Salo and Liyanage
408
Physical network functions assume a tight coupling of the Network Functions software and hardware which, in most cases, is provided by a single vendor. In the Network
Functions Virtualization (NFV) scenario, multiple vendors are expected to be involved
in the delivery and setup of different virtualized elements (e.g. hardware resources,
virtualization layer, virtualized network functions (VNF), virtualized infrastructure
manager, etc.). As a result, due to the virtualization process, new security issues need to
be addressed [24]. Examples are:
● The use of hypervisors may introduce additional security vulnerabilities. In general,
to reduce the vulnerabilities of hypervisors in use, it is essential to follow the best
practices on hardening and patch management;
● The usage of shared storage and shared networking may also add additional dimensions of vulnerability;
● The interconnectivity among the virtualized end‐to‐end architectural components
exposes new interfaces that, unless protected, can create new security threats;
● The execution of diverse VNFs over the NFV infrastructure can also create additional
security issues, if VNFs are not properly isolated from others.
According to Aclatel‐Lucent’s report on network virtualization [25], NFV will introduce several new security challenges:
● Due to the dispersion of virtual machines (VMs) that belong to a VNF across racks
and datacenters, and due to the migration of VMs for the optimization or maintenance purposes, the physical perimeters of the network functions become blurred
and “fluid”, making it practically impossible to manually define and manage
security zones;
● The introduction of hypervisors creates new attack surfaces that could result in,
among other things, compromised isolation between VMs;
● Hardware, hypervisors, VNFs and cloud resource control solutions may be provided
by different vendors, increasing the risk of security holes due to mismatched assumptions and expectations.
According to ETSI NFV ISG report on virtualization requirements [26], the NFV
framework shall implement appropriate security counter measures to address:
● security vulnerabilities introduced by the virtualization layer;
● protection of data stored on the shared storage resources or transmitted via shared
network resources;
● protection of new interfaces exposed by the interconnectivity among virtualized end‐
to‐end architectural components, e.g. hardware resources, VNFs and management
systems;
● isolation of distinct VNF sets executing over the NFV infrastructure to ensure security
and separation between these VNF sets;
● secure management of VNF sets by other third‐party entities (e.g. VNPaaS, enterprise
virtual CPE, and virtual consumer home gateways).
The NFV Infrastructure shall be able to use standard security mechanisms wherever
applicable to authentication, authorization, encryption and validation [26].
408
Physical network functions assume a tight coupling of the Network Functions software and hardware which, in most cases, is provided by a single vendor. In the Network
Functions Virtualization (NFV) scenario, multiple vendors are expected to be involved
in the delivery and setup of different virtualized elements (e.g. hardware resources,
virtualization layer, virtualized network functions (VNF), virtualized infrastructure
manager, etc.). As a result, due to the virtualization process, new security issues need to
be addressed [24]. Examples are:
● The use of hypervisors may introduce additional security vulnerabilities. In general,
to reduce the vulnerabilities of hypervisors in use, it is essential to follow the best
practices on hardening and patch management;
● The usage of shared storage and shared networking may also add additional dimensions of vulnerability;
● The interconnectivity among the virtualized end‐to‐end architectural components
exposes new interfaces that, unless protected, can create new security threats;
● The execution of diverse VNFs over the NFV infrastructure can also create additional
security issues, if VNFs are not properly isolated from others.
According to Aclatel‐Lucent’s report on network virtualization [25], NFV will introduce several new security challenges:
● Due to the dispersion of virtual machines (VMs) that belong to a VNF across racks
and datacenters, and due to the migration of VMs for the optimization or maintenance purposes, the physical perimeters of the network functions become blurred
and “fluid”, making it practically impossible to manually define and manage
security zones;
● The introduction of hypervisors creates new attack surfaces that could result in,
among other things, compromised isolation between VMs;
● Hardware, hypervisors, VNFs and cloud resource control solutions may be provided
by different vendors, increasing the risk of security holes due to mismatched assumptions and expectations.
According to ETSI NFV ISG report on virtualization requirements [26], the NFV
framework shall implement appropriate security counter measures to address:
● security vulnerabilities introduced by the virtualization layer;
● protection of data stored on the shared storage resources or transmitted via shared
network resources;
● protection of new interfaces exposed by the interconnectivity among virtualized end‐
to‐end architectural components, e.g. hardware resources, VNFs and management
systems;
● isolation of distinct VNF sets executing over the NFV infrastructure to ensure security
and separation between these VNF sets;
● secure management of VNF sets by other third‐party entities (e.g. VNPaaS, enterprise
virtual CPE, and virtual consumer home gateways).
The NFV Infrastructure shall be able to use standard security mechanisms wherever
applicable to authentication, authorization, encryption and validation [26].