Cost Optimization in Security-Aware Service Function Chain Deployment with Diverse Vendors

Frequent cyber-attacks force the service provider to employ security-aware service functions (SFs) to accommodate client network requests. Thanks to virtualization techniques' maturity, a security-aware SF can be provided by diverse vendors with various configurations, each of which needs various implementation cost and provides different security levels. When a client's network request comes, the multi-configuration SFs could compose various security-aware service function chains (S-SFCs) to flexibly satisfy the security requirement. In this paper, we investigate how to efficiently compose and embed an S-SFC to satisfy the client's security requirement. With the objective of cost optimization, we formulate the problem of security-aware service function chain deployment and prove its NP-hardness. We propose the technique of the security-cost-balance (SCB) factor to efficiently consider the capability of a physical node and the cost when the node is employed to satisfy the client's security requirement. Based on this technique, we develop an efficient algorithm called SCB-based S-SFC deployment (SCB-SD). The simulation results show that SCB-SD significantly outperforms the benchmarks directly extended from the state-of-the-art.

I. Introduction

Network function virtualization (NFV) is proposed to reduce capital expenditures (CAPEX) and operational expenses (OPEX) when accommodating clients' network services [1]. With NFV, the network functions required by the client are implemented with software-based modules called service functions (SFs). An NFV-enabled service request (NSR) generally includes a set of SFs and the corresponding resource demands (e.g., computation, bandwidth) [2]. To accommodate an NSR, the service provider must concatenate the required SFs into a service function chain (SFC) and deploy it over a shared physical network (PN). The above process is referred to as the service function chaining and embedding (SFCE) [3]. After the SFCE process, the carrier of an SF is referred to as the SF instance (SFI), and the physical forwarding path that hosts the SFC is called the service function path (SFP) [4].