A Priority-Based Domain Type Enforcement for Exception Management
Résumé
Network Function Virtualization (NFV) is introduced as a new methodology that offers several advantages such as the optimization of the resources and the improvement of network efficiency and performance. However, potential security issues are an important obstacle for a wide adoption of NFV. To reduce the risk of these security issues, the communication between the different components of the network service have to be controlled through the deployment of access control policies. Existing solutions allowing access control management on NFV services are suffering from at least one of the following limitations. First, the lack of generality by either requiring the modification of the NFV infrastructure or supporting only specific types of access control policies. Second, the unscalability when complex (i.e., policies containing exceptions and/or inconsistent rules) access control policies are to be deployed. To overcomes these limitations, in this paper, we propose a DTE-based access control model that can efficiently enforce complex policies. The experimental results show that, compared to similar existing solutions, our model reduces considerably (1) the complexity of the DTE specification to be deployed and (2) the impact in terms of network performance of the VNF in which policies are deployed.