What are the security topics the need to be researched in NFV ?

In view of more & more Telcos are embarking on NFV i.e. using available IT hardware & software to horizontalize various VNF apps, holistic end-to-end NFV security can be a good research topic as personally I find that each vendors only responsible for the component security they are providing e.g. (see below & diagram attached):

Since above components are likely provided by different vendors, holistic security assessment & protection should be put in place. Some might claim that why not verticalize entire PNF stack from top to bottom in which this is not security protection but rather can be intention to provide vendor locked-in or locked-down.

Network Function Virtualization (NFV) attacks

TRAFFIC HIDDEN FROM MONITORING

NEW SECURITY RISKS AND A SECURITY INFORMATION EXPLOSION

PERFORMANCE BOTTLENECKS—THE VSWITCH AND HARDWARE LAYERS

Dear Praveen Panday,

for some information about NFV Security I would recommend:

ETSI GS NFV-SEC 001 - V1.1.1: "Network Functions Virtualisation (NFV); NFV Security; Problem Statement", Oct 2014

Numerous sources of literature on NFV can be found in the chapter

"18.3 Network Function Virtualization (NFV)" in my book at the address:

https://www.researchgate.net/publication/331651693_Technik_der_IP-NETZE_-_Internet-Kommunikation_in_Theorie_und_Praxis

Best regards

Anatol Badach

The security topics the need to be researched in NFV are

TRAFFIC HIDDEN FROM MONITORING

In virtual-compute environments, a significant portion of the network traffic never hits a physical link. Cisco estimates that about 73% of data-center traffic will come from within the data center by 2019—most of this traffic is virtual machine to virtual machine (VM to VM) communication, which is buried deep inside physical hosts. Known as “east–west traffic,” it is essentially invisible to traditional monitoring architectures and creates a big blind spot for network operations.

Topic : NEW SECURITY RISKS AND A SECURITY INFORMATION EXPLOSION

NFV creates several new security challenges. According to a technical paper from Alcatel Lucent, there are four major NFV-specific security issues operators must be aware of:

• The introduction of new software components that did not exist in the traditional network model: The hypervisor and various management/orchestration elements, which creates a “longer chain of trust.”

addition to Traffic Hidden that is mentioned , the NFV threats are similar to the CLOUD threats . These threats are

-Code execution on the host, privilege escalation, isolation breaking .

-Ddos attacks like SYN flooding, ICMP

-Side channel attacks

using Multiple security VNF instances (such as , vDPi,vFirewall, and vIDS)

Hello.

I can see two ways to research security in NFV:

- Using/creating security techniques for the virtualized infrastructure itself (VNF, MANO, NFVI)

- Using the NFV infrastructure to secure final services (security services implemented with NFV)

For the 2nd topic, I suggest some interesting works mainly related to DDoS mitigation:

- VGuard: A distributed denial of service attack mitigation method using network function virtualization

- Vfence: A defense against distributed denial of service attacks using network function virtualization

- DeMONS: A DDoS mitigation NFV solution

- DDoS Mitigation: A review of Content Delivery Network and its DDoS Defence techniques

By shifting the way of implementing hardware middleboxes (e.g., frewalls, WAN optimizers and load balancers) to software-based virtual network function (VNF) instances, network function virtualization (NFV) emerges as a promising paradigm that embraces great flexibility, agility and efficiency.

Recommend follow John C.s. Lui