFlow World Congress.
2. [2] ETSI. Network Functions Virtualisation (NFV); Infrastructure Overview. Technical Report, ETSI GS NFV-INF 001 V1.1.1., 2015.
3. [3] ONF. Software-Defined Networking: The New Norm for Networks. Technical Report., 2012, ONF White Paper.
4. [4] M. Aiash, G. Mapp, O. Gemikonakli, Secure live virtual machines migration: Issues and solutions, in: 28th International Conference on Advanced Information Networking and Applications Workshops, 2014, pp. 160–165.
5. [5] Hu, F., Hao, Q., Bao, K., A survey on software-defined network and openflow: From concept to implementation. IEEE Commun. Surv. Tutor. 16:4 (2014), 2181–2206.
6. [6] Shafieian, S., Zulkernine, M., Haque, A., Cloud Computing: Challenges, Limitations and R & D Solutions. 2014, Springer, 3–22.
7. [7] Y. Luo, E. Murray, T.L. Ficarra, Accelerated virtual switching with programmable NICs for scalable data center networking, in: Proceedings of the Second ACM SIGCOMM Workshop on Virtualized Infrastructure Systems and Architectures, 2010, pp. 65–72.
8. [8] Han, B., Gopalakrishnan, V., Ji, L., Lee, S., Network functions virtualization: Challenges and opportunities for innovations. IEEE Commun. Mag. 53:2 (2015), 90–97.
9. [9] Veitch, P., McGrath, M.J., Bayon, V., An instrumentation and analytics framework for optimal and robust NFV deployment. IEEE Commun. Mag. 53 (2015), 126–133.
10. [10] Li, Y., Chen, M., Software-defined network function virtualization: A survey. IEEE Access 3 (2015), 2542–2553.
11. [11] Blenk, A., Basta, A., Reisslein, M., Kellerer, W., Survey on network virtualization hypervisors for software defined networking. IEEE Commun. Surv. Tutor. 18:1 (2016), 655–685.
12. [12] Mijumbi, R., Serrat, J., Gorricho, J.-L., Bouten, N., De Turck, F., Boutaba, R., Network function virtualization: State-of-the-art and research challenges. IEEE Commun. Surv. Tutor. 18:1 (2016), 236–262.
13. [13] D. Cotroneo, L. De Simone, A.K. Iannillo, A. Lanzaro, R. Natella, J. Fan, W. Ping, Network function virtualization: Challenges and directions for reliability assurance, in: IEEE International Symposium on Software Reliability Engineering Workshops, ISSREW, 2014, pp. 37–42.
14. [14] Alcatel-Lucent. Providing Security in NFV- Challenges and Opportunities, Alcatel-Lucent White Paper. Technical Report., 2014, Alcatel-Lucent.
15. [15] Hawilo, H., Shami, A., Mirahmadi, M., Asal, R., NFV: state of the art, challenges and implementation in next generation mobile networks (vEPC). IEEE Netw. Mag. 28:6 (2014), 18–26.
16. [16] ETSI. Network Functions Virtualisation (NFV); NFV Security; Security and Trust Guidance. Technical Report, ETSI GS NFV-SEC 003 V1.1.1., 2014.
17. [17] ETSI. Network Functions Virtualisation (NFV); Infrastructure; Hypervisor Domain. Technical Report, ETSI GS NFV-INF 004 V1.1.1., 2015.
18. [18] BROCADE. Intel and Brocade Network Functions Virtualization Solution. Technical Report., 2014, Brocade Communications Systems.
19. [19] Ashktorab, V., Taghizadeh, S.R., Security threats and countermeasures in cloud computing. Int. J. Appl. Innov. Eng. Manag. 1:2 (2012), 234–245.
20. [20] Ogiela, M.R., Ogiela, U., Shadow generation protocol in linguistic threshold schemes. Commun. Comput. Inf. Sci. 58 (2009), 35–42.
21. [21] CSA. The Notorious Nine: Cloud Computing Top Threats in 2013. Technical Report., 2013, Cloud Security Alliance.
22. [22] S. Natarajan, T. Wolf, Security issues in network virtualization for the future internet, in: International Conference on Computing, Networking and Communications, ICNC, 2012, pp. 537–543.
23. [23] W. Eatherton, The push of network processing to the top of the pyramid, in: Keynote Presentation at ACM/IEEE Symposium on Architectures for Networking and Communication Systems, ANCS, 2005.
24. [24] L. Rizzo, M. Carbone, G. Catalli, Transparent acceleration of software packet forwarding using netmap, in: Proceedings of IEEE INFOCOM’2012, 2012, pp. 2471–2479.
