Dynamic trust-based service function chain deployment method for disrupting attack chains

Abstract

Enhancement of service function chain (SFC) security ability by composing virtual network functions (VNFs) and allocating resources considering their security attributes can address the vulnerability threats in cloud environments, which is an important means of attempting to secure SFCs at the deployment stage. However, existing works do not consider the vulnerability correlation of the multi-step attack chains when completing SFC deployment based on trustworthiness. This results in existing security orchestration methods ignoring the differences in trustworthiness among network entities and focusing only on local trust optimization; these steps effectively disrupt the attack chains to secure SFCs. In this article, an innovative hierarchical trust model is proposed to assess the differentiated trustworthiness among network entities caused by vulnerability correlation. On the basis of trustworthiness assessment, both virtual trust of VNF combinations at the SFC composition stage and physical trust of physical node (PN) selections at the SFC placement stage are globally considered to disrupt the attack chains in SFCs as much as possible. To this end, the security-aware and cost-efficient SFC composition and placement (SCSCP) problem is formulated as an integer linear programming (ILP) problem, which is NP-hard. To tackle the SCSCP problem, the joint trust and cost global optimization (JTCGO) algorithm is proposed to dynamically update the trustworthiness and globally find the SFC deployment solutions including the VNF combination schemes and PN selection schemes. Simulation results demonstrate that our proposed algorithm can provide the optimal SFC deployment solutions for requests and can guarantee the SFC trustworthiness at a controllable cost, thereby protecting SFCs from network attacks in complex security environments.

Keywords

Service function chain (SFC) / Attack chain / Vulnerability correlation / Trustworthiness / SFC composition and placement

RIGHTS & PERMISSIONS

Zhejiang University Press