No more backups: Toward efficient embedding of survivable virtual networks

Abstract

Although network virtualization can improve security by isolating traffic from different networks, routers and links are still vulnerable to attacks on the underlying network. High capacity physical links, in particular, constitute good targets since they may be important for a large number of virtual networks. Previous work protects virtual networks by setting aside backup resources. Although effective, this solution increases the cost to infrastructure providers. In this paper, we present a virtual network embedding approach which enables resilience to attacks and efficiency in resource utilization. Our approach is two-folded: while a preventive strategy embeds virtual links into multiple substrate paths, a reactive strategy attempts to reallocate any capacity affected by an underlying DoS attack. Since the embedding problem is NP-Hard, we devise a Simulated Annealing meta-heuristic to solve it efficiently. Results show our solution can provide resilience to attacks at a lower cost.

Virtual network security: threats, countermeasures, and challenges

“…Unlike the previously described approaches in the area of virtual network resilience, Oliveira et al [7] present a strategy based on "opportunistic resilience", which does not employ backup resources. The bandwidth demand of each virtual link is split over multiple physical paths.…”

“…Attacks may originate from within a virtual network hosted in the same environment, or from outside sources. The most common threats are Denial of Service (DoS) attacks, as presented by Yu et al [6] and Oliveira et al [7]. A single physical router or link compromised by a DoS attack may cause disruption on several virtual networks currently using its resources.…”

“…Without adequate protection, users from a virtual network might be able to access or even interfere with traffic that belongs to other virtual networks, violating security properties such as confidentiality and integrity [4,5]. Additionally, the infrastructure could be a target for denial of service attacks, causing availability issues for virtual networks instantiated on top of it [6,7]. Therefore, it is of great importance that network virtualization architectures offer protection against these and other types of threats that might compromise security.…”

Multi-Path Link Embedding for Survivability in Virtual Networks

“…This is because the substrate element failures are highly unpredictable [20], [34], and the exact amount of substrate resources that are needed for survivability is not known in advance [24]. For this reason, a number of research works consider only substrate link failures to achieve VN survivability [22], [35], [36], [39]. However, none of these works provide provable survivability guarantee, in presence substrate link failure(s).…”

“…Second, primary and backup resources need to be disjoint in the SN. Embedding each virtual link into multiple disjoint paths mitigates the impact of failures [35], [36], [46]. Although effective, this approach incurs path splitting overhead including packet redirection, increased routing table size, and packet reordering.…”