Virtualized security at the network edge: a user-centric approach

Abstract

The current device-centric protection model against security threats has serious limitations. On the one hand, the proliferation of user terminals such as smart-phones, tablets, notebooks, smart TVs, game consoles and desktop computers makes it extremely difficult to achieve the same level of protection regardless of the device used. On the other hand, when various users share devices (e.g., parents and kids using the same devices at home), the set up of distinct security profiles, policies, and protection rules for the different users of a terminal is far from trivial. In light of this, this paper advocates for a paradigm shift in user protection. In our model, the protection is decoupled from the users' terminals, and it is provided by the access network through a Trusted Virtual Domain (TVD). Each TVD provides unified and homogeneous security for a single user, irrespective of the terminal employed. We describe a user-centric model, where non-technically savvy users can define their own profiles and protection rules in an intuitive way. We show that our model can harness from the virtualization power offered by nextgeneration access networks, especially, from Network Functions Virtualization (NFV) in the Points of Presence (POPs) at the edge of Telecom operators. We also analyze the distinctive features of our model, and the challenges faced based on the experience gained in the development of a proof-of-concept.

Offloading personal security applications to a secure and trusted network node

“…The system architecture, including also the external infrastructure architecture [3], is easily mapped to an NFV deployment and a design compatible with the ETSI standard [4] is currently under development. The concept of the Service Graph allows for complex modeling of VNFs chaining, becoming an NFV enabler.…”

Towards an Efficient Management and Orchestration Framework for Virtual Network Security Functions

“…In the literature, the SECaaS approach has been deeply investigated in the last few years. For instance, some authors [9] proposed a "user-centric" approach for the provision of virtualised security at the network edge. In that paper, a complete framework design is shown, in which an NFV Infrastructure is used to provide security services for the end-user terminals.…”

Situational Awareness in Virtual Networks: The ASTRID Approach

“…Given the reduced set of security features integrated in virtualization platforms and the increasing needs for crosscloud deployments, users are generally left most of the burden for protecting their applications against external threats. Since, on first approximation, virtualization environments could be viewed as special instances of physical networks, softwarebased versions of security middleboxes may be integrated in service graph design [3], [4]. We argue that this approach comes with important limitations in the current cyber-security landscape:…”