Network security policy

Security policy

Network Functions Virtualization

Computer network

Musical

Operating system

Distributed computing

Computer security model

Visual arts

Political science

Orchestration

Network security

Enforcement

Security service

Computer science

Virtualization

Information security

Cloud computing

Resource allocation

Computer security

IEEE/ACM Transactions on Networking

This paper introduces an approach toward the automatic enforcement of security policies in network functions virtualization (NFV) networks and dynamic adaptation to network changes. The approach relies on a refinement model that allows the dynamic transformation of high-level security requirements into configuration settings for the network security functions (NSFs), and optimization models that allow the optimal selection of the NSFs to use. These models are built on a formalization of the NSF capabilities, which serves to unequivocally describe what NSFs are able to do for security policy enforcement purposes. The approach proposed is the first step toward a security policy aware NFV management, orchestration, and resource allocation system-a paradigm shift for the management of virtualized networks-and it requires minor changes to the current NFV architecture. We prove that our approach is feasible, as it has been implemented by extending the OpenMANO framework and validated on several network scenarios. Furthermore, we prove with performance tests that policy refinement scales well enough to support current and future virtualized networks.

Adding Support for Automatic Enforcement of Security Policies in NFV Networks