25. [25] A. Shieh, S. Kandula, E.G. Sirer, SideCar: Building programmable datacenter networks without programmable switches, in: Proceedings of the 9th ACM SIGCOMM Workshop on Hot Topics in Networks, Hotnets-IX, 2010, pp. 21:1–21:6.
26. [26] C. Kachris, G. Sirakoulis, D. Soudris, Network function virtualization based on FPGAs: A framework for all-programmable network devices, CoRR, 2014.
27. [27] Anwer, M.B., Motiwala, M., Tariq, M., Feamster, N., SwitchBlade: A platform for rapid deployment of network protocols on programmable hardware. ACM SIGCOMM Comput. Commun. Rev. 40:4 (2010), 183–194.
28. [28] P. Costa, M. Migliavacca, P. Pietzuch, A.L. Wolf, NaaS: Network-as-a-service in the cloud, in: 2nd USENIX Workshop on Hot Topics in Management of Internet, Cloud, and Enterprise Networks and Services, 2012.
29. [29] V. Varadarajan, T. Kooburat, B. Farley, T. Ristenpart, M.M. Swift, Resource-freeing attacks: Improve your cloud performance (at your neighbor's expense), in: Proceedings of the ACM Conference on Computer and Communications Security, CCS’12, 2012, pp. 281–292.
30. [30] J. Idziorek, M. Tannian, D. Jacobson, Detecting fraudulent use of cloud resources, in: Proceedings of the 3rd ACM Workshop on Cloud Computing Security Workshop, CCSW’11, 2011, pp. 61–72.
31. [31] J. Oberheide, K. Veeraraghavan, E. Cooke, J. Flinn, F. Jahanian, Virtualized in-cloud security services for mobile devices, in: Proceedings of the First Workshop on Virtualization in Mobile Computing, MobiVirt’08, 2008, pp. 31–35.
32. [32] Gutz, S., Story, A., Schlesinger, C., Foster, N., Splendid isolation: A slice abstraction for software-defined networks. Proceedings of the First Workshop on Hot Topics in Software Defined Networks, HotSDN’12, 2012, ACM, 79–84.
33. [33] Y. Zhang, A. Juels, M.K. Reiter, T. Ristenpart, Cross-VM side channels and their use to extract private keys, in: 2012 ACM Conference on Computer and Communications Security, CCS’12, 2012, pp. 305–316.
34. [34] T. Ristenpart, E. Tromer, H. Shacham, S. Savage, Hey, you, get off of my cloud: Exploring information leakage in third-party compute clouds, in: Proceedings of CCS 2009, 2009, pp. 199–212.
35. [35] Wu, Z., Xu, Z., Wang, Whispers in the hyper-space: High-speed covert channel attacks in the cloud. 21st USENIX Security Symposium, (USENIX Security 12), 2012, USENIX, 159–173.
36. [36] D.A. Osvik, A. Shamir, E. Tromer, Cache attacks and countermeasures: The case of AES, in: Proceedings of the Cryptographers’ Track at the RSA Conference on Topics in Cryptology, CT-RSA’06, 2006, pp. 1–20.
37. [37] Maurice, Clementine, Neumann, Christoph, Heen, Olivier, Francillon, Aurelien, C5: Cross-cores cache covert channel. Detection of Intrusions and Malware, and Vulnerability Assessment, DIMVA’15, 2015, Springer, 46–64.
38. [38] V. Varadarajan, Y. Zhang, T. Ristenpart, M. Swift, A placement vulnerability study in multi-tenant public clouds, in: 24th USENIX Security Symposium (USENIX Security 15), 2015, pp. 913–928.
39. [39] J. Oberheide, E. Cooke, F. Jahanian, Empirical exploitation of live virtual machine migration, in: BlackHat DC Convention, 2008.
40. [40] Berger, S., Cáceres, R., Goldman, K.A., Perez, R., Sailer, R., van Doorn, L., vTPM: Virtualizing the trusted platform module. 15th Conference on USENIX Security Symposium USENIX-SS’06, vol. 15, 2006.
41. [41] Zhang, F., Chen, H., Security-preserving live migration of virtual machines in the cloud. J. Netw. Syst. Manage. 21:4 (2013), 562–587.
42. [42] S. Biedermann, M. Zittel, S. Katzenbeisser, Improving security of virtual machines during live migrations, in: 2013 Eleventh Annual International Conference on Privacy, Security and Trust, PST, 2013, pp. 352–357.
