Cloud and MEC Security 391
16.6 Security Architectures for 5G Cloud and MEC
16.6.1 Centralized Security Architectures
The main benefit of centralization is the global visibility of network resource stats
and policy synchronization. There are, of course, challenges with centralization, such
as latency constraints, scalability and availability challenges; however, large systems that
are not very latency sensitive, and centralized systems have more benefits as stated.
Centralized control coupled with programmability enables run‐time adoption of the
network to the changing environment and business requirements. For example, if the traffic behavior changes, it will be beneficial to change the system behavior towards the
traffic as well. SDN is one such candidate that enables centralized control of the network
with programmability. The logically centralized control enabled by SDN brings dynamism
in network security systems by harvesting intelligence from the network equipment
through programmable Application Programming Interfaces (APIs). Using NFV, virtual
security functions can be placed at any network perimeter, whenever the need arises
using the programmable interfaces of SDN such as OpenFlow. In clouds and MEC scenarios, the security framework working as an SDN application can monitor the traffic or
resource requests coming towards MEC or cloud infrastructures at a run time to validate
the requests. In OpenFlow, each new request is forwarded to the centralized controller,
where it can check the authenticity of the user. The controller can check the user credentials through the management plane or other integrity verification system such as HSS in
the cellular domain. If the user is authentic, his request is served. If the user is malicious,
his subsequent flows are either dropped or forwarded to another system for further
analysis and counter actions [43]. Furthermore, the network administrator can prioritize
and de‐prioritize traffic, redirect or block traffic, change the security policies, and see the
user behavior through software from the centralized control point without configuring
individual devices. This minimizes the operational expenses (OpEx) for network operators. An integrated environment leveraging SDN‐based centralized control framework is
presented in Figure 16.6. With the centralized control platform, security services and
MEC Servers/
Cloud RAN
Access Networks
Backhaul Network
Control Signalling for Function/Service Placement
Data Flow
Security service Migration
Traffic
Monitoring
Security
Policy
Maleware
Detection
Packet
Inspection
SDN-based
Centralized Control
Data Centers
CDNs
Figure 16.6 Centralized security architecture for mobile clouds and MEC security.
16.6 Security Architectures for 5G Cloud and MEC
16.6.1 Centralized Security Architectures
The main benefit of centralization is the global visibility of network resource stats
and policy synchronization. There are, of course, challenges with centralization, such
as latency constraints, scalability and availability challenges; however, large systems that
are not very latency sensitive, and centralized systems have more benefits as stated.
Centralized control coupled with programmability enables run‐time adoption of the
network to the changing environment and business requirements. For example, if the traffic behavior changes, it will be beneficial to change the system behavior towards the
traffic as well. SDN is one such candidate that enables centralized control of the network
with programmability. The logically centralized control enabled by SDN brings dynamism
in network security systems by harvesting intelligence from the network equipment
through programmable Application Programming Interfaces (APIs). Using NFV, virtual
security functions can be placed at any network perimeter, whenever the need arises
using the programmable interfaces of SDN such as OpenFlow. In clouds and MEC scenarios, the security framework working as an SDN application can monitor the traffic or
resource requests coming towards MEC or cloud infrastructures at a run time to validate
the requests. In OpenFlow, each new request is forwarded to the centralized controller,
where it can check the authenticity of the user. The controller can check the user credentials through the management plane or other integrity verification system such as HSS in
the cellular domain. If the user is authentic, his request is served. If the user is malicious,
his subsequent flows are either dropped or forwarded to another system for further
analysis and counter actions [43]. Furthermore, the network administrator can prioritize
and de‐prioritize traffic, redirect or block traffic, change the security policies, and see the
user behavior through software from the centralized control point without configuring
individual devices. This minimizes the operational expenses (OpEx) for network operators. An integrated environment leveraging SDN‐based centralized control framework is
presented in Figure 16.6. With the centralized control platform, security services and
MEC Servers/
Cloud RAN
Access Networks
Backhaul Network
Control Signalling for Function/Service Placement
Data Flow
Security service Migration
Traffic
Monitoring
Security
Policy
Maleware
Detection
Packet
Inspection
SDN-based
Centralized Control
Data Centers
CDNs
Figure 16.6 Centralized security architecture for mobile clouds and MEC security.