Towards the Dynamic Provision of Virtualized Security Services

  • Cataldo Basile
  • Christian Pitscheider
  • Fulvio Risso
  • Fulvio ValenzaEmail author
  • Marco Vallini
Conference paper
Part of the Communications in Computer and Information Science book series (CCIS, volume 530)


Network operators face several limitations in terms of infrastructure management and costs when trying to offer security services to a large number of customers with current technologies. Network Functions Virtualization and Software-Defined Networks paradigms try to overcome these limitations by allowing more flexibility, configurability and agility. Unfortunately, the problem of deciding which security services to use, where to place and how to configure them is a multi-dimensional problem that has no easy solution. This paper provides a model that can be used to determine the best allocation for the security applications needed to satisfy the user requirements while minimizing the cost for the network operator, subject to the different constraints expressed by the involved actors. This model can be exploited to pursue an initial dimensioning and set-up of the system infrastructure or to dynamically adapt it to support the user security policies. Initial validation shows that allocations generated with our model have considerable advantages in terms of costs and performance compared to traditional approaches.


Policy Implementation Security Service Internet Service Provider Edge Node Security Application 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.



The research described in this paper is part of the SECURED project, co-funded by the European Commission (FP7 grant agreement no. 611458).


  1. 1.
    The european telecommunications standards institute: network function virtualization - white paper 2. Technical report, October 2013Google Scholar
  2. 2.
    Feamster, N., Rexford, J., Zegura, E.: The road to SDN: an intellectual history of programmable networks. ACM SIGCOMM Comput. Commun. Rev. 44(2), 87–98 (2014)CrossRefGoogle Scholar
  3. 3.
    Basile, C., Lioy, A., Scozzi, S., Vallini, M.: Ontology-based policy translation. In: Herrero, Á., Gastaldo, P., Zunino, R., Corchado, E. (eds.) CISIS 2009. ASC, vol. 63, pp. 117–126. Springer, Heidelberg (2009) CrossRefGoogle Scholar
  4. 4.
    Basile, C., Lioy, A., Pitscheider, C., Valenza, F., Vallini, M.: A novel approach for integrating security policy enforcement with dynamic network virtualization. In: NetSoft 2015: 1st IEEE Conference on Network Softwarization, London, UK, April 2014Google Scholar
  5. 5.
    Proctor, M.: Drools: a rule engine for complex event processing. In: Schürr, A., Varró, D., Varró, G. (eds.) AGTIVE 2011. LNCS, vol. 7233, p. 2. Springer, Heidelberg (2012) CrossRefGoogle Scholar
  6. 6.
    Moens, H., De Turck, F.: VNF-P: a model for efficient placement of virtualized network functions. In: CNSM 2014: 10th International Conference on Network and Service Management, pp. 418–423, November 2014Google Scholar
  7. 7.
    Yoshida, M., Shen, W., Kawabata, T., Minato, K., Imajuku, W.: MORSA: a multi-objective resource scheduling algorithm for NFV infrastructure. In: APNOMS 2014: 16th Asia-Pacific Network Operations and Management Symposium, pp. 1–6, September 2014Google Scholar
  8. 8.
    Clayman, S., Maini, E., Galis, A., Manzalini, A., Mazzocca, N.: The dynamic placement of virtual network functions. In: NOMS 2014: Network Operations and Management Symposium, pp. 1–9, May 2014Google Scholar
  9. 9.
    Beloglazov, A., Buyya, R.: Energy efficient allocation of virtual machines in cloud data centers. In: CCGrid 2010: 10th IEEE/ACM International Conference on Cluster, Cloud and Grid Computing, pp. 577–578, May 2010Google Scholar
  10. 10.
    García, A.J., Cervelló-Pastor, C., Jiménez, Y.: A modular simulation tool of an orchestrator for allocating virtual resources in SDN. Int. J. Model. Optim. 4(2), 88–99 (2014)CrossRefGoogle Scholar
  11. 11.
    Gember, A., Krishnamurthy, A., John, S.S., Grandl, R., Gao, X., Anand, A., Benson, T., Akella, A., Sekar, V.: Stratos: a network-aware orchestration layer for middleboxes in the cloud. CoRR abs/1305.0209, June 2013Google Scholar
  12. 12.
    Meng, X., Pappas, V., Zhang, L.: Improving the scalability of data center networks with traffic-aware virtual machine placement. In: INFOCOM 2010, San Diego, CA, pp. 1–9, March 2010Google Scholar
  13. 13.
    Mehraghdam, S., Keller, M., Karl, H.: Specifying and placing chains of virtual network functions. In: CloudNet 2014: IEEE 3rd International Conference on Cloud Networking, Luxembourg, pp. 7–13, October 2014Google Scholar

Copyright information

© Springer International Publishing Switzerland 2015

Authors and Affiliations

  • Cataldo Basile
    • 1
  • Christian Pitscheider
    • 1
  • Fulvio Risso
    • 1
  • Fulvio Valenza
    • 1
    Email author
  • Marco Vallini
    • 1
  1. 1.Dipartimento Automatica e InformaticaPolitecnico di TorinoTurinItaly

Personalised recommendations