Network Functions Virtualization (NFV), along with Software-Defined Networking (SDN), drives a new change in networking infrastructure with respect to designing, deploying, and managing various network services. In particular, NFV has potential to significantly reduce the hardware cost, greatly improve operational efficiency, and dramatically shorten the development lifecycle of network service. It also makes network functions and services much more adaptive and scalable. Despite the promising advantages of NFV, security remains to be one of the vital concerns and potential hurdle, as attack surface becomes unclear and defense line turns to be blurred in the virtualization environment. This survey is therefore devoted to analyzing NFV from a security perspective. We firstly analyze security threats of five well-defined NFV use cases, with an objective to establishing a comprehensive layer-specific threat taxonomy. Second, we conduct in-depth comparative studies on several security mechanisms that are applied in traditional scenarios and in NFV environments. The purpose is to analyze their implicit relationships with NFV performance objectives in terms of feasibility, agility, effectiveness, and so on. Third, based on the established threat taxonomy and the analyzed security mechanisms, we provide a set of recommendations on securing NFV based services, along with the analysis on the state-of-the-art security countermeasures. A resulting holistic security framework is intended to lay a foundation for NFV service providers to deploy adaptive, scalable, and cost-effective security hardening based on their particular needs. Some future research directions are finally discussed.

Internet of Things (IoT) devices increasingly contribute to critical infrastructures, necessitating robust security measures. LoRaWAN, a low-power IoT network, employs the Advanced Encryption Standard (AES) with a 128-bit key for encryption and integrity, balancing efficiency and security. As computational capabilities of devices advance and recommendations for stronger encryption, such as AES-256, emerge, the implications of using longer AES keys (192 and 256 bits) on LoRaWAN devices’ energy consumption and processing time become crucial. Despite the significance of the topic, there is a lack of research on the implications of using larger AES keys in real-world LoRaWAN settings. To address this gap, we perform extensive tests in a real-world LoRaWAN environment, modifying the source code of both a LoRaWAN end device and open-source server stack to incorporate larger AES keys. Our results show that, while larger AES keys increase both energy consumption and processing time, these increments are minimal compared to the time on air. Specifically, for the maximum payload size we used, when comparing AES-256 to AES-128, the additional computational time and energy are, respectively, 750 $\mathrm{m}$$\mathrm{s}$ and 236 μJ. However, in terms of time on air costs, these increases represent just 0.2% and 0.13%, respectively. Our observations confirm our intuition that the increased costs correlate to the number of rounds of AES computation. Moreover, we formulate a mathematical model to predict the impact of longer AES keys on processing time, which further supports our empirical findings. These results suggest that implementing longer AES keys in LoRaWAN is a practical solution enhancing its security strength while not significantly impacting energy consumption or processing time.

Service Function Chaining (SFC) has recently received considerable attentions from both industry and academia, due to its potential for improving the flexibility of provisioning and composition of Virtualized Network Functions (VNFs) to suit application-specific needs. From a security perspective, there is a gap between high-level SFC policy specification and its enforcement in the data plane. It cannot guarantee that the deployed VNFs are always chained in an expected manner, or the packet flows of a particular service chain are sequentially forwarded to the intended and legitimate VNFs strictly compliant with the specified SFC policy. This lack of assurance leaves the door open for attackers to maliciously manipulate the service chain by evading from security functions such as firewall, Deep Packet Inspection (DPI), , or deviating the packet flows from their original service function path, ultimately leading to the violation of SFC policy. It is therefore important to have an efficient self-checking mechanism in place, ensuring the SFC to be implemented in a secure and dependable way. This paper presents a new security primitive – Lite Identity-based Ordered Multisignature scheme (ChainSign in short), which enforces all intended VNFs in a particular service chain to sequentially sign the packet received. Then the last hop of the chain will verify the signature, so as to validate whether all of them work as expected and have not been compromised, while satisfying the security properties of concern (i.e., the consistency in VNF chaining, their authenticities and sequences in a service chain). In addition to the implementation, we leverage the IETF Network Service Header (NSH) to carry the signature generated from our proposed scheme. The experiments show that ChainSign can preserve all identified security properties with minimal overhead.

Network Function Virtualization (NFV) is a new technology that deploys network services and functions as software components in data centers and cloud environments. One of its key applications is Service Function Chain (SFC), which chains a set of Virtual Network Functions (VNFs) in a specific order to deliver a desired service. However, deploying NFV and SFC networks faces challenges, particularly in terms of disaster resiliency. This encompasses natural disasters and hardware failures, which can disrupt network operations and lead to service interruption or degradation across an entire disaster zone (DZ). Therefore, designing NFV and SFC networks that can withstand disasters while providing high levels of service availability and reliability is important. This paper presents a new method for protecting SFCs using adaptive multi-path routing. The proposed Multi-path Protection (MP) method has the advantage of reducing the amount of reserved bandwidth on backup paths by distributing SFC traffic over multiple DZ-disjoint working paths. The problem being addressed involves VNFs placement, routing SFCs, and implementing protection mechanisms. The objective is to minimize network resource consumption, including both the bandwidth used by request routing paths and the computing resources for VNF execution. To solve this multi-dimensional optimization problem, a path-adaptive and flow-based integer linear program (ILP) is proposed to provide the optimal solution in sall-size network settings. We also propose a heuristic approach that offers the near-optimal solution in a time-efficient way. Comprehensive simulation results show that the proposed MP strategy outperforms traditional Dedicated Protection (DP) in terms of bandwidth and processing resource consumption, resulting in a significant gain up to 20%.

In public safety scenarios, communication between responders is crucial to ensure better cooperation during rescue missions. Several Mission critical services have been proposed by 3GPP, enabling the exchange of data, voice, and multimedia content over the latest generation of cellular networks. Despite the great popularity of cellular technologies, there are limitations when users exchange large amounts of data traffic at the edge of the antenna. By taking advantage of the proximity between users, deploying Device-to-Device (D2D) communication should offer better bandwidth, lower delays, and optimized device energy consumption. To overcome the range limitations of Direct D2D communication, a multi-hop cooperative relay based on CQI (Channel Quality Indicator) can route the message to the final destination. Two communication modes are thus proposed: (1) the D2D Loosely Coupled mode, which relies exclusively on user-type relays, and (2) the Hybrid mode, which allows the cellular antenna to be used as a relay when routing packets. This paper proposes modeling and evaluation of these solutions in the context of rescue operations, using an extension of the Simu5G library under the OMNeT++ simulator. Several configurations, including different application bitrates, showcase the coverage capabilities and related end-to-end delays when using a multi-relays solution compared to Direct D2D communication. The D2D Loosely coupled and Hybrid modes are evaluated and compared to the Infrastructure mode, particularly when traffic moves to the edge of the cell. Hybrid mode performance has been highlighted through a series of mobility scenarios.