43. [43] Intel Trusted Execution Technology (Intel TxT), Hardware-based Technology for Enhancing Server Platform Security, 2012.
44. [44] MSE: Message Stream Sncryption protocol, Azureu Wiki, 2014. http://wiki.vuze.com/w/MessageStreamEncryption.
45. [45] PCI-SIG SR-IOV Primer, An Introduction to SR-IOV Technology, Intel SR-IOV, 2011.
46. [46] I. Smolyar, M. Ben-Yehuda, D. Tsafrir, Securing self-virtualizing ethernet devices, in: 24th USENIX Security Symposium, USENIX Security 15, 2015, pp. 335–350.
47. [47] X. Zhang, Ch. Lan, A. Perrig, Secure and scalable fault localization under dynamic traffic patterns, in: Proceedings of the IEEE Symposium on Security and Privacy, SP’12, 2012, pp. 317–331.
48. [48] Chen, I., Bao, F., Chang, M., Cho, J., Dynamic trust management for delay tolerant networks and its application to secure routing. IEEE Trans. Parallel Distrib. Syst. 25:5 (2014), 1200–1210.
49. [49] Intel Trust Execution Technology, (Intel TXT) Enabling Guide, 330139-001US, 2015.
50. [50] F. Bernal, M. Sanchez, G. López, A.F. Gomez-Skarmeta, O. Canovas, Trusted network access control in the eduroam federation, in: Third International Conference on Network and System Security, 2009, NSS’09, 2009, pp. 170–175.
51. [51] T. Kim, M. Peinado, G. Mainar-Ruiz, STEALTHMEM: System-level protection against cache-based side channel attacks in the cloud, in: 21st USENIX Security Symposium, USENIX Security 12, 2012, pp. 189–204.
52. [52] Y. Zhang, A. Juels, A. Oprea, M.K. Reiter, HomeAlone: Co-residency detection in the cloud via side-channel analysis, in: 2011 IEEE Symposium on Security and Privacy, SP’11, 2011, pp. 313–328.
53. [53] C. Gentry, Fully homomorphic encryption using ideal lattices, in: Proceedings of the Forty-first Annual ACM Symposium on Theory of Computing, STOC’09, 2009, pp. 169–178.
54. [54] Melis, L., Asghar, H.J., De Cristofaro, E., Kaafar, M.A., Private processing of outsourced network functions: Feasibility and constructions. The 2016 ACM International Workshop on Security in Software Defined Networks & Network Function Virtualization, SDN-NFV Security’16, 2016, ACM, 39–44.
55. [55] OpenAttestation, Build and Install OpenAttestation (2.0), 2013. https://github.com/OpenAttestation/OpenAttestation/wiki.
56. [56] Intel Virtualization Technology for Directed I/O, Architecture Specification, 2014.
57. [57] Trusted Platform Module Library, TPM 2.0, 2014.
58. [58] Intel Software Guard Extensions Programming Reference, Intel-SGX, 2014.
59. [59] Osborn, J.D., Challener, D.C., Trusted Platform Module Evolution. Technical Report 2., 2013, Johns Hopkins APL Technical Digest.
60. [60] Raj, H., Saroiu, S., Wolman, A., Aigner, R., Cox, J., England, P., Fenner, C., Kinshumann, K., Loeser, J., Mattoon, D., Nystrom, M., Robinson, D., Spiger, R., Thom, S., Wooten, D., fTPM: A Firmware-based TPM 2.0 Implementation. Technical Report MSR-TR-2015-84., 2015, Microsoft Research.
61. [61] A. Francillon, Q. Nguyen, K.B. Rasmussen, G. Tsudik, A minimalist approach to remote attestation, in: Proceedings of the Conference on Design, Automation & Test in Europe, DATE’14, Vol. 466, 2014, pp. 1–6.
62. [62] Strasser, M., Stamer, H., A software-based trusted platform module emulator. 1st International Conference on Trusted Computing and Trust in Information Technologies: Trusted Computing - Challenges and Applications, Trust’08, 2008, Springer-Verlag, 33–47.
63. [63] Alsouri, S., Feller, T., Malipatlolla, S., Katzenbeisser, S., Hardware-based Security for Virtual Trusted Platform Modules. Technical Report., 2013 arXiv preprint.
64. [64] NSA. High Assurance Platform. Technical Report., 2011, HAP Fact sheet, National Security Agency.
65. [65] Dai, H., Zhao, Sh., Zhang, Qiu, M.J., Tao, L., Security enhancement of cloud servers with a redundancy-based fault-tolerant cache structure. Future Gener. Comput. Syst. 52:C (2015), 147–